23 CRR-NY 500.10NY-CRR

OFFICIAL COMPILATION OF CODES, RULES AND REGULATIONS OF THE STATE OF NEW YORK
TITLE 23. FINANCIAL SERVICES
CHAPTER I. REGULATIONS OF THE SUPERINTENDENT OF FINANCIAL SERVICES
PART 500. CYBERSECURITY REQUIREMENTS FOR FINANCIAL SERVICES COMPANIES
23 CRR-NY 500.10
23 CRR-NY 500.10
500.10 Cybersecurity personnel and intelligence.
(a) Cybersecurity personnel and intelligence.
In addition to the requirements set forth in section 500.4(a) of this Part, each covered entity shall:
(1) utilize qualified cybersecurity personnel of the covered entity, an affiliate or a third party service provider sufficient to manage the covered entity’s cybersecurity risks and to perform or oversee the performance of the core cybersecurity functions specified in section 500.2(b)(1)-(6) of this Part;
(2) provide cybersecurity personnel with cybersecurity updates and training sufficient to address relevant cybersecurity risks; and
(3) verify that key cybersecurity personnel take steps to maintain current knowledge of changing cybersecurity threats and countermeasures.
(b) A covered entity may choose to utilize an affiliate or qualified third party service provider to assist in complying with the requirements set forth in this Part, subject to the requirements set forth in section 500.11 of this Part.
23 CRR-NY 500.10
Current through June 15, 2022
End of Document