Risk Management Lessons from New York’s Cybersecurity Regulation

In 2017, the New York Department of Financial Services (NYDFS) first introduced its landmark cybersecurity regulation, 23 NYCRR Part 500, which set new standards for financial institutions to safeguard their systems and protect sensitive information. In 2023, significant amendments were made to this regulation, making it even more comprehensive and stringent in response to the increasingly complex cyberthreat landscape. In fact, in its first enforcement action following the amendments, NYDFS fined Genesis Global Trading $8 million for noncompliance, highlighting the urgency of the regulatory updates and the potential consequences for failures to comply.