The NY Department of Finance recently cast stringent and wide-reaching Cybersecurity regulations on banks, insurance companies, other financial services institutions, and anyone that does business with these types of entities in the state of New York. We break down the new DFS Cybersecurity Regulations and what they mean for your vendor risk management program.
Recent high-profile data breaches affecting the financial and healthcare sectors highlight the unexpected or unintended consequences that can arise when organizations outsource IT, support and processing activities.
In summary, the law requires all business institutions to prove that they have:
The legislation is effective as of March 1st, 2017, and compliance is mandatory within 180 days. The New York State has issued a list of frequently asked questions (FAQs) around compliance and exceptions.
For companies it basically says, “make sure your vendors are secure, that they securely access your data, and that their third parties and vendors are compliant, too.” Managing your vendors is a challenge, fourth party management is an even bigger hurdle to overcome if you look at the current landscape and available solutions.
We at ThirdPartyTrust are singularly focused on third party risk management. As such, let us highlight what this means for your vendor risk management program.
You will be required to:
Ultimately, the use of third-parties suppliers and outsourcing will not absolve organizations of responsibility for that risk nor will it allow deflection of a security breach to the outsourced entity. Violations can be assessed as “willful misuse” carrying fines of $50,000 or more per instance.
For many companies, the process of gathering and managing third party risk profiles is laborious and time-intensive, with spreadsheets and file cabinets being the historical method of choice. Gleaning insights and patterns from this information is difficult, at best. However, there are tools and frameworks available to make this easier for organizations and their third party vendors.
Download Guide: Building a Scalable Third Party Risk Management Program
It’s clear that regulators are now requiring all companies to actively be apprised of their third-party entities’ cyber risk profiles and methods. Establishing a line of sight with each third-party entity’s Vendor Management and/or Compliance department is even more difficult. Similarly, establishing a formalized framework for the purpose of acquiring third-party cyber risk intelligence is extremely difficult
Regardless of the difficulty, the regulators will hold you accountable, and the penalties will carry hefty monetary fines (as well as adverse effects to your reputational and operational risk).
It is imperative that organizations implement a controllable, pragmatic risk management strategy. The most efficient strategy incorporates converged practices, collaboration, and relationship building at the third and fourth party levels. This strategy applies for domestic dependencies as well as global dependencies, where the challenge of managing third party security is compounded by distance, legal, and cultural variables.
To learn more about how ThirdPartyTrust can help you manage third-party risk, request your free trial now: