article thumbnail

Proposed Amendments to NY Financial Services Cybersecurity Regulations Impose New Obligations on Large Entities, Boards of Directors and CISOs

Hunton Privacy

As part of the “training and monitoring” requirements under Section 500.14 A covered entity’s cyber program must include phishing training and exercises, as well as monitoring and filtering of emails to block malicious content. As part of the “risk assessment” requirements under Section 500.9

article thumbnail

NYDFS proposes significant cybersecurity regulation amendments

Data Protection Report

The draft amendments would also require that relevant employees be trained for their implementation. Covered entities must also periodically test their incident response plans (including “disruptive events such as ransomware,” which NYDFS specifically would require) and their ability to restore systems from backups.