The proposed rules will be finalized following a 30-day comment period. Cybersecurity laws are few and far between, particularly at the local level. New York's regulation is one of the first programs mandating companies to implement cybersecurity programs to protect customers. To a CISO or CIO, those consumer cybersecurity protection measures are practically implied at this point, but cybersecurity can still take a back seat in board rooms. Those lacking cybersecurity measures could have embarrassing consequences. If organizations are found with lacking cybersecurity practices that result in a breach, they could become a target of the Federal Trade Commission. More states could certainly follow suit and implement locally-focused cybersecurity accountability measures, but companies are still pushing back resulting in regulation delays, such as those in New York. Companies should anticipate more cybersecurity mandates in the future, as government agencies are looking to regulate and protect against large-scale breaches and the release of sensitive customer information.
The New York State Department of Financial Services (DFS) will launch new cybersecurity regulations on 1 March, three months later than originally planned, to give companies time to become compliant. In a statement released yesterday, the DFS said it would be issuing “interim guidance” for businesses that want to comply with its proposed rules by 30 June.