reglab/statecodes huggingface dataset:
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 201 - Registration Requirements and Prohibited Practices for Credit Reporting Agencies › Section 201.4 - Information Reporting Requirements

Current through Register Vol. 46, No. 28, July 10, 2024
(a) On or before July first of each year,
				beginning in 2019, every consumer credit reporting agency that is required to
				be registered pursuant to section 201.02 of this Part shall report to the
				superintendent, in a statement subscribed and affirmed as true under penalties
				of perjury, the information requested by the superintendent. The superintendent
				also may require the filing of quarterly or other statements, which shall be in
				such form and shall contain such matters as the superintendent shall
				prescribe.
(b) The superintendent
				also may address to any consumer credit reporting agency that is required to be
				registered pursuant to section 201.02 of this Part any inquiry in relation to
				the assembly, evaluation, or maintenance of any consumer credit report on any
				consumers located in New York. Every consumer credit reporting agency or person
				so addressed shall reply in writing to such inquiry promptly and truthfully,
				and such reply shall be, if required by the superintendent, subscribed by such
				individual, or by such officer or officers of the consumer credit reporting
				agency, as the superintendent shall designate, and affirmed by them as true
				under the penalties of perjury.
(c)
				All information disclosed by a consumer credit reporting agency shall be deemed
				confidential and not subject to disclosure unless the superintendent determines
				that such disclosure is necessary to carry out the powers and duties conferred
				upon the superintendent by the Insurance Law, the Banking Law, or the Financial
				Services Law or to allow the department to perform examinations or
				investigations authorized by law.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 201 - Registration Requirements and Prohibited Practices for Credit Reporting Agencies › Section 201.5 - Revocation and Suspension of a Registration

Current through Register Vol. 46, No. 28, July 10, 2024
(a) The superintendent may refuse to renew,
				revoke, or may suspend for a period the superintendent determines the
				registration of any consumer credit reporting agency if, after notice and
				hearing, the superintendent determines that the registrant or any member,
				principal, officer, director, or controlling person of the registrant, has:
(1) violated any insurance, financial
				service, or banking laws or violated any regulation, subpoena or order of the
				superintendent or of another state's insurance or banking commissioner or of
				any other state or federal agency with authority to regulate consumer credit
				reporting agencies, or has violated any law in the course of his or her
				dealings in such capacity;
(2)
				provided materially incorrect, materially misleading, materially incomplete or
				materially untrue information in the registration application;
(3) failed to comply with the requirements of
				this Part, including but not limited to, section 201.07 of this Part concerning
				cybersecurity;
(4) used fraudulent,
				coercive or dishonest practices;
(5) improperly withheld, misappropriated or
				converted any monies or properties received in the course of business in this
				state or elsewhere;
(6) admitted or
				been found to have committed any unfair trade practice or fraud; or
(7) had a consumer credit reporting agency
				registration, or its equivalent, denied, suspended or revoked in any other
				state, province, district or territory.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 201 - Registration Requirements and Prohibited Practices for Credit Reporting Agencies › Section 201.6 - Prohibited Practices

Current through Register Vol. 46, No. 28, July 10, 2024
No consumer credit reporting agency that is required to be
				  registered pursuant to section 201.02 of this Part shall:
(a) directly or indirectly employ any scheme,
				device or artifice to defraud or mislead a consumer that is prohibited by any
				federal law, or by any New York State law that is not preempted by federal
				law;
(b) engage in any unfair,
				deceptive or predatory act or practice toward any consumer that is prohibited
				by federal law, or by any New York State law that is not preempted by federal
				law;
(c) if prohibited by any
				federal law or by any New York State law that is not preempted by federal law,
				misrepresent or omit any material information in connection with the assembly,
				evaluation, or maintenance of a credit report for a New York
				consumer;
(d) engage in any unfair,
				deceptive, or abusive act or practice in violation of section 1036 of the
				Dodd-Frank Wall Street Reform and Consumer Protection Act;
(e) fail to comply with the provisions of
				federal law relating to the accuracy of the information in any consumer report
				relating to a New York consumer;
(f) refuse to communicate with an authorized
				representative of a New York consumer who provides a written authorization
				signed by the consumer, provided that the consumer credit reporting agency may
				adopt procedures reasonably related to verifying that the representative is in
				fact authorized to act on behalf of the consumer, and provided further that the
				authorized representative is not a credit repair organization, or associated
				with a credit repair organization, as defined in
				15
				U.S.C. §
										1679a(3);
				or
(g) make any false statement or
				make any omission of a material fact in connection with any information or
				reports filed with a governmental agency or in connection with any
				investigation conducted by the superintendent or another governmental
				agency.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 201 - Registration Requirements and Prohibited Practices for Credit Reporting Agencies › Section 201.7 - Cybersecurity

