Showing 160 controls
500.7.a
As part of its cybersecurity program, based on the covered entity’s risk assessment each covered entity shall:
500.7.a.1
limit user access privileges to information systems that provide access to nonpublic information to only those necessary to perform the user’s job;
500.7.a.2
limit the number of privileged accounts and limit the access functions of privileged accounts to only those necessary to perform the user’s job;
500.7.a.3
limit the use of privileged accounts to only when performing functions requiring the use of such access;
500.7.a.4
periodically, but at a minimum annually, review all user access privileges and remove or disable accounts and access that are no longer necessary;
500.7.a.5
disable or securely configure all protocols that permit remote control of devices; and
500.7.a.6
promptly terminate access following departures.
500.7.b
To the extent passwords are employed as a method of authentication, the covered entity shall implement a written password policy that meets industry standards.
500.7.c
Each class A company shall monitor privileged access activity and shall implement:
500.7.c.1
a privileged access management solution; and
500.7.c.2
an automated method of blocking commonly used passwords for all accounts on information systems owned or controlled by the class A company and wherever feasible for all other accounts. To the extent t...
500.8.a
Each covered entity’s cybersecurity program shall include written procedures, guidelines and standards designed to ensure the use of secure development practices for in-house developed applications ut...
500.8.b
All such procedures, guidelines and standards shall be reviewed, assessed and updated as necessary by the CISO (or a qualified designee) of the covered entity at least annually.
500.13.a
As part of its cybersecurity program, each covered entity shall implement written policies and procedures designed to produce and maintain a complete, accurate and documented asset inventory of the co...
500.13.a.1
a method to track key information for each asset, including, as applicable, the following:
500.13.a.1.i
owner;
500.13.a.1.ii
location;
500.13.a.1.iii
classification or sensitivity;
500.13.a.1.iv
support expiration date; and
500.13.a.1.v
recovery time objectives; and
500.13.a.2
the frequency required to update and validate the covered entity’s asset inventory.
500.13.b
As part of its cybersecurity program, each covered entity shall include policies and procedures for the secure disposal on a periodic basis of any nonpublic information identified in section 500.1(k)(...
500.6.a
Each covered entity shall securely maintain systems that, to the extent applicable and based on its risk assessment:
500.6.a.1
are designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the covered entity; and
500.6.a.2
include audit trails designed to detect and respond to cybersecurity events that have a reasonable likelihood of materially harming any material part of the normal operations of the covered entity.
500.6.b
Each covered entity shall maintain records required by paragraph (a)(1) of this section for not fewer than five years and shall maintain records required by paragraph (a)(2) of this section for not fe...
Chief information security officer
Each covered entity shall designate a CISO. The CISO may be employed by the covered entity, one of its affiliates or a third-party service provider. If the CISO is employed by a third-party service pr...
500.4.a.1
retain responsibility for compliance with this Part;
500.4.a.2
designate a senior member of the covered entity’s personnel responsible for direction and oversight of the third-party service provider; and
500.4.a.3
require the third-party service provider or affiliate to maintain a cybersecurity program that protects the covered entity in accordance with the requirements of this Part.
Report
The CISO of each covered entity shall report in writing at least annually to the senior governing body on the covered entity’s cybersecurity program, including to the extent applicable:
500.4.b.1
the confidentiality of nonpublic information and the integrity and security of the covered entity’s information systems;
500.4.b.2
the covered entity’s cybersecurity policies and procedures;
500.4.b.3
material cybersecurity risks to the covered entity;
500.4.b.4
overall effectiveness of the covered entity’s cybersecurity program;
500.4.b.5
material cybersecurity events involving the covered entity during the time period addressed by the report; and
500.4.b.6
plans for remediating material inadequacies.
500.4.c
The CISO shall timely report to the senior governing body or senior officer(s) on material cybersecurity issues, such as significant cybersecurity events and significant changes to the covered entity’...
500.4.d
The senior governing body of the covered entity shall exercise oversight of the covered entity’s cybersecurity risk management, including by:
500.4.d.1
having sufficient understanding of cybersecurity-related matters to exercise such oversight, which may include the use of advisors;
500.4.d.2
requiring the covered entity’s executive management or its designees to develop, implement and maintain the covered entity’s cybersecurity program;
500.4.d.3
regularly receiving and reviewing management reports about cybersecurity matters; and
500.4.d.4
confirming that the covered entity’s management has allocated sufficient resources to implement and maintain an effective cybersecurity program.
500.10.a.1
utilize qualified cybersecurity personnel of the covered entity, an affiliate or a third- party service provider sufficient to manage the covered entity’s cybersecurity risks and to perform or oversee...
