On February 23, the New York Department of Financial Services (DFS) issued four additional frequently asked questions and responses (FAQs) relating to its new cybersecurity regulation (Part 500).1 Part 500, several provisions of which became effective on March 1, 2017, has garnered widespread attention from banks, insurance companies and other financial services firms. Covered Entities were required to submit the first annual certifications of compliance to the DFS by February 15, 2018. The four new FAQs supplement earlier releases of FAQs in 2017.2
As previously discussed (here, here, and here), Part 500 requires Covered Entities to adopt and maintain a cybersecurity program and corresponding cybersecurity policies and procedures. Although in some ways Part 500 is similar to federal requirements and guidance on cybersecurity for banks and securities firms, it differs in details and imposes substantial reporting obligations. Covered Entities are now required to be in compliance with the majority of the regulation’s requirements. Additional requirements of Part 500 related to risk assessments, penetration testing and vulnerability assessments, multi-factor authentication, and risk-based training phase in between March 1, 2018 and March 1, 2019.
These new FAQs are issued as the New York financial services industry prepares for the first wave of DFS examinations that will evaluate a Covered Entity’s compliance with Part 500. In January, Superintendent Vullo announced that the “DFS will now be incorporating cybersecurity in all examinations, including adding questions related to cybersecurity to ‘first day letters[.]'”3 Such examinations may lead to matters requiring attention and, potentially, subsequent enforcement actions.
The new FAQs provide additional guidance as Covered Entities continue to navigate compliance with Part 500. Specifically, three of the new FAQs provide guidance on determining whether certain classes of companies qualify as Covered Entities and, thus, are subject to Part 500. The DFS’ analyses focus on whether a company is “authorized” so as to fit within the definition of Covered Entity under Section 500.01(c). New FAQ #3 clarifies Covered Entities’ obligations when considering merger and acquisition-related strategic options, including that various aspects of the entity’s cybersecurity program must be periodically reviewed and tailored to the risk profile of the resulting entity and that cybersecurity due diligence should be prioritized. Although most acquirors already follow sophisticated due diligence processes when evaluating strategic opportunities, the new FAQ underscores the importance of demonstrating to the DFS that cybersecurity was a key consideration.
The four new FAQs are reproduced below.
Are Exempt Mortgage Servicers Covered Entities under 23 NYCRR 500?
Under N.Y. Bank Law § 590(2)(b-1), an exempt entity will need to prove its “exempt organization” status. Since the notification is not an authorization from the Department, an Exempt Mortgage Servicer, under N.Y. Bank Law § 590(2)(b-1), will not fit the definition of a Covered Entity under 500.01(c). However, Exempt Mortgage Loan Servicers that also hold a license, registration, or received approval under the provisions of Part 418.2(e) are required to prove exemption and comply with regulation. With respect to DFS’s cybersecurity regulation, given the ever-increasing cybersecurity risks that financial institutions face, DFS strongly encourages all financial institutions, including exempt Mortgage Servicers, to adopt cybersecurity protections consistent with the safeguards and protections of 23 NYCRR Part 500.
Are Not-for-profit Mortgage Brokers Covered Entities under 23 NYCRR 500?
Yes. Not-for-profit Mortgage Brokers are Covered Entities under 23 NYCRR 500. 3 NYCRR Part 39.4(e) provides that Mortgage Brokers “which seek exemption may submit a letter application” to the Mortgage Banking unit of the Department at the address set forth in section 1.1 of Supervisory Policy G 1, “together with such information as may be prescribed by” the Superintendent. As this authorization is necessary for a Not-for-profit Mortgage Broker, it is a Covered Entity under 23 NYCRR 500.
Do Covered Entities have any obligations when acquiring or merging with a new company?
Section 500.09(a) states that the “Risk Assessment shall be updated as reasonably necessary to address changes to the Covered Entity’s Information Systems, Nonpublic Information or business operations.” Furthermore, Section 500.08(b) states that the institution’s application security “procedures, guidelines and standards shall be periodically reviewed, assessed and updated as necessary by the CISO (or a qualified designee) of the Covered Entity.” As such, when Covered Entities are acquiring or merging with a new company, Covered Entities will need to do a factual analysis of how these regulatory requirements apply to that particular acquisition. Some important considerations include, but are not limited to, what business the acquired company engages in, the target company’s risk for cybersecurity including its availability of PII, the safety and soundness of the Covered Entity, and the integration of data systems. The Department emphasizes that Covered Entities need to have a serious due diligence process and cybersecurity should be a priority when considering any new acquisitions.
Are Health Maintenance Organizations (HMOs) and continuing care retirement communities (CCRCs) Covered Entities?
Yes. Both HMOs and CCRCs are Covered Entities. Pursuant to the Public Health Law, HMOs must receive authorization and prior approval of the forms they use and the rates they charge for comprehensive health insurance in New York. The Public Health Law subjects HMOs to DFS authority by making provisions of the Insurance Law applicable to them. CCRCs are required by Insurance Law Section 1119 to have contracts and rates reviewed and authorized by DFS. The Public Health Law also subjects HMOs and CCRCs to the examination authority of the Department. As this authorization is fundamental to the ability to conduct their businesses, HMOs and CCRCs are Covered Entities because they are “operating under or required to operate under” DFS authorizations pursuant to the Insurance Law. Moreover, since these entities have sensitive, private data, their compliance with cybersecurity protection is necessary.4
* * *
Covered Entities interested in assistance with implementing measures to comply with Part 500 are encouraged to contact any of the authors listed below or your Arnold & Porter contact. The Firm’s financial services team would be pleased to assist with any questions you may have about Part 500, upcoming examinations, or cybersecurity compliance more broadly.