Ex-New York regulatory lawyers now in private practice are discussing what banking, financial and insurance companies should do to ensure compliance with sturdier cybersecurity regulations coming into place by a state watchdog agency in April.

Board-level reporting requirements approaching mid-April, and a large expansion of multifactor authentication (MFA) requirements later in November 2025, are the two biggest shifts—“new concepts that are going to take some real time and attention for pretty much everybody to make sure that they’re doing what they need to do,” said Eversheds Sutherland counsel Al Sand.