500.10.a.2
provide cybersecurity personnel with cybersecurity updates and training sufficient to address relevant cybersecurity risks; and
500.10.a.3
verify that key cybersecurity personnel take steps to maintain current knowledge of changing cybersecurity threats and countermeasures.
500.10.b
A covered entity may choose to utilize an affiliate or qualified third-party service provider to assist in complying with the requirements set forth in this Part, subject to the requirements set forth...
500.3.a
information security;
500.3.b
data governance, classification and retention;
500.3.c
asset inventory, device management and end of life management;
500.3.d
access controls, including remote access and identity management;
500.3.e
business continuity and disaster recovery planning and resources;
500.3.f
systems operations and availability concerns;
500.3.g
systems and network security and monitoring;
500.3.h
security awareness and training;
500.3.i
systems and application security and development and quality assurance;
500.3.j
physical security and environmental controls;
500.3.k
customer data privacy;
500.3.l
vendor and third-party service provider management;
500.3.m
risk assessment;
500.3.n
incident response and notification; and
500.3.o
vulnerability management.
500.2.a
Each covered entity shall maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the covered entity’s information systems and nonpublic information sto...
500.2.b
The cybersecurity program shall be based on the covered entity’s risk assessment and designed to perform the following core cybersecurity functions:
500.2.b.1
identify and assess internal and external cybersecurity risks that may threaten the security or integrity of nonpublic information stored on the covered entity’s information systems;
500.2.b.2
use defensive infrastructure and the implementation of policies and procedures to protect the covered entity’s information systems, and the nonpublic information stored on those information systems, f...
500.2.b.3
detect cybersecurity events;
500.2.b.4
respond to identified or detected cybersecurity events to mitigate any negative effects;
500.2.b.5
recover from cybersecurity events and restore normal operations and services; and
500.2.b.6
fulfill applicable regulatory reporting obligations.
500.2.c
Each class A company shall design and conduct independent audits of its cybersecurity program based on its risk assessment.
500.2.d
A covered entity may meet the requirement(s) of this Part by adopting the relevant and applicable provisions of a cybersecurity program maintained by an affiliate, provided that such provisions satisf...
500.2.e
All documentation and information relevant to the covered entity’s cybersecurity program, including the relevant and applicable provisions of a cybersecurity program maintained by an affiliate and ado...
500.15.a
As part of its cybersecurity program, each covered entity shall implement a written policy requiring encryption that meets industry standards, to protect nonpublic information held or transmitted by t...
500.15.b
To the extent a covered entity determines that encryption of nonpublic information at rest is infeasible, the covered entity may instead secure such nonpublic information using effective alternative c...
Limited exemption
Each covered entity with: (1) fewer than 20 employees and independent contractors of the covered entity and its affiliates; (2) less than $7,500,000 in gross annual revenue in each of the last three f...
500.19.b
An employee, agent, wholly owned subsidiary, representative or designee of a covered entity, who is itself a covered entity, is exempt from this Part and need not develop its own cybersecurity program...
500.19.c
A covered entity that does not directly or indirectly operate, maintain, utilize or control any information systems, and that does not, and is not required to, directly or indirectly control, own, acc...
500.19.d
A covered entity under article 70 of the Insurance Law that does not and is not required to directly or indirectly control, own, access, generate, receive or possess nonpublic information other than i...
500.19.e
An individual insurance broker subject to Insurance Law section 2104 who qualifies for the exemption pursuant to subdivision 500.19(c) of this Part and has not, for any compensation, commission or oth...
500.19.f
A covered entity that qualifies for any of the above exemptions pursuant to this section shall file electronically a Notice of Exemption in the form set forth on the department’s website within 30 day...
500.19.g
The following persons are exempt from the requirements of this Part, provided such persons do not otherwise qualify as a covered entity for purposes of this Part: persons subject to Insurance Law sect...
500.19.h
In the event that a covered entity ceases to qualify for an exemption, such covered entity shall have 180 days from the date that it ceases to so qualify to comply with all applicable requirements of...
500.24.a
A filer required to make an electronic filing or a submission pursuant to this Part may apply to the superintendent for an exemption from the requirement that the filing or submission be electronic by...
500.24.b.1
set forth the filer’s DFS license number, NAIC number, Nationwide Multistate Licensing System number or institution number;
500.24.b.2
identify the specific filing or submission for which the filer is applying for the exemption;
500.24.b.3
specify whether the filer is making the request for an exemption based upon undue hardship, impracticability or good cause, and set forth a detailed explanation as to the reason that the superintenden...
