The regulations and standards we work with
These are the rules and frameworks our clients most often answer to. For each one we set out what it requires and how we handle it.
New York's cybersecurity regulation
The most demanding financial-services cybersecurity regulation in the United States, and a model other states have followed. It applies to firms licensed or registered by the New York Department of Financial Services and requires a senior officer to certify compliance each year. Whether, and how far, it reaches your firm is something we establish and put in writing.
- A written cybersecurity program and policies approved by senior management (500.02–500.03)
- A chief information security officer who reports to the board in writing each year (500.04)
- A risk assessment that shapes the program (500.09)
- Multi-factor authentication, encryption, access controls, monitoring and staff training (500.05–500.15)
- Notice to the Department within 72 hours of determining that a cybersecurity incident has occurred (500.17(a))
- An annual certification of compliance, or an acknowledgment of noncompliance (500.17(b))
Our role: we establish how much of Part 500 applies to your firm and whether an exemption is available, build the program, act as or support your security lead, and make sure the officer who signs each April has a dated evidence file behind the signature.
The GLBA Safeguards Rule
The federal baseline for nonbank financial institutions. Its definition of a financial institution is broader than many firms expect. It requires a written information security program with specific elements, run by a qualified individual who reports to the board.
- A qualified individual responsible for the program (§314.4(a))
- A written risk assessment with defined criteria (§314.4(b))
- Access controls, encryption, multi-factor authentication, monitoring and secure disposal of data (§314.4(c))
- Selection and oversight of service providers (§314.4(f))
- A written incident response plan (§314.4(h))
- An annual written report to the board or senior officers (§314.4(i))
Our role: the Safeguards program is the foundation of every engagement. We build it first, serve as or support your qualified individual, and keep the risk assessment and annual reporting on schedule.
SOC 2 readiness
SOC 2 is voluntary until a client makes it a condition of doing business. The costly mistake is to commission the audit before knowing how far you are from passing it.
- A readiness review against the Trust Services Criteria your clients request
- A readiness report and evidence index in terms an auditor will recognize
- A plan that builds on your existing security program, which usually covers much of the ground
Our role: we tell you plainly whether you are weeks or months from being ready, close the gaps that matter, and give the auditor a program built to be examined.
Where much of the detail is decided
Federal rules set the minimum. State licenses and state law determine much of the rest, and each state writes its own security conditions, breach-notification requirements and examination practices.
Requirements accumulate
Each new license brings rules that no one reads until an examiner does. Firms licensed in several states often carry requirements they have never been told about.
Established state by state
We identify the conditions your licenses and operations trigger in each state where you do business, including its data-security and breach-notification law.
Changes tracked
When a state adopts a rule that affects your firm, it goes on your compliance calendar well before an examiner asks about it.
The assessment tells you which of these apply
In two weeks, with the source of each requirement named.