Monday, April 12, 2021
On March 1, 2017, the New York State Department of Financial Services (“NYDFS”) Cybersecurity Requirements for Financial Services Companies (the “Cybersecurity Regulation”) became effective.
[1] Fast forward four years, where NYDFS issued its first penalty under the Cybersecurity Regulation arising from a standard examination. On March 3, 2021, NYDFS entered into a Consent Order with Residential Mortgage Services, Inc. (“RMS”) that requires RMS to pay a penalty of $1.5 million after a standard examination uncovered an unreported email compromise impacting New York consumers and a lack of periodic risk assessments by RMS. Previously, the only NYDFS cybersecurity enforcement action was against a title insurance company that experienced a large, publicly-reported data breach. The fact that NYDFS penalized RMS in connection with a standard examination demonstrates the importance of covered entities’ compliance with the Cybersecurity Regulation.