Compliance Briefing — NYDFS issues ransomware preparedness guidance
New York’s Department of Financial Services warned regulated institutions about escalating ransomware attacks and outlined mandatory controls around MFA, privileged access, incident playbooks, and timely notification.
On 4 February 2021 the New York State Department of Financial Services (NYDFS) published an Industry Letter detailing ransomware risk management expectations for banks, insurers, and virtual currency firms. NYDFS highlighted common intrusion vectors, required multifactor authentication and privileged access controls, urged firms to rehearse incident playbooks, and reminded licensees of 72-hour reporting obligations under 23 NYCRR 500.
Compliance leaders should validate MFA coverage for remote access and privileged accounts, tighten backup segmentation, and ensure incident runbooks align with DFS notification and data-retention requirements.
Continue in the Compliance pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Third-Party Risk Oversight Playbook — Zeph Tech
Operationalize OCC, Federal Reserve, EBA, and MAS outsourcing expectations with lifecycle controls, continuous monitoring, and board reporting.
-
Compliance Operations Control Room — Zeph Tech
Implement cross-border compliance operations that satisfy Sarbanes-Oxley, DOJ guidance, EU DORA, and MAS TRM requirements with verifiable evidence flows.
-
SOX Modernization Control Playbook — Zeph Tech
Modernize Sarbanes-Oxley (SOX) compliance by aligning PCAOB AS 2201, SEC management guidance, and COSO 2013 controls with data-driven testing, automation, and board reporting.