Resource: NY DFS Issues New Cybersecurity Guidance to Address Risks Associated with the Use of Third-Party Service Providers

According to NY DFS, Acting Superintendent Kaitlin Asrow today issued new cybersecurity guidance addressing the risks associated with entities becoming increasingly reliant on third-party service providers (TPSPs). The guidance, which DFS says builds on its ongoing work to protect New Yorkers and DFS-regulated entities, clarifies regulatory requirements under the department’s cybersecurity regulation and shares best practices for risk management when using TPSPs.

Asrow is quoted saying that while third-party providers have driven innovation and efficiencies, regulated entities remain ultimately accountable for protecting consumers and managing risk, and that internal risk management controls should be established and maintained. The guidance does not impose new requirements on DFS-regulated entities, but aims to help entities understand and apply existing rules more effectively.

A copy of the guidance is available on the Department’s website, with additional cybersecurity resources on the Department’s Cybersecurity Resource Center.