Current through Register Vol. 46, No. 28, July 10, 2024
(a) Every consumer
				credit reporting agency that is required to be registered pursuant to 201.02
				shall be deemed to be a Covered Entity and shall comply with the following
				provisions in Part 500 of this Title: 500.02, 500.03, 500.04, 500.05, 500.06,
				500.07, 500.08, 500.09, 500.10, 500.11, 500.12, 500.13, 500.14, 500.15, 500.16,
				500.17, 500.18, 500.20.
(b) Except
				as provided in subsection (c), a consumer credit reporting agency shall have
				until November 1, 2018 to comply with this section.
(c) A consumer credit reporting agency shall
				have:
(1) Until February 28, 2019 to comply
				with the requirements of sections 500.04(b), 500.05, 500.09,
				500.12, and
				500.14(a)(2) of
				this Part.
(2) Until August 31,
				2019 to comply with the requirements of sections 500.06, 500.08,
				500.13,
				500.14(a)(1)  and
				500.15 of this Part.
(3) Until December 31, 2019 to comply with
				the requirements of section
				500.11 of this Part.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 201 - Registration Requirements and Prohibited Practices for Credit Reporting Agencies › Section 201.8 - Authority of the Superintendent Preserved

Current through Register Vol. 46, No. 28, July 10, 2024
Nothing in this Part shall be construed to limit or affect
				  the superintendent's authority under to the Banking Law, the Insurance Law, the
				  Financial Services Law, or any other statute or regulation.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 201 - Registration Requirements and Prohibited Practices for Credit Reporting Agencies › Section 201.9 - Severability

Current through Register Vol. 46, No. 28, July 10, 2024
If any provision of this Part or the application thereof to
				  any person or circumstance is adjudged invalid by a court of competent
				  jurisdiction, such judgment shall not affect or impair the validity of the
				  other provisions of this Part or the application thereof to other persons or
				  circumstances.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 400 - Independent Dispute Resolution for Emergency Services and Surprise Bills › Section 400.0 - Preamble

Current through Register Vol. 46, No. 28, July 10, 2024
Part H of Chapter 60 of the Laws of 2014 provided new rights
				  and obligations, effective March 31, 2015, concerning disputes involving bills
				  by health care providers. Health care plans, physicians, and when applicable,
				  other health care providers and patients, have the right to request a review by
				  an IDRE to resolve a payment dispute regarding a bill for certain emergency
				  services or surprise bills. Chapters 375 and 377 of the Laws of 2019, effective
				  January 1, 2020, provided additional rights and obligations for disputes
				  involving hospital bills for emergency services and inpatient services that
				  follow an emergency room visit. Part YY of Chapter 56 of the Laws of 2020,
				  effective April 3, 2020, provided new hold harmless requirements and assignment
				  of benefits rights and obligations for emergency services, including inpatient
				  services, that follow an emergency room visit. This Part implements the
				  requirements of Financial Services Law Article 6 by establishing a dispute
				  resolution process and establishing the standards for such process, including
				  criteria and the process for certifying and selecting an
				  IDRE.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 400 - Independent Dispute Resolution for Emergency Services and Surprise Bills › Section 400.1 - Applicability

Current through Register Vol. 46, No. 28, July 10, 2024
(a) This Part shall
				apply to health care services provided in this State on and after March 31,
				2015. This Part also shall apply to emergency services provided by
				non-participating hospitals and inpatient services that follow an emergency
				room visit provided in this State on and after January 1, 2020. The
				requirements relating to assignment of benefits and provider hold harmless for
				emergency services in subdivisions (a)(2) and (b)(2) of section
				400.6 of this Part shall apply to
				emergency services provided in this State on and after April 3, 2020.
(b) This Part shall not apply to health care
				services, including emergency services, where physician fees are subject to
				schedules or other monetary limitations under any other law, including the
				Workers' Compensation Law and Insurance Law article 51, and shall not preempt
				any such law. This Part shall not apply to emergency services subject to
				Financial Services Law section 602(b).
(c) The requirements of this Part for
				emergency services provided by non-participating hospitals, including inpatient
				services that follow an emergency admission, shall not apply to hospitals that
				had at least 60 percent of inpatient discharges annually that consisted of
				Medicaid, uninsured, and dual eligible individuals as determined by the
				department of health in its determination of safety net
				hospitals.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 400 - Independent Dispute Resolution for Emergency Services and Surprise Bills › Section 400.2 - Definitions

