New York Proposes Major Changes to Cybersecurity Regulation
These days, cybersecurity is a hot-button issue in policy circles. Look no further than the US presidential debates, where our two candidates have highlighted the need to address h…
These days, cybersecurity is a hot-button issue in policy circles. Look no further than the US presidential debates, where our two candidates have highlighted the need to address hackers, security breaches and even foreign nations that may be using sophisticated cyber tactics to influence the outcome of the upcoming November elections. The pressure to get policies and systems in place to confront these threats is real. Some policy leaders, like those in New York, are not deferring to the federal government to take the lead.
On September 13, the New York Department of Financial Services (NYDFS) proposed first-of-its-kind cybersecurity rules covering a wide range of banks, insurers and financial services companies under its jurisdiction. The issuance of the proposed regulations follows a series of industry surveys and discussions with its regulated entities over the course of several years that provided insights on their cybersecurity programs, related costs and future plans.
At first blush, the NYDFS proposal appears to establish foundational cybersecurity requirements that are consistent with existing guidelines and industry best practices. For example, the proposal requires regulated entities to implement a cybersecurity program that is in alignment with the National Institute of Standards and Technology (NIST) Cybersecurity Framework. In addition, the proposal calls for the implementation and maintenance of a written cybersecurity policy that addresses a wide range of areas such as information security , data governance, vendor management, customer data privacy and incident response. These requirements are consistent with ISO 27001 standards and leading industry practices.
However, the NYDFS introduces many new prescriptive requirements that go beyond any current regulatory guidance or industry practices. The following are a few of the most widely discussed changes:
- Enhanced multi-factor authentication. Currently, multi-factor authentication is only required for a limited subset of external applications such as internet banking channels. The NYDFS proposal requires multi-factor authentication for any users accessing internal systems from an external network and for privileged access to database servers.
- Data encryption. The NYDFS requires data encryption not just for data in-transit but also for data at-rest. The requirements also mandate that organizations include these enhanced standards in their contracts with third-party service providers.
- Annual certification. The proposed rules establish an annual certification process similar to Sarbanes Oxley by requiring the Board of Directors or a senior officer to certify annually that the company’s cybersecurity program meets the New York standards. The current proposal is silent on whether this certification could subject signatories to individual liability in cases where the program is found to be deficient.
- Cyber incident reporting. Organizations would be required to notify NYDFS within 72 hours of cybersecurity events that have a reasonable likelihood of materially affecting the normal operation of the entity or that affect nonpublic information. Nearly every state has data security breach notification laws that set different standards on when notice may be given to consumers and state authorities, and under what circumstances. The proposal adds new standards to the regulatory maze of notification requirements.
Critics of the proposal are concerned about the overlap, added compliance costs and resource constraints that would be imposed especially on smaller companies. They note that most financial services firms are already complying with Payment Card Industry Data Security (PCI DSS), the Federal Financial Institutions Cybersecurity Assessment Tool, as well as the aforementioned NIST framework. In addition, there are also concerns that New York’s proposal could encourage other states to adopt their own set of cybersecurity regulations, resulting in a patchwork quilt of standards.
The federal government is currently engaged in myriad activities aimed at developing a comprehensive, uniform approach to cybersecurity standards. FICO recently submitted comments to the Commission on Enhancing National Cybersecurity, which is working on a report for President Obama with a set of recommendations; these will serve as a blueprint for the next Administration for strengthening cybersecurity in both public and private sectors.
Coordinated federal efforts are important, but as we have seen in New York, the states may not wait around for federal action. Given the unprecedented scope and prescriptive nature of the NYDFS proposal, there will likely be a wave of public comments in advance of the November 12, 2016 comment deadline. With compliance required just 180 days after the proposal’s January 1, 2017 effective date, all eyes will be on the Empire State to see how its final rules shape the evolving cybersecurity policy landscape.
Popular Posts
Average U.S. FICO® Score at 716, Indicating Improvement in Consumer Credit Behaviors Despite Pandemic
The FICO Score is a broad-based, independent standard measure of credit risk
Read more
The GSE Data Is Public. Here's What It Shows About Credit Score Modernization.
Independent Milliman analysis of GSE historical data confirms what anyone can now verify directly: FICO® Score 10T is the most predictive score.
Read more
FICO® Score High Achievers: Is Age the Only Factor?
