The FISMA Focus IPD

On April 9, 2017, Maria Vullo, the New York Department of Financial Services (NYDFS) superintendent, pronounced to state insurance commissioners that New York’s new cybersecurity regulation could be the model for other states.

The new cybersecurity regulation went into effect on March 1 and requires certain financial services companies licensed under New York law, including insurance companies, to maintain a robust cybersecurity program. This mandate applies far and wide to a range of licensed entities. Various commenters have expressed concerns over how burdensome the requirements can be for small businesses. Notwithstanding this objection, Superintendent Vullo expressed that states should have a “consistent framework” and the “New York regulation is a road map with rules of the road.”