Current through Register Vol. 46, No. 28, July 10, 2024
As used in this Part:
(a)
Active practice
means
				actively treating persons in a state where the physician is licensed.
(b)
Affiliated
means
				controls, controlled by, or under common control.
(c)
Control
shall have the
				meaning ascribed by Insurance Law section 107(a)(16).
(d)
Dispute resolution
				process
means a process to resolve a dispute for a fee for emergency
				services, including inpatient services that follow an emergency room visit, or
				a surprise bill.
(e)
Emergency condition
means a medical or behavioral condition
				that manifests itself by acute symptoms of sufficient severity, including
				severe pain, such that a prudent layperson, possessing an average knowledge of
				medicine and health, could reasonably expect the absence of immediate medical
				attention to result in:
(1) placing the
				health of the person afflicted with such condition in serious jeopardy, or in
				the case of a behavioral condition placing the health of such person or others
				in serious jeopardy;
(2) serious
				impairment to such person's bodily functions;
(3) serious dysfunction of any bodily organ
				or part of such person;
(4) serious
				disfigurement of such person; or
(5) a condition described in
				42 U.S.C. section
				1395 dd (Social Security Act section
				1867[e][1][A][i], [ii] or [iii]).
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 400 - Independent Dispute Resolution for Emergency Services and Surprise Bills › Section 400.3 - Independent dispute resolution entity (IDRE) certification requirements

Current through Register Vol. 46, No. 28, July 10, 2024
(a) An entity
				applying to be an IDRE certified to perform reviews regarding bills for
				emergency services, including inpatient services that follow an emergency room
				visit, and surprise bills pursuant to Financial Services Law Article 6 shall
				submit to the superintendent:
(1) a
				description of the proposed IDRE's organizational structure and capability to
				operate a statewide IDRE, including:
(i) a
				certificate of incorporation, articles of organization and bylaws or operating
				agreement of the proposed IDRE and, as applicable, those of the proposed IDRE's
				holding company or parent company;
(ii) the proposed IDRE's organizational
				chart;
(iii) identification of
				management staff and a description of such management staff's
				responsibilities;
(iv) the name and
				credentials of a medical director appointed by the proposed IDRE, who is a
				physician in possession of a current and valid non-restricted license to
				practice medicine in New York;
(v)
				the names and biographies of all controlling employees, officers, and
				executives of the proposed IDRE; and information concerning the governing board
				of the proposed IDRE, including roles and responsibilities, identification of
				the board members and a description of their qualifications;
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 400 - Independent Dispute Resolution for Emergency Services and Surprise Bills › Section 400.4 - Conflict of interest

Current through Register Vol. 46, No. 28, July 10, 2024
(a) No
				proposed IDRE shall be qualified for certification as an IDRE if it owns or
				controls, is owned or controlled by, or is under common control with any of the
				following:
(1) any national, state or local
				illness, health benefit or public advocacy group;
(2) any national, state or local society or
				association of hospitals, physicians, or other providers of health care
				services; or
(3) any national,
				state or local association of health care plans.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 400 - Independent Dispute Resolution for Emergency Services and Surprise Bills › Section 400.6 - Responsibilities of physicians, hospitals, and non-participating referred health care providers for disputes regarding emergency services and surprise bills

Current through Register Vol. 46, No. 28, July 10, 2024
(a)
(1) If a non-participating physician or
				non-participating referred health care provider bills a patient for a surprise
				bill, the non-participating physician or non-participating referred health care
				provider shall provide a claim form to the patient and an assignment of
				benefits form in a form prescribed by the superintendent.
(2) If a non-participating physician or a
				non-participating hospital bills a patient for emergency services, including
				inpatient services that follow an emergency room visit, the non-participating
				physician or nonparticipating hospital shall provide a claim form and an
				assignment of benefits form to the patient.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 400 - Independent Dispute Resolution for Emergency Services and Surprise Bills › Section 400.7 - Process to submit disputes regarding emergency services or surprise bills

