More Information on NY Cybersecurity Regulation
Print this Article | Send to Colleague
Kathy Weinheimer posted the following response
On September 6, 2017, the New York State Department of Financial Services or DFS added new FAQs to its "Frequently Asked Questions" page that directs individual licensees to file for an exemption from Part 500 — the cybersecurity regulation. The additions were the first written mention of such an interpretation, coming more than six months after adoption of the regulation. According to the DFS, individuals have until September 27 to file for the exemption.
Since its introduction, it has been our belief and interpretation that individual licensees were not subject to the regulation. In August 2017, more than five months after the DFS adopted the final version of Part 500, we learned that the department was interpreting it otherwise. Producer groups question the logic. Working together, IIABNY, Professional Insurance Agents of New York and the New York State Association of Health Underwriters fought back against the DFS's interpretation. Written objections were sent to the DFS, and we reached out to the department in several other ways. We held an in-person meeting on September 12 with a representative of Gov. Andrew Cuomo's office and have at least caught their ear. We requested consideration of an extended deadline if the DFS will not change its interpretation.
We believe DFS's interpretation amounts to an unnecessary requirement that obligates individual insurance licensees to complete yet another form with no benefit to the insurance-buying public. If the department feels "minimum standards are warranted, while not being overly prescriptive" (as quoted from the regulation's introduction), it makes little sense to mandate actions by individuals who have no control over their organizations' information security practices.
A number of our questions to the DFS are still unanswered but based on what we know now, we recommend individual licensees file for the exemption. We will continue to fight for a more logical approach by the DFS and will keep you informed.
