Matthew L. Levine (Photo courtesy of the author)
The New York State Department of Financial Services (“DFS”) has issued its long-awaited proposed revision to “Part 500,” the agency’s groundbreaking Cybersecurity Regulation.[1] This revision may be the basis for the final rule that will go into effect in stages after the Notice of Adoption is published in the State Register.
A catalog of analysis by law and consulting firms has already popped up online concerning the specific changes proposed, and not proposed, in this latest revision. There is no question that, when implemented, the regulation’s final changes are likely to have a material impact on financial institutions regulated by DFS.
Yet another document that accompanied the proposed revision should not be overlooked: the DFS “Assessment of Public Comments” (the “Assessment”). The rough equivalent of the “fine print” accompanying the proposal, the Assessment responds to an extensive body of commentary received by DFS from financial institutions, trade groups, law firms and others after DFS issued a previous iteration of the proposed amendments in November 2022.[2]
