4 Step Guide To NYDFS 500.11 Compliance
Tags: New York, Information Security, Risk Management, Cybersecurity, Ciso

Whistic has seen a steady uptick in questions and chatter regarding NYDFS deadlines the past few weeks. By now, you know the clock is ticking on Phase 4 of 23 NYCRR Part 500, more specifically termed 500.11 Third-Party Service Providers. There is a reason for the lead time in this section’s requirements, the first certification due for compliance is March 2020 due to the involved nature of managing third party vendors. This means that a covered entity’s policy must be in effect March 1, 2019 in order to be able to provide TSP (Third-Party Service Providers) compliance certifications 12 months down the road.

Experts have speculated NYDFS could calculate penalties according to the New York Banking Law which in a nutshell state fines of $2,500 per day during which a violation continues, $15,000 per day in the event of any reckless or unsound practice or pattern of misconduct, or $75,000 per day in the event of a knowing and willful violation. It is believed that those in violation won’t find out the degree of enforcement until they are presented with a reprimand, inclusive of any corresponding fine. Definitely nothing any business entity wants to risk experiencing firsthand.

If you have sorted through The New York State Department of Financial Services Cybersecurity Resource Center, you may still have questions as to what is required in each phase & how to quickly get compliant in time for the coming deadline. Below is a 4 Step NYDFS 500.11 Compliance Guide to assist covered entities working to comply, or to audit existing progress against by the March 1, 2019 deadline.

STEP 1: Understand Exactly What’s Required in 500.11

In-short, establish a cybersecurity risk management program (written policies & procedures) under the jurisdiction of a CISO. The monitoring of all third-party vendors must be included within these policies & procedures. Four sections are detailed in 500.11 including: (1) the identification and risk assessment of Third Party Service Providers; (2) minimum cybersecurity practices required to be met by Third Party Service Providers in order for them to do business with the Covered Entity; (3) due diligence processes used to evaluate the adequacy of cybersecurity practices of Third Party Service Providers; and (4) periodic assessment of such Third Party Service Providers based on the risk they present. Number Four expands quite a bit including access controls, encryption & warranties; certainly worth a closer look.

Similar to HIPAA, entities covered by 23 NYCRR Part 500 may be liable for breaches caused by any vendor with access to the covered entity’s systems. One thing to consider here, to be in compliance with 23 NYCRR 500, this also obligates your third-party service providers to comply.

STEP 2: Draft Your Third Party Written Policies and Procedures

Think of this step as essentially implementing Service Level Agreements (SLAs) in order for your third parties to understand, your security policies in writing. To put this simply, contemplate your ecosystem, how many vendors have access to sensitive data? Understand risk based on your vendors, namely based on how they interact with your data and let this dictate the policies you are setting and/or amending. Core sections of your SLA should include:

Information privacy

Information security

Network and data access

Threat and risk analysis

Compliance verification process

Breach disclosure reporting requirements

As part of these requirements, it’s always a good idea to check adherence to NIST (SP) 800–171 guidelines and SANS Critical Security Controls.

Be sure to check out additional useful information from industry-leading cybersecurity resources:

https://cloudsecurityalliance.org/

www.vendorsecurityalliance.org

https://sharedassessments.org/

https://www.privacyshield.gov/welcome

https://www.cisecurity.org/

STEP 3: Evaluate Your Third Parties

Now that you have your policies & procedures, it’s time to start the process of assessing vendors. Basic steps for this process include:

Review all contracts with third party relationships & amend these where necessary to incorporate the new DFS requirements.

Evaluate limiting customer or non-public data to as few third parties as possible, thus limiting your exposure.

Request third party certifications and audits

Ask tough questions about the vendor’s cybersecurity risk management program.

Understand where the data is stored, because many vendors have multiple data centers.

Have documented plans for dealing with data breaches if and when they occur.

If you are planning for scale and into future-proofing, a plan to automate ongoing Third Party Risk Management has already crossed your mind. Pro tip, get the right tool for the job when it comes to Third Party Risk Management (TPRM). Far too often businesses implement systems that don’t actually do what they need it to, wasting time, budget & resources; returning them to square one to hunt for something that actually does the work that needs to be done. Whistic is the only complete Vendor Security Platform that enables any company to both conduct & respond to security reviews.

Whistic related reading for this step:

6 Ways Compliance Teams Can Benefit From Using Whistic

How Whistic Helps Tech Companies Start Up a Vendor Risk Management Program

STEP 4: Establish Your Security Profile

Third Party Vendor Management cuts both ways in this instance, so if you are a covered entity you are likely doing business, consuming or providing data, with other covered entities; and are therefore subject to the same requirements as a third party of that company. Whistic recommends a living, breathing record of your company’s security and compliance posture that you can use to respond to inbound security reviews from your customers, prospects, regulators or partners.

This sort of Security Profile is especially helpful for financial services organizations that are highly regulated and compliance-driven. A Security Profile is not just a storage unit for security and compliance documentation, but a scalable tool that enables you to not only proactively share your security posture, but save significant time and money moving forward since this supplants the necessity to fill out a security questionnaire every time a third party sends you one.

While this may be somewhat taxing or stressful for NYFS covered entities currently, it appears they may be ahead of the curve when one considers evolving regulations rolling out at state, national, and even worldwide levels. At least 24 states have laws that address data security practices of private sector entities, which is double what it was just 2 years prior according to The National Conference of State Legislatures.