Impact of New York’s Cybersecurity Regulations on MSPs

As of March 1, 2017, New York State’s new cybersecurity regulations governing the financial services industry are now in effect. Dubbed “first-in-the-nation protections” by New York Governor Andrew Cuomo, these regulations require that institutions regulated by the NY Department of Financial Services (DFS) – including banks, insurance companies and other financial services providers – must establish and maintain a cybersecurity program that both protects the private data of consumers and supports the integrity of the industry in the state.

We – like most vendors – remain informed about new regulations such as this in order to better serve the managed service providers (MSPs) we work with. Ultimately, MSPs that are knowledgeable about legal trends in the industries they serve are able to offer superior and more tailored service to their end user clients. These MSPs can also ensure that their clients have all the information they need to make the right decisions around data security and regulatory compliance.

While the newly introduced regulations in question only affect financial services providers, and only those in New York State, this governmental action may very well influence other jurisdictions and localities to adopt similar regulations. At the same time, the regulations represent a best practices framework around data security that make a lot of sense for companies handling sensitive data, no matter their industry or location.

Here are the highlights of what MSPs serving organizations affected by these new regulations need to know:

1) A strong cybersecurity program is now required. Financial services organizations are now required to maintain a well funded, staffed and managed cybersecurity program, and to keep senior leadership informed it. The program must be led by a chief information security officer (or other such leader) who is responsible for safeguarding sensitive data.