New York Mandates Reporting of Ransom Payments and Strengthens Cybersecurity Regulations

New York's Department of Financial Services has introduced new regulations requiring banks and other financial institutions to implement governance, reporting, and training measures to enhance their cybersecurity. The rules include a 24-hour deadline for reporting ransom payments made in connection with a ransomware event and a 30-day requirement to explain the reasons behind the payment. Banks must also implement multifactor authentication for employees and customers accessing their information systems. The regulations aim to protect customer data and maintain the integrity of the financial system in response to the increasing number of cyberattacks. The rules harmonize with existing regulations and frameworks and emphasize the role of boards in overseeing cybersecurity risk management. The regulations will be effective from November 1, with certain provisions taking effect at later dates.