New cyber security rules for New York financial institutions went into effect in March.
New cyber security
exposure for directors
and officers at
By Alex Wright
Boards of directors could face a fresh wