FAQs For Nov 1st 2024

What is NY DFS Requiring from ALL covered entities?

• Mandatory Reports: Your CISO, or designated qualified Cybersecurity Expert, must now submit written reports detailing plans to address any inadequacies and plans for remediation. Significant cybersecurity events or changes must be reported to senior leadership and DFS—failure to do so could lead to serious repercussions. 
• Updated Security Policies & Encryption: Your written information security policy needs to meet the new encryption requirements, for both cloud and local devices. If this isn’t done, your organization could be left exposed. 
• Incident Response & Business Continuity: These plans must be updated, rigorously tested, and maintained according to the new guidelines. Any lapse here could be disastrous in the event of a breach. 
• Multifactor Authentication: In use for any local and remote access to information systems, third party applications, and privileged accounts.
• Cybersecurity Training: All employees must have, at minimum, annual training that also covers social engineering, phishing, business email compromise, and techniques enhanced by AI like deepfakes.
  

When do I need to comply by?

You must be in compliance of all of the above items on or before November 1st 2024.