New York state’s upcoming cybersecurity regulation for financial services organizations is gearing up to be one of the most impactful and far-reaching cybersecurity standards in the nation. Though panned by counsel and financial industry groups, the regulation, which has gone through multiple minor revisions, is set to take effect on March 1, after which companies have 180 days (until Sept. 1) to comply.
While ostensibly focused on financial services firms, the new cybersecurity rules will affect companies far beyond the financial industry by requiring any company serving or doing business with a New York financial services “covered entity” to build out and document robust information security processes and procedures. Such an obligation is inevitably one in which counsel will play a significant role in meeting.
