News

New York calls for consistent nationwide cybersecurity standards

April 10, 2017

New York is making the case that other U.S. states should use New York's comprehensive new cybersecurity rules as a model as they develop regulatory frameworks aimed at preventing cyberattacks — and specifying how the public should be notified if a breach does occur, a report by Reuters said.

"We believe the best way for industry to focus on the threat of cyber security is to have a consistent framework," Maria Vullo, superintendent of the New York State Department of Financial Services, said at a meeting of the National Association of Insurance Commissioners on Saturday in Denver. "The New York regulation is a road map with rules of the road."

Among other requirements, the New York rules require that companies scrutinize security at third-party vendors and perform risk assessments for the purposes of designing their own cybersecurity programs, which must be certified annually by the state.

The rules took effect March 1 and apply to state-chartered banks as well as insurers and foreign banks that do business in the state, Reuters said.