<p>FICO’s latest research on <a href="http://www.fico.com/en/blogs/risk-compliance/us-credit-quality-rising-the-beat-goes-on/" target="_blank">national FICO® Score distribution</a> shows that US credit quality continues to trend upwards, with an increasing number of consumers scoring in the highest scores ranges. Given that, we decided it was time to refresh our study on “<a href="http://www.fico.com/en/blogs/risk-compliance/infographic-what-does-a-high-credit-scorer-look-like/" target="_blank">FICO® Score high achievers</a>,” where we examine the credit behavioural profiles of consumers with higher credit scores.</p> <p>As expected, our latest study showed that older people generally have higher scores, as has been the case in our <a href="http://www.fico.com/en/blogs/risk-compliance/age-before-beauty-credit-worthiness-before-youth/" target="_blank">past research</a>. This is largely because they have trade lines that have been open longer, which leads to higher scores (assuming the trade lines are in good standing and all other things equal). The most credit savvy among you will remember that length of credit history accounts for roughly 15% of the overall <a href="http://www.myfico.com/CreditEducation/WhatsInYourScore.aspx" target="_blank">FICO® Score calculation</a>.</p> <p>But for younger consumers, it isn’t too helpful to say, “just wait until you are 50 years old, and that will fix things!” Thus, I decided to dive deeper with our analysis, including looking at the credit behavioural characteristics of younger consumers with high FICO® Scores.</p> <p>In this analysis, I looked at credit characteristics for the two highest score bands, 750-799 and 800-850, which have about 16% and 23% of the population, respectively. I further broke this down by looking at the characteristics of the youngest 15% in each group, which occurs at age 29 for the 750-799 group and 43 for the 800-850. We used FICO<strong>®</strong> Score 9 for our analysis, and examined typical variables of the categories that go into the make-up of the score.</p> <p><a href="http://www.fico.com/en/blogs/wp-content/uploads/2016/10/FICO-Score-High-Achiever-table.png"><img class="alignnone size-full wp-image-29367" src="http://www.fico.com/en/blogs/wp-content/uploads/2016/10/FICO-Score-High-Achiever-table.png" alt="fico-score-high-achiever-table" width="715" height="747" /></a></p> <p>Since there’s a lot to dissect in this chart, I’ll highlight a few findings that struck me: <ul> <li><strong>Credit history.</strong> Higher scores are undoubtedly associated with a longer time on file. What’s striking is the higher average time on file for the 800+ group, both overall and for revolving accounts (the most common trade line). Clearly, it helps to start credit use early in life – but that’s not the sole determining factor for high scoring. The younger cohorts in both the 800+ and 750-799 groups have time on file medians significantly less than their older counterparts.</li> <li><strong>New credit.</strong> High credit scorers do, in fact, pursue new credit. We see little variation in months since last trade line opening and last inquiry among all groups observed.</li> <li><strong>Pay on time.</strong> As you might expect, the further in the past the delinquency, the higher the score – and that’s <u>if</u> a delinquency ever happened. 95% of the 800+ people and 72% of the 750-799 group have never been delinquent, which is a striking contrast to the 57% for the total population. The percentages for the younger groups are even higher, especially so for the 750-799ers. Collection items are also scarce for these high scorers. While 23% of the national population have collection items greater than $99, the figures are only 0.5% for the 800+ group and 3% for the 750-799 group. It is clear that, in conjunction with starting a credit file early, paying on time is a key trait of the FICO® Score high achiever.</li> <li><strong>Balance and utilization.</strong> Finally, we look at how credit is being used, focusing on revolving product use. (Since most people only have one mortgage or one auto loan, variation in instalment product figures is minimal and driven by payment history, which is near perfect for high scorers, as we’ve seen.) FICO® Score high achievers tend to have more open revolving accounts. While the % active trades and utilization are generally lower, by no means do high scorers avoid the use of credit products. What drives the difference here is the amount of <u>available</u> revolving credit utilized. The 800+ group is roughly 1/4 of the national median, both in total and on their highest utilized card; they also have lower balances and more cards<em>. </em>The 750-799 group is more active and higher utilized, but still only at 2/3 of the national figures. The young 750-799 group compensate with lower revolving balances and, as a result, lower utilization, which is in line with what we see for the 800+ group.</li> <li><strong>Benchmarks.</strong> I’d like to point out that while this study provides good benchmarks of the typical credit traits of the FICO® Score high achiever, individual credit profiles will vary widely. And keep in mind that when we sort groups of consumers as a whole by different behaviours, some results may look superficially odd. For example, the 800+ band has a longer median average open account time (128 months) than average revolving months on file (140 months).</li> </ul> So, what do we conclude? A huge takeaway is that high scorers don’t have too much in the way of serious delinquencies and negative public record data.</p> <p>In most respects, the young 800+ people are like their peer group. They really only differ markedly in their shorter credit history and higher non-mortgage balance, both of which are a function of life stage. Our results show that you don’t have to be a credit product hermit; these high scorers have more credit cards. The takeaway is to start credit activity early and maintain well-managed and moderate usage.</p> <p>In many ways, the young 750-799 people are more interesting because their age profile is much younger. Their credit characteristics differ more from their peer group, particularly in terms of length of credit history. They compensate by having almost pristine credit records and lower balances.</p> <p>Ultimately, 39% of US consumers are FICO® Score high achievers, which they accomplish by following common-sense credit practices. It ain’t rocket science!</p>
Read moreTake the next step
Connect with FICO for answers to all your product and solution questions. Interested in becoming a business partner? Contact us to learn more. We look forward to hearing from you.