Current through Register Vol. 46, No. 28, July 10, 2024
(a)
(1) Emergency services. A health care plan, a
				non-participating physician, a non-participating hospital, or a patient who is
				not an insured may submit a dispute regarding emergency services, including
				inpatient services that follow an emergency room visit, to the superintendent
				for review by an IDRE.
(2) Surprise
				bills. A health care plan, a non-participating physician, a non-participating
				referred health care provider, an insured who does not assign benefits, or a
				patient who is not an insured may submit a dispute regarding a surprise bill to
				the superintendent for review by an IDRE.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 400 - Independent Dispute Resolution for Emergency Services and Surprise Bills › Section 400.8 - Responsibilities of an IDRE

Current through Register Vol. 46, No. 28, July 10, 2024
(a) Within
				three business days of receipt of an application submitted by a health care
				plan, non-participating physician, non-participating hospital,
				non-participating referred health care provider or a patient, an IDRE shall
				screen the application for any conflicts of interest in accordance with section
				400.4 of this Part. If the IDRE
				determines a conflict exists, the IDRE shall reject the application and return
				it to the superintendent within those three business days.
(b) If the IDRE determines that a conflict
				does not exist, the IDRE shall, within three business days of receiving an
				application submitted by a health care plan, non-participating physician,
				non-participating hospital, or non-participating referred health care provider:
(1) screen the application for
				eligibility;
(2) contact the health
				care plan, physician, hospital, or non-participating referred health care
				provider if additional information is needed to determine eligibility of the
				request for dispute resolution and provide the health care plan, the physician,
				hospital, or non-participating referred health care provider three business
				days to submit the information and provide an explanation of where the
				information should be sent. If the information is not submitted, the IDRE shall
				make a second request and provide one business day to submit the information.
				If the information is not submitted, or if the application is not eligible, the
				IDRE shall promptly reject the application.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 400 - Independent Dispute Resolution for Emergency Services and Surprise Bills › Section 400.9 - IDRE record retention and compliance

Current through Register Vol. 46, No. 28, July 10, 2024
(a) An IDRE shall retain case records in
				accordance with 11 NYCRR 243 (Insurance Regulation 152) for audit and
				examination for a period of six years from the date of the IDRE's
				determination. The IDRE shall keep and maintain all documentation relating to a
				case for no less than six years from the date of the IDRE's determination. The
				IDRE shall maintain on file each attestation required to be submitted pursuant
				to section
				400.3(a)(4)(ii)
				of this Part for six years from the date of the IDRE's determination.
(b) An IDRE shall ensure the confidentiality
				of medical and treatment records and review materials in accordance with 11
				NYCRR 420 (Insurance Regulation 169) and 11 NYCRR 421 (Insurance Regulation
				173) relating to the privacy and confidentiality of health
				information.
(c) Every attestation
				required to be submitted pursuant to section
				400.3(a)(4)(ii)
				shall be in a form prescribed by the superintendent.
(d) An IDRE shall be subject to examination
				by the superintendent at any time to ascertain compliance with Financial
				Services Law article 6 and this Part.
(e) An IDRE shall provide ready access to the
				superintendent to all data, records, and information collected and maintained
				concerning the IDRE's dispute resolution activities.
(f) An IDRE shall provide the superintendent
				data, information, and reports as the superintendent determines necessary to
				evaluate the dispute resolution process within two business days or such other
				period acceptable to the superintendent.
(g) An IDRE shall consent to cooperate in
				court proceedings relevant to its role as an IDRE.
(h) The superintendent may suspend IDRE case
				assignment if the IDRE fails to comply with any of the requirements of this
				Part and the superintendent may require all necessary corrective actions be
				taken by the IDRE.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 400 - Independent Dispute Resolution for Emergency Services and Surprise Bills › Section 400.10 - Payment for the independent dispute resolution

