23 CRR-NY 500.16NY-CRR
23 CRR-NY 500.16
23 CRR-NY 500.16
500.16 Incident response plan.
(a) As part of its cybersecurity program, each covered entity shall establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event materially affecting the confidentiality, integrity or availability of the covered entity’s information systems or the continuing functionality of any aspect of the covered entity’s business or operations.
(b) Such incident response plan shall address the following areas:
(1) the internal processes for responding to a cybersecurity event;
(2) the goals of the incident response plan;
(3) the definition of clear roles, responsibilities and levels of decision-making authority;
(4) external and internal communications and information sharing;
(5) identification of requirements for the remediation of any identified weaknesses in information systems and associated controls;
(6) documentation and reporting regarding cybersecurity events and related incident response activities; and
(7) the evaluation and revision as necessary of the incident response plan following a cybersecurity event.
23 CRR-NY 500.16
Current through June 30, 2022
| End of Document |
IMPORTANT NOTE REGARDING CONTENT CURRENCY: The "Current through" date indicated immediately above is the date of the most recently produced official NYCRR supplement covering this rule section. For later updates to this section, if any, please: consult editions of the NYS Register published after this date; or contact the NYS Department of State Division of Administrative Rules at [email protected]. See Help for additional information on the currency of this unofficial version of NYS Rules.