Source: https://www.lexblog.com/2018/07/06/nydfs-requires-consumer-credit-reporting-agencies-to-comply-with-cybersecurity-regulation/
Timestamp: 2020-08-09 12:15:12
Document Index: 100308070

Matched Legal Cases: ['§ 500', '§ 500', '§ 500', '§ 500', '§ 500', '§ 500', '§ 500', '§ 500', '§ 500', '§ 500', '§ 500', '§ 500', '§ 500', '§ 500', '§ 500', '§ 500', '§ 500', '§ 500', '§ 500']

NYDFS Requires Consumer Credit Reporting Agencies to Comply with Cybersecurity Regulation | LexBlog
By Edward J. McAndrew, James Kim & John L. Culhane, Jr.
A CCRA must register with the NYDFS if “within the previous 12-month period, [it] has assembled, evaluated, or maintained a consumer credit report on one thousand or more New York consumers.” Every CCRA “that is required to register…at any time between June 1, 2018 and September 1, 2018” must register by September 15, 2018. Registration must be renewed by February 1, 2019 for the 2019 calendar year and by February 1 of each year thereafter.
A CCRA that is required to register with the NYDFS must comply with all material provisions of the NYDFS cybersecurity regulation. The NYDFS has established different compliance deadlines for particular requirements of the cybersecurity regulation. Each registered CCRA must comply with the following provisions by November 1, 2018:
Cybersecurity Program — § 500.02
Cybersecurity Policy — § 500.03
Chief Information Security Officer — § 500.04(a)
Access Privileges — § 500.07
Cybersecurity Personnel & Intelligence — § 500.10
Incident Response Plan — § 500.16
Notices to Superintendent — § 500.17
CCRAs that must register will be entitled to the confidentiality protections of cybersecurity regulation (§ 500.18) as of November 1, 2018, which is also the date on which the NYDFS will begin enforcement of the cybersecurity regulation against CCRAs. As to enforcement, the new regulation also expressly prohibits registered CCRAs from engaging in any “unfair, deceptive, or predatory act or practice toward any consumer that is prohibited by any federal law, or by any New York State law that is not preempted by federal law,” or engaging in “any unfair, deceptive, or abusive act or practice in violation of section 1036 of the [Dodd-Frank Act].”
Each registered CCRA must comply with the following provisions by February 28, 2019:
CISO Report to the Board of Directors — § 500.04(b)
Penetration Testing & Vulnerability Assessments — § 500.05
Risk Assessment — § 500.09
Multi-factor Authentication — § 500.12
Training & Monitoring — § 500.14(a)(2) — Because Section 500.14 does not contain a subsection (a)(2), we suspect the NYDFS meant to reference the training requirement contained in Section 500.14(b).
Each registered CCRA must comply with the following provisions by August 31, 2019:
Audit Trail — § 500.06
Application Security — § 500.08
Limitations on Data Retention — § 500.13
Training & Monitoring — § 500.14(a)(1) — Because Section 500.14 does not contain a subsection (a)(1), we suspect the NYDFS meant to reference the monitoring requirement contained in Section 500.14(a).
Encryption of Nonpublic Information — § 500.15
Finally, each registered CCRA must comply with the following provision by December 31, 2019:
Third Party Service Provider Security Policy — § 500.11
In directing the NYDFS to issue the new CCRA regulation, Governor Cuomo stated: “As the federal government weakens consumer protections, New York is strengthening them with these new standards. Oversight of credit reporting agencies ensures that the personal private information of New Yorkers is less vulnerable to the threat of cyber-attacks, providing them with peace of mind about their financial future.”