Current through Register Vol. 46, No. 28, July 10, 2024
(a)
Disputes involving an
				insured.
(1) If an IDRE determines the
				health care plan's payment, or best and final offer, as applicable, is
				reasonable, payment for the dispute resolution process shall be the
				responsibility of the non-participating physician, non-participating hospital,
				or as applicable, nonparticipating referred health care provider.
(2) If an IDRE determines the
				non-participating physician's or non-participating referred health care
				provider's fee or the non-participating hospital's fee or best and final offer,
				as applicable, is reasonable, payment for the dispute resolution process shall
				be the responsibility of the health care plan.
(3) If good faith negotiations directed by
				the IDRE results in a settlement between the health care plan and the
				non-participating physician, non-participating hospital or non-participating
				referred health care provider, the health care plan and the non-participating
				physician, non-participating hospital or non-participating referred health care
				provider shall evenly divide and share the prorated cost for dispute
				resolution.
(4) For disputes that
				are rejected as ineligible or due to the requesting non-participating
				physician, nonparticipating hospital, nonparticipating referred health care
				provider or health care plan's failure to submit information, an IDRE may
				charge an application processing fee, which shall be the responsibility of the
				requesting physician, hospital, health care provider or health care
				plan.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.0 - Introduction

Current through Register Vol. 46, No. 28, July 10, 2024
The New York State Department of Financial Services ("DFS")
				  has been closely monitoring the evergrowing threat posed to information and
				  financial systems by nation-states, terrorist organizations and independent
				  criminal actors. Recently, cybercriminals have sought to exploit technological
				  vulnerabilities to gain access to sensitive electronic data. Cybercriminals can
				  cause significant financial losses for DFS regulated entities as well as for
				  New York consumers whose private information may be revealed and/or stolen for
				  illicit purposes. The financial services industry is a significant target of
				  cybersecurity threats. DFS appreciates that many firms have proactively
				  increased their cybersecurity programs with great success.
Given the seriousness of the issue and the risk to all
				  regulated entities, certain regulatory minimum standards are warranted, while
				  not being overly prescriptive so that cybersecurity programs can match the
				  relevant risks and keep pace with technological advances. Accordingly, this
				  regulation is designed to promote the protection of customer information as
				  well as the information technology systems of regulated entities. This
				  regulation requires each company to assess its specific risk profile and design
				  a program that addresses its risks in a robust fashion. Senior management must
				  take this issue seriously and be responsible for the organization's
				  cybersecurity program and file an annual certification confirming compliance
				  with these regulations. A regulated entity's cybersecurity program must ensure
				  the safety and soundness of the institution and protect its customers.
It is critical for all regulated institutions that have not
				  yet done so to move swiftly and urgently to adopt a cybersecurity program and
				  for all regulated entities to be subject to minimum standards with respect to
				  their programs. The number of cyber events has been steadily increasing and
				  estimates of potential risk to our financial services industry are stark.
				  Adoption of the program outlined in these regulations is a priority for New
				  York State.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.1 - Definitions

Current through Register Vol. 46, No. 28, July 10, 2024
For purposes of this Part only, the following definitions
				  shall apply:
(a) Affiliate means any
				person that controls, is controlled by or is under common control with another
				person. For purposes of this subdivision, control means the possession, direct
				or indirect, of the power to direct or cause the direction of the management
				and policies of a person, whether through the ownership of stock of such person
				or otherwise.
(b) Authorized user
				means any employee, contractor, agent or other person that participates in the
				business operations of a covered entity and is authorized to access and use any
				information systems and data of the covered entity.
(c)
Chief Information Security
				Officer
or
CISO
means a qualified individual
				responsible for overseeing and implementing a covered entity's cybersecurity
				program and enforcing its cybersecurity policy.
(d)
Class A company
means a
				covered entity with at least $20,000,000 in gross annual revenue in each of the
				last two fiscal years from all business operations of the covered entity and
				the business operations in this State of the covered entity's affiliates and:
(1) over 2,000 employees averaged over the
				last two fiscal years, including employees of both the covered entity and all
				of its affiliates no matter where located; or
(2) over $1,000,000,000 in gross annual
				revenue in each of the last two fiscal years from all business operations of
				the covered entity and all of its affiliates no matter where located.
For purposes of this subdivision, when calculating the number
				  of employees and gross annual revenue, affiliates shall include only those that
				  share information systems, cybersecurity resources or all or any part of a
				  cybersecurity program with the covered entity.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.2 - Cybersecurity Program

Current through Register Vol. 46, No. 28, July 10, 2024
(a) Each
				covered entity shall maintain a cybersecurity program designed to protect the
				confidentiality, integrity and availability of the covered entity's information
				systems and nonpublic information stored on those information
				systems.
(b) The cybersecurity
				program shall be based on the covered entity's risk assessment and designed to
				perform the following core cybersecurity functions:
(1) identify and assess internal and external
				cybersecurity risks that may threaten the security or integrity of nonpublic
				information stored on the covered entity's information systems;
(2) use defensive infrastructure and the
				implementation of policies and procedures to protect the covered entity's
				information systems, and the nonpublic information stored on those information
				systems, from unauthorized access, use or other malicious acts;
(3) detect cybersecurity events;
(4) respond to identified or detected
				cybersecurity events to mitigate any negative effects;
(5) recover from cybersecurity events and
				restore normal operations and services; and
(6) fulfill applicable regulatory reporting
				obligations.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.3 - Cybersecurity policy

Current through Register Vol. 46, No. 28, July 10, 2024
Each covered entity shall implement and maintain a written
				  policy or policies, approved at least annually by a senior officer or the
				  covered entity's senior governing body for the protection of its information
				  systems and nonpublic information stored on those information systems.
				  Procedures shall be developed, documented and implemented in accordance with
				  the written policy or policies. The cybersecurity policy or policies and
				  procedures shall be based on the covered entity's risk assessment and address,
				  at a minimum, the following areas to the extent applicable to the covered
				  entity's operations:
(a) information
				security;
(b) data governance,
				classification and retention;
(c)
				asset inventory, device management and end of life management;
(d) access controls, including remote access
				and identity management;
(e)
				business continuity and disaster recovery planning and resources;
(f) systems operations and availability
				concerns;
(g) systems and network
				security and monitoring;
(h)
				security awareness and training;
(i) systems and application security and
				development and quality assurance;
(j) physical security and environmental
				controls;
(k) customer data
				privacy;
(l) vendor and third-party
				service provider management;
(m)
				risk assessment;
(n) incident
				response and notification; and
(o)
				vulnerability management.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.4 - Cybersecurity governance

Current through Register Vol. 46, No. 28, July 10, 2024
(a) Chief
				information security officer. Each covered entity shall designate a CISO . The
				CISO may be employed by the covered entity, one of its affiliates or a
				third-party service provider. If the CISO is employed by a third-party service
				provider or an affiliate, the covered entity shall:
(1) retain responsibility for compliance with
				this Part;
(2) designate a senior
				member of the covered entity's personnel responsible for direction and
				oversight of the third-party service provider; and
(3) require the third-party service provider
				or affiliate to maintain a cybersecurity program that protects the covered
				entity in accordance with the requirements of this Part.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.5 - Vulnerability management

Current through Register Vol. 46, No. 28, July 10, 2024
Each covered entity shall, in accordance with its risk
				  assessment, develop and implement written policies and procedures for
				  vulnerability management that are designed to assess and maintain the
				  effectiveness of its cybersecurity program. These policies and procedures shall
				  be designed to ensure that covered entities:
(a) conduct, at a minimum:
(1) penetration testing of their information
				systems from both inside and outside the information systems' boundaries by a
				qualified internal or external party at least annually; and
(2) automated scans of information systems,
				and a manual review of systems not covered by such scans, for the purpose of
				discovering, analyzing and reporting vulnerabilities at a frequency determined
				by the risk assessment, and promptly after any material system
				changes;
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.6 - Audit Trail

Current through Register Vol. 46, No. 28, July 10, 2024
(a) Each
				Covered Entity shall securely maintain systems that, to the extent applicable
				and based on its Risk Assessment:
(1) are
				designed to reconstruct material financial transactions sufficient to support
				normal operations and obligations of the Covered Entity; and
(2) include audit trails designed to detect
				and respond to Cybersecurity Events that have a reasonable likelihood of
				materially harming any material part of the normal operations of the Covered
				Entity.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.7 - Access privileges and management

Current through Register Vol. 46, No. 28, July 10, 2024
(a) As
				part of its cybersecurity program, based on the covered entity's risk
				assessment each covered entity shall :
(1)
				limit user access privileges to information systems that provide access to
				nonpublic information to only those necessary to perform the user's
				job;
(2) limit the number of
				privileged accounts and limit the access functions of privileged accounts to
				only those necessary to perform the user's job;
(3) limit the use of privileged accounts to
				only when performing functions requiring the use of such access;
(4) periodically, but at a minimum annually,
				review all user access privileges and remove or disable accounts and access
				that are no longer necessary;
(5)
				disable or securely configure all protocols that permit remote control of
				devices; and
(6) promptly terminate
				access following departures.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.8 - Application Security

Current through Register Vol. 46, No. 28, July 10, 2024
(a) Each
				Covered Entity's cybersecurity program shall include written procedures,
				guidelines and standards designed to ensure the use of secure development
				practices for in-house developed applications utilized by the Covered Entity,
				and procedures for evaluating, assessing or testing the security of externally
				developed applications utilized by the Covered Entity within the context of the
				Covered Entity's technology environment.
(b) All such procedures, guidelines and
				standards shall be reviewed, assessed and updated as necessary by the CISO (or
				a qualified designee) of the covered entity at least annually.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.9 - Risk Assessment

Current through Register Vol. 46, No. 28, July 10, 2024
(a) Each
				covered entity shall conduct a periodic risk assessment of the covered entity's
				information systems sufficient to inform the design of the cybersecurity
				program as required by this Part. Such risk assessment shall be reviewed and
				updated as reasonably necessary, but at a minimum annually, and whenever a
				change in the business or technology causes a material change to the covered
				entity's cyber risk . The covered entity's risk assessment shall allow for
				revision of controls to respond to technological developments and evolving
				threats and shall consider the particular risks of the covered entity's
				business operations related to cybersecurity, nonpublic information collected
				or stored, information systems utilized and the availability and effectiveness
				of controls to protect nonpublic information and information systems.
(b) The Risk Assessment shall be
				carried out in accordance with written policies and procedures and shall be
				documented. Such policies and procedures shall include:
(1) criteria for the evaluation and
				categorization of identified cybersecurity risks or threats facing the Covered
				Entity;
(2) criteria for the
				assessment of the confidentiality, integrity, security and availability of the
				Covered Entity's Information Systems and Nonpublic Information, including the
				adequacy of existing controls in the context of identified risks; and
(3) requirements describing how identified
				risks will be mitigated or accepted based on the Risk Assessment and how the
				cybersecurity program will address the risks.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.10 - Cybersecurity Personnel and Intelligence

Current through Register Vol. 46, No. 28, July 10, 2024
(a) In addition to the requirements set forth
				in section
				500.4(a) of this
				Part, each covered entity shall:
(1) utilize
				qualified cybersecurity personnel of the covered entity, an affiliate or a
				third-party service provider sufficient to manage the covered entity's
				cybersecurity risks and to perform or oversee the performance of the core
				cybersecurity functions specified in section
				500.2(b)(1)-(6)
				of this Part;
(2) provide
				cybersecurity personnel with cybersecurity updates and training sufficient to
				address relevant cybersecurity risks; and
(3) verify that key cybersecurity personnel
				take steps to maintain current knowledge of changing cybersecurity threats and
				countermeasures.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.11 - Third-party service provider security policy

Current through Register Vol. 46, No. 28, July 10, 2024
(a) Each covered entity shall implement
				written policies and procedures designed to ensure the security of information
				systems and nonpublic information that are accessible to, or held by,
				third-party service providers. Such policies and procedures shall be based on
				the risk assessment of the covered entity and shall address to the extent
				applicable:
(1) the identification and risk
				assessment of third-party service providers;
(2) minimum cybersecurity practices required
				to be met by such third-party service providers in order for them to do
				business with the covered entity;
(3) due diligence processes used to evaluate
				the adequacy of cybersecurity practices of such third-party service providers;
				and
(4) periodic assessment of such
				third-party service providers based on the risk they present and the continued
				adequacy of their cybersecurity practices.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.12 - Multi-Factor Authentication

Current through Register Vol. 46, No. 28, July 10, 2024
(a)
				Multi-factor authentication shall be utilized for any individual accessing any
				information systems of a covered entity, unless the covered entity qualifies
				for a limited exemption pursuant to section
				500.19(a) of this
				Part in which case multi-factor authentication shall be utilized for:
(1) remote access to the covered entity's
				information systems;
(2) remote
				access to third-party applications, including but not limited to those that are
				cloud based, from which nonpublic information is accessible; and
(3) all privileged accounts other than
				service accounts that prohibit interactive login.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.13 - Asset management and data retention requirements

Current through Register Vol. 46, No. 28, July 10, 2024
(a) As part of its cybersecurity program,
				each covered entity shall implement written policies and procedures designed to
				produce and maintain a complete, accurate and documented asset inventory of the
				covered entity's information systems. The asset inventory shall be maintained
				in accordance with written policies and procedures. At a minimum, such policies
				and procedures shall include:
(1) a method to
				track key information for each asset, including, as applicable, the following:
(i) owner;
(ii) location;
(iii) classification or
				sensitivity;
(iv) support
				expiration date; and
(v) recovery
				time objectives; and
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.14 - Monitoring and training

Current through Register Vol. 46, No. 28, July 10, 2024
(a) As
				part of its cybersecurity program, each covered entity shall:
(1) implement risk-based policies, procedures
				and controls designed to monitor the activity of authorized users and detect
				unauthorized access or use of, or tampering with, nonpublic information by such
				authorized users;
(2) implement
				risk-based controls designed to protect against malicious code, including those
				that monitor and filter web traffic and electronic mail to block malicious
				content; and
(3) provide periodic,
				but at a minimum annual, cybersecurity awareness training that includes social
				engineering for all personnel that is updated to reflect risks identified by
				the covered entity in its risk assessment.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.15 - Encryption of Nonpublic Information

Current through Register Vol. 46, No. 28, July 10, 2024
(a) As part of its cybersecurity program,
				each covered entity shall implement a written policy requiring encryption that
				meets industry standards, to protect nonpublic information held or transmitted
				by the covered entity both in transit over external networks and at
				rest.
(b) To the extent a covered
				entity determines that encryption of nonpublic information at rest is
				infeasible, the covered entity may instead secure such nonpublic information
				using effective alternative compensating controls that have been reviewed and
				approved by the covered entity's CISO in writing . The feasibility of
				encryption and effectiveness of the compensating controls shall be reviewed by
				the CISO at least annually.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.16 - Incident Response Plan

Current through Register Vol. 46, No. 28, July 10, 2024
(a) As part of
				its cybersecurity program, each covered entity shall establish written plans
				that contain proactive measures to investigate and mitigate cybersecurity
				events and to ensure operational resilience, including but not limited to
				incident response, business continuity and disaster recovery plans.
(1) Incident response plan. Incident response
				plans shall be reasonably designed to enable prompt response to, and recovery
				from, any cybersecurity event materially affecting the confidentiality,
				integrity or availability of the covered entity's information systems or the
				continuing functionality of any aspect of the covered entity's business or
				operations. Such plans shall address the following areas with respect to
				different types of cybersecurity events, including disruptive events such as
				ransomware incidents:
(i) the goals of the
				incident response plan;
(ii) the
				internal processes for responding to a cybersecurity event;
(iii) the definition of clear roles,
				responsibilities and levels of decision-making authority;
(iv) external and internal communications and
				information sharing;
(v)
				identification of requirements for the remediation of any identified weaknesses
				in information systems and associated controls;
(vi) documentation and reporting regarding
				cybersecurity events and related incident response activities;
(vii) recovery from backups;
(viii) preparation of root cause analysis
				that describes how and why the event occurred, what business impact it had, and
				what will be done to prevent reoccurrence; and
(ix) updating of incident response plans as
				necessary.
New York Codes, Rules and Regulations › Title 23 - FINANCIAL SERVICES › Chapter I - Regulations of the Superintendent of Financial Services › Part 500 - CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES › Section 500.17 - Notices to Superintendent

Current through Register Vol. 46, No. 28, July 10, 2024
(a)
				Notice of cybersecurity incident .
(1) Each
				covered entity shall notify the superintendent electronically in the form set
				forth on the department's website as promptly as possible but in no event later
				than 72 hours after determining that a cybersecurity incident has occurred at
				the covered entity, its affiliates, or a third-party service
				provider.
(2) Each covered entity
				shall promptly provide to the superintendent any information requested
				regarding such incident. Covered entities shall have a continuing obligation to
				update the superintendent with material changes or new information previously
				unavailable.