Cybersecurity
NYS DFS Part 500 Cybersecurity Program Requirements
CYBERSECURITY | NYS DFS
Part 500 Cybersecurity Program Annual Certification
The NYS DFS 23 New York Codes, Rules and Regulations (NYCRR) Part 500, known as the “Cybersecurity Regulations,” established stricter standards for financial services companies in response to rising cybersecurity threats. On November 1, 2023, NYS DFS finalized the 2nd Amendment adoption, reinforcing the cybersecurity risk-based approach that financial entities must incorporate into business strategy and risk management.
Critically, the 2nd Amendment added the review frequency of a dedicated cybersecurity risk assessment, implementation of Multi-factor Authentication (MFA), Incident Response and Business Continuity testing, and submission of Notice of Explanation of Extortion Payment and annual Notice of Compliance.
Strengthening Cybersecurity in the EU through Digital Operational Resilience
CYBERSECURITY | EU
Implementation and Requirements of the Digital Operational Resilience Act (DORA)
The Digital Operational Resilience Act (DORA) was enacted in January 2023 and will take effect in January 2025, with the objective of incorporating the components of operational resilience in managing risk, strengthening the information technology security of banks, insurance companies and investment firms in the event of severe operational disruption.
Before the introduction of DORA, financial institutions managed operational risk mainly through the allocation of capital. With the increasing dependence of financial institutions to technology and tech companies, the importance of managing risk involving information and communication technology (ICT) third-party service providers (TPSPs) has become more crucial than ever.
Harmonizing UK’s Cybersecurity Posture with the EU’s DORA
CYBERSECURITY | UK EU
UK and EU Strategies for Cross-Jurisdictional DORA Resilience and Regulatory Readiness
Both the UK and the EU are accelerating enhancements to their cybersecurity and operational resilience frameworks, with 2025 marking a pivotal implementation year. These developments signal a shift from policy design to active supervision and enforcement, raising the bar for firms operating across both jurisdictions.
With the UK operational resilience framework in effect through 2025, supervisory focus has shifted to firms demonstrating embedded resilience, including effective impact tolerances, scenario testing, and oversight of Critical Third Parties. As DORA took effect in January 2025, supervisory focus shifted to ongoing compliance, with increased emphasis on effective Information and Communication Technology (ICT) risk management, incident reporting, resilience testing, and third-party oversight. 2026 contains fewer fixed deadlines but marks a clear shift to sustained supervisory scrutiny and enforcement across both the EU and the UK.
Reporting Obligations under Australia’s Cyber Security Act 2024
CYBERSECURITY | AU
Cyber Security Act 2024 Mandatory Incident Reporting and Ransomware Reporting Guidance
The Cyber Security Act 2024 officially became law on November 2024 applicable to Smart Devices or relevant connectable products, acquired in Australia, that can connect (directly or indirectly) to the internet or a network. The following identify the Act’s objectives:
•Mandatory minimum cybersecurity standards for smart devices.
•A “Limited Use” obligation for the National Cyber Security Coordinator to foster industry engagement with the government after cyber incidents.
•Establish the Cyber Incident Review Board (CIRB) to review major cyber incidents and advise on response and impact reduction.
•Mandatory reporting for certain businesses to disclose ransomware and cyber extortion payments.
•Encourage cyber incident reporting to the AU Government with protections on use and liability.
•Support consent-based, limited-purpose sharing of cyber incident data with State and Territory Governments (not admissible evidence).













