Training and Monitoring (Section 500.14): Covered entities are still required in the updated proposal to provide regular cybersecurity awareness training, but all personnel are no longer required to attend.

Encryption of Nonpublic Information (Section 500.15): The original proposed regulation provided a one year lead time for implementation of encryption in transit and a five year lead time for implementation of encryption at rest. The updated proposed regulation indicates that compensating controls may be used indefinitely if encryption of nonpublic information is infeasible.

Notices to the Superintendent (500.17): The requirement to notify the superintendent “as promptly as possible but in no event later than 72 hours from a determination that a Cybersecurity Event” has occurred remains, but the words “actual or potential” have been removed from the definition.

Exceptions (Section 500.19): The exception for covered entities with “fewer than 1000 customers” has been removed and replaced with an exception for covered entities with “fewer than 10 employees including any independent contractors.”

General Changes: Throughout the updated proposed regulation, phrases such as “at a minimum”, “no less than annually” and “assigning accountability” have been removed and phrases such as “to the extent applicable” and “updated as necessary” have been added.

The full text of the updated DFS regulation is available here.

As updated and proposed, the DFS cybersecurity regulation significantly softens the “mandatory minimum” approach taken in the earlier version. The changes will reduce the expense of supporting conflicting or duplicative regulatory requirements and security framework best practices, and will likely be welcomed by covered entities and the third party vendors that support them. Alignment of existing policies and procedures with the new regulation and the likely forthcoming federal regulations will be far from automatic, however, and the evolving threat landscape should encourage businesses in all industries to improve their security posture on an ongoing basis.

***** Justin Hectus is the Chief Information Officer and Chief Information Security Officer of Keesal, Young & Logan (KYL). A member of Cybersecurity Law & Strategy's Board of Editors and a two-time ILTA Distinguished Peer Award winner, his dual role at KYL incorporates development and execution of the firm's strategic technology vision and leadership of initiatives focused on managing risks for the firm and its clients. Julie Taylor is a shareholder with Keesal, Young & Logan in its San Francisco office and is admitted to practice in California and Washington. Julie litigates employment matters throughout the United States, and regularly advises clients on a myriad of employee-related concerns. In addition, Julie is significantly involved in the firm's nationally recognized e-discovery, technology and cybersecurity initiatives.