The new rules include having written policies and procedures, hiring a designated chief information security officer, and reporting hacking attempts to the state within 72 hours. The state rules are first-in-nation and are widely expected to become a model for other states.
“New Yorkers must be confident that the banks, insurance companies and other financial institutions that they rely on are securely handling and establishing necessary protocols that ensure the security and privacy of their sensitive personal information,” said Maria T. Vullo, superintendent of the financial services department. Her department said it surveyed about 200 of the financial firms it regulates to evaluate cybersecurity progress and develop the requirements.