The proposed cybersecurity regulations from the New York Department of Financial Services would impose significant new compliance responsibilities on over 4,000 financial institutions in New York. The regulations set the most prescriptive standards among any state or federal agency and would require companies to establish comprehensive cybersecurity programs, designate cybersecurity personnel, and report any cyber incidents within 72 hours. The regulations have major implications for communications professionals in developing robust cybersecurity response plans, preparing for potential leaks, and ensuring effective employee training on cybersecurity awareness.

1. © Brunswick | 2016 | Confidential | 1
PublicAffairsAdviceNote
September 22, 2016
Subject:
Proposed cybersecurity regulations
from the NY Department of Financial Services
Summary
Groundbreaking cybersecurity regulations
proposed this month by the New York State
Department of Financial Services would
impose significant new compliance
responsibilities. The proposed regulations
raise the bar for communications and public
affairs professionals in particular around
cybersecurity planning and response.
Overview and Background
In mid-September, New York Governor Andrew Cuomo proposed
far-reaching cyber security regulations applying to the roughly
4,000 banks, insurance companies, or other financial services
institutions regulated by the New York State Department of
Financial Services. The proposed regulations are the most
prescriptive and ambitious among any state or federal agency.
Given New York’s leadership in financial services, these
regulations set a precedent that will likely influence other
jurisdictions. The proposed regulations, which are subject to a
public comment period and take effect in January, 2017, could
have significant implications for communicators, requiring in
many cases a reassessment of cyber risk policies in place within
their companies.

2. © Brunswick | 2016 | Confidential | 2
Key Features of the Proposed Rules
The proposed regulations far surpass existing federal or state regulations on cybersecurity, and
will require a deeper approach and greater integration between legal, communications, and
technology planning and strategies. The regulations would require that institutions regulated
by the NY DFS establish and maintain a cybersecurity program, which includes, but is not
limited to:
 Regular identification of external and internal cyber risks and use of defensive infrastructure to
reduce risks.
 A written cybersecurity policy setting forth protocols for security, monitoring, and incident
response reviewed by the company’s board of directors.
 Designation of a chief information security officer.
 Employment and regular training of cybersecurity personnel and increased cyber awareness
for all personnel.
 An information security policy for managing third party vendors, including establishing
“preferred provisions” for inclusion in vendor contracts.
 An incident response plan to respond to and recover from a cybersecurity incident.
 Notification of the DFS within 72 hours of a cyber event.
For full details, please see the full proposed regulations.
Communications and Public Relations Implications
© Brunswick 2016
1
New York DFS Proposed Cybersecurity Regulations: What Communicators
Need to Think About
Do you have an
incident response plan
that includes internal
and external
communications?
Are you prepared for
stringent new
reporting
requirements for
cybersecurity
incidents?
Do you have effective
employee
communications
programs around
cybersecurity?
1 2 3
Is communications
planning robust, defining
roles and responsibilities
throughout the company,
and tested in
simulations?
Do you have a leak
strategy, and do you have
relevant documents (e.g.,
holding statements,
talking points) in place?
Is your cybersecurity
awareness program
conveyed to employees in
a way they will
understand?

3. © Brunswick | 2016 | Confidential | 3
Every company holds data, and these proposed regulations create a business and legal case for
taking strong measures to mitigate cyber risks—including reputational ones. Companies should
take this opportunity to look closely at their communications response plan, employee education
and training, and preparation for cyber incident leaks. Even for companies who have each of these
elements in place, the proposed regulations may require changes. Communications departments
should consider the following in light of the proposed regulations:
 The proposed regulations are far more prescriptive around incident response plans, and
specifically require that plans include “external and internal communications and
information sharing.” Communications plans have always been critical for reputation
protection, and are now necessary to comply with NY DFS regulations. All companies
subject to the DFS regulations should ensure robust cyber communications plans are in
place.
 The proposed regulations tighten reporting requirements, requiring notification of the
superintendent of the NY DFS no later than 72 hours after a company becomes aware of a
cybersecurity incident. Companies should prepare in advance for any public leakage of
reports. Preparations should include, but are not limited to: media holding statements,
stakeholder mapping to anticipate and plan responses, talking points for various
stakeholders, and a leak strategy.
 The regulations require that all personnel attend regular cybersecurity awareness training.
Companies should ensure that training materials, and employee engagement around
cybersecurity, be in accordance with their cultures and effectively communicated to all
employees.
For further information on communications planning, please contact
cybersecurityUS@brunswickgroup.com.