On Feb. 16, 2017, New York’s powerful financial regulator, the Department of Financial Services (DFS), announced the first-in-nation cybersecurity regulation, which will take effect March 1, 2017. The press release accompanying the regulation states that it is intended to require banks, insurance companies and other “covered entities” to “establish and maintain a cybersecurity program designed to protect consumers’ private data and ensure the safety and soundness of New York State’s financial services industry.” The regulation is, and was expressly intended to be, groundbreaking.
Despite the New York-centric language in the press release, the regulation impacts regulated and nonregulated entities both in and outside of New York. Companies across the country, and even outside of the U.S., are affected by the new regulation, as are many of the law firms that represent them.