500.24.b.4
specify whether the request for an exemption extends to future filings or submissions, in addition to the specific filing or submission identified in paragraph (2) of this subdivision.
500.24.c
The filer requesting an exemption shall submit, upon the superintendent’s request, any additional information necessary for the superintendent to evaluate the filer’s request for an exemption.
500.24.d
The filer shall be exempt from the electronic filing or submission requirement upon the superintendent’s written determination so exempting the filer, where the determination specifies the basis upon...
500.24.e
If the superintendent approves a filer’s request for an exemption from the electronic filing or submission requirement, then the filer shall make a filing or submission in a form and manner acceptable...
500.16.a
As part of its cybersecurity program, each covered entity shall establish written plans that contain proactive measures to investigate and mitigate cybersecurity events and to ensure operational resil...
Incident response plan
Incident response plans shall be reasonably designed to enable prompt response to, and recovery from, any cybersecurity event materially affecting the confidentiality, integrity or availability of the...
500.16.a.1.i
the goals of the incident response plan;
500.16.a.1.ii
the internal processes for responding to a cybersecurity event;
500.16.a.1.iii
the definition of clear roles, responsibilities and levels of decision-making authority;
500.16.a.1.iv
external and internal communications and information sharing;
500.16.a.1.ix
updating of incident response plans as necessary.
500.16.a.1.v
identification of requirements for the remediation of any identified weaknesses in information systems and associated controls;
500.16.a.1.vi
documentation and reporting regarding cybersecurity events and related incident response activities;
500.16.a.1.vii
recovery from backups;
500.16.a.1.viii
preparation of root cause analysis that describes how and why the event occurred, what business impact it had, and what will be done to prevent reoccurrence; and
Business continuity and disaster recovery (BCDR) plan
BCDR plans shall be reasonably designed to ensure the availability and functionality of the covered entity’s information systems and material services and protect the covered entity’s personnel, asset...
500.16.a.2.i
identify documents, data, facilities, infrastructure, services, personnel and competencies essential to the continued operations of the covered entity’s business;
500.16.a.2.ii
identify the supervisory personnel responsible for implementing each aspect of the BCDR plan;
500.16.a.2.iii
include a plan to communicate with essential persons in the event of a cybersecurity-related disruption to the operations of the covered entity, including employees, counterparties, regulatory authori...
500.16.a.2.iv
include procedures for the timely recovery of critical data and information systems and to resume operations as soon as reasonably possible following a cybersecurity-related disruption to normal busin...
500.16.a.2.v
include procedures for backing up or copying, with sufficient frequency, information essential to the operations of the covered entity and storing such information offsite; and
500.16.a.2.vi
identify third parties that are necessary to the continued operations of the covered entity’s information systems.
500.16.b
Each covered entity shall ensure that current copies of the plans or relevant portions therein are distributed or are otherwise accessible, including during a cybersecurity event, to all employees nec...
500.16.c
Each covered entity shall provide relevant training to all employees responsible for implementing the plans regarding their roles and responsibilities.
500.16.d
Each covered entity shall periodically, but at a minimum annually, test its:
500.16.d.1
incident response and BCDR plans with all staff and management critical to the response, and shall revise the plan as necessary; and
500.16.d.2
ability to restore its critical data and information systems from backups.
500.16.e
Each covered entity shall maintain backups necessary to restore material operations. The backups shall be adequately protected from unauthorized alterations or destruction.
500.14.a.1
implement risk-based policies, procedures and controls designed to monitor the activity of authorized users and detect unauthorized access or use of, or tampering with, nonpublic information by such a...
500.14.a.2
implement risk-based controls designed to protect against malicious code, including those that monitor and filter web traffic and electronic mail to block malicious content; and
500.14.a.3
provide periodic, but at a minimum annual, cybersecurity awareness training that includes social engineering for all personnel that is updated to reflect risks identified by the covered entity in its...
500.14.b
Each class A company shall implement, unless the CISO has approved in writing the use of reasonably equivalent or more secure compensating controls:
500.14.b.1
an endpoint detection and response solution to monitor anomalous activity, including but not limited to lateral movement; and
500.14.b.2
a solution that centralizes logging and security event alerting.
500.12.a
Multi-factor authentication shall be utilized for any individual accessing any information systems of a covered entity, unless the covered entity qualifies for a limited exemption pursuant to section...
500.12.a.1
remote access to the covered entity’s information systems;
500.12.a.2
remote access to third-party applications, including but not limited to those that are cloud based, from which nonpublic information is accessible; and
500.12.a.3
all privileged accounts other than service accounts that prohibit interactive login.
500.12.b
If the covered entity has a CISO, the CISO may approve in writing the use of reasonably equivalent or more secure compensating controls. Such controls shall be reviewed periodically, but at a minimum...
500.17.a.1
Each covered entity shall notify the superintendent electronically in the form set forth on the department’s website as promptly as possible but in no event later than 72 hours after determining that...
500.17.a.2
Each covered entity shall promptly provide to the superintendent any information requested regarding such incident. Covered entities shall have a continuing obligation to update the superintendent wit...
500.17.b.1
Annually each covered entity shall submit to the superintendent electronically by April 15 either:
500.17.b.1.i
a written certification that:
500.17.b.1.i.a
certifies that the covered entity materially complied with the requirements set forth in this Part during the prior calendar year; and
500.17.b.1.i.b
shall be based upon data and documentation sufficient to accurately determine and demonstrate such material compliance, including, to the extent necessary, documentation of officers, employees, repres...
500.17.b.1.ii
a written acknowledgment that:
500.17.b.1.ii.a
acknowledges that, for the prior calendar year, the covered entity did not materially comply with all the requirements of this Part;
500.17.b.1.ii.b
identifies all sections of this Part that the entity has not materially complied with and describes the nature and extent of such noncompliance; and
500.17.b.1.ii.c
provides a remediation timeline or confirmation that remediation has been completed.
500.17.b.2
Such certification or acknowledgment shall be submitted electronically in the form set forth on the department’s website and shall be signed by the covered entity’s highest-ranking executive and its C...
500.17.b.3
Each covered entity shall maintain for examination and inspection by the department upon request all records, schedules and other documentation and data supporting the certification or acknowledgment...
Notice and explanation of extortion payment
Each covered entity, in the event of an extortion payment made in connection with a cybersecurity event involving the covered entity, shall provide the superintendent electronically, in the form set f...
500.17.c.1
within 24 hours of the extortion payment, notice of the payment; and
500.17.c.2
within 30 days of the extortion payment, a written description of the reasons payment was necessary, a description of alternatives to payment considered, all diligence performed to find alternatives t...
500.9.a
Each covered entity shall conduct a periodic risk assessment of the covered entity’s information systems sufficient to inform the design of the cybersecurity program as required by this Part. Such ris...
500.9.b
The risk assessment shall be carried out in accordance with written policies and procedures and shall be documented. Such policies and procedures shall include:
500.9.b.1
criteria for the evaluation and categorization of identified cybersecurity risks or threats facing the covered entity;
500.9.b.2
criteria for the assessment of the confidentiality, integrity, security and availability of the covered entity’s information systems and nonpublic information, including the adequacy of existing contr...
500.9.b.3
requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the cybersecurity program will address the risks.
500.11.a
Each covered entity shall implement written policies and procedures designed to ensure the security of information systems and nonpublic information that are accessible to, or held by, third-party ser...
500.11.a.1
the identification and risk assessment of third-party service providers;
500.11.a.2
minimum cybersecurity practices required to be met by such third-party service providers in order for them to do business with the covered entity;
500.11.a.3
due diligence processes used to evaluate the adequacy of cybersecurity practices of such third-party service providers; and
500.11.a.4
periodic assessment of such third-party service providers based on the risk they present and the continued adequacy of their cybersecurity practices.
500.11.b
Such policies and procedures shall include relevant guidelines for due diligence and/or contractual protections relating to third-party service providers including to the extent applicable guidelines...
500.11.b.1
the third-party service provider’s policies and procedures for access controls, including its use of multi-factor authentication as required by section 500.12 of this Part, to limit access to relevant...
500.11.b.2
the third-party service provider’s policies and procedures for use of encryption as required by section 500.15 of this Part to protect nonpublic information in transit and at rest;
500.11.b.3
notice to be provided to the covered entity in the event of a cybersecurity event directly impacting the covered entity’s information systems or the covered entity’s nonpublic information being held b...
500.11.b.4
representations and warranties addressing the third-party service provider’s cybersecurity policies and procedures that relate to the security of the covered entity’s information systems or nonpublic...
500.5.a.1
penetration testing of their information systems from both inside and outside the information systems’ boundaries by a qualified internal or external party at least annually; and
500.5.a.2
automated scans of information systems, and a manual review of systems not covered by such scans, for the purpose of discovering, analyzing and reporting vulnerabilities at a frequency determined by t...
500.5.b
are promptly informed of new security vulnerabilities by having a monitoring process in place; and
500.5.c
timely remediate vulnerabilities, giving priority to vulnerabilities based on the risk they pose to the covered entity.