Compliance Briefing — NYDFS Cybersecurity certification due for 2019
Covered financial institutions regulated by the New York Department of Financial Services had to file their 2019 NYDFS Cybersecurity Regulation certification by March 2, 2020. DFS warned it would enforce missing or false attestations, making leadership accountable for control gaps.
Executive briefing: For the 2019 reporting year, NYDFS required Covered Entities to submit their annual Cybersecurity Regulation certification by (moved from March 1 because it fell on a Sunday). The attestation obligates a senior officer or board to confirm compliance with 23 NYCRR Part 500 controls.
Why it matters
- Leadership accountability: executive sign-off raises the cost of understating deficiencies in cyber programs.
- Regulatory posture: missing certifications are treated as violations, inviting exams and potential penalties.
- Audit readiness: substantiating the certification requires evidence across access control, monitoring, and incident response.
Operator actions
- Confirm submission: Verify 2019 certifications were filed in the DFS portal with board or senior officer approval.
- Evidence pack: Retain control testing, risk assessment, and penetration test results that support the attestation.
- Gap remediation: Track any Part 500 exceptions or timelines committed in the certification and assign owners.
- Calendar 2020: Schedule quarterly reviews so 2020 certification workpapers are ready ahead of next March's deadline.
Continue in the Compliance pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Third-Party Risk Oversight Playbook — Zeph Tech
Operationalize OCC, Federal Reserve, EBA, and MAS outsourcing expectations with lifecycle controls, continuous monitoring, and board reporting.
-
Compliance Operations Control Room — Zeph Tech
Implement cross-border compliance operations that satisfy Sarbanes-Oxley, DOJ guidance, EU DORA, and MAS TRM requirements with verifiable evidence flows.
-
SOX Modernization Control Playbook — Zeph Tech
Modernize Sarbanes-Oxley (SOX) compliance by aligning PCAOB AS 2201, SEC management guidance, and COSO 2013 controls with data-driven testing, automation, and board reporting.