This timeline includes key dates for DFS-licensed individual producers, mortgage loan originators, and other businesses that qualify for exemptions under Sections 500.19 (a), (c), and (d) of the amended Cybersecurity Regulation.
*Indicates actions that are not required for Covered Entities that qualify for 500.19(c)and (d) exemptions. 500.19(c) exemptions apply to entities that do not maintain nonpublic information, and 500.19(d) exemptions apply to captive insurers.
This guide is provided for general planning purposes. Please consult the text of the Cybersecurity Regulation for specific requirements.
Section 500.19
More businesses qualify for exemptions (limited and full). Check to confirm eligibility for an exemption.
Section 500.17
Notifying DFS of cybersecurity events continues to be required. What’s new: Ransomware deployment and any ransom payments made must be reported.
Section 500.17(b)
Annual compliance submissions continue to be due. What’s new: Determine whether to file one of two new forms: Certification of Material Compliance or Acknowledgment of Noncompliance.
Section 500.9(b)
Risk assessments continue to be required. What’s new: Risk assessments must be reviewed and updated at least annually and whenever a change in the business or technology causes a material change to the business’ cyber risk.
Section 500.3*(b)
After assessing your risks, update your policies to address these issues if needed:
Section 500.12(a)*
Implement multifactor authentication (MFA) requirements outlined in Section 500.12(a) if you have not already done so.
Section 500.14(a)(3)*
Provide all personnel at your business at least annual cybersecurity awareness training.
Section 500.7*
Section 500.12*
Comply with enhanced MFA requirements.
Section 500.13(a)
Implement new asset inventory requirements.
