New York state's mandatory cybersecurity requirements for financial institutions reached a significant deadline, August 28, whereby covered entities must create a written security policy and appoint a chief information security officer.

The August date marks the end of a 180-day transitional period for the New York State Department of Financial Services cybersecurity regulations, which went into effect on March 1, 2017, required financial institutions to provide minimum cybersecurity standards and report breaches to regulators to limit consumer losses. Covered entities must also limit access privileges to nonpublic data, periodically assess the process, and implement procedures to inform the state regulator within 72 hours of cybersecurity or data security incidents.

New York's Department of Financial Services regulates numerous financial entities including credit unions, banks, trusts, budget planners, check cashers, money transmitters, licensed lenders, and mortgage brokers. The NYDFS does not have jurisdiction over broker-dealers and registered investment advisors.