NYDFS Issues Guidance on Managing Cybersecurity Risks for Third-Party Service Providers

The New York Department of Financial Services (NYDFS) recently released an industry letter providing guidance to regulated financial services providers regarding their responsibilities to oversee third-party service providers (TPSPs), which companies have increasingly relied upon to provide cloud computing, file transfer systems, artificial intelligence, and fintech solutions.

The guidance clarifies regulatory requirements under the New York Cybersecurity Regulation, which creates mandatory cybersecurity compliance requirements for financial services providers.  Regulated entities may not delegate their responsibility for compliance with the cybersecurity regulation to an affiliate or a TPSP.  The guidance discusses recommended best practices across the four stages of the relationship with TPSPs:

• Identification, due diligence, and selection of the service provider;

• Contracting, including expected terms and clauses addressing cybersecurity and technology-related requirements;

• Ongoing monitoring and oversight of the TPSPs’ cybersecurity compliance and identification of potential new risks; and

• Terminating the TPSP relationship, including ensuring the TPSP does not retain access to company data.

The NYDFS states that it will continue to evaluate whether regulated entities have appropriate TPSP risk management practices in its examinations, investigations, and enforcement actions.  The NYDFS further recommends that covered entities promptly review their cybersecurity programs to confirm they sufficiently manage risk in light of the issues and best practices highlighted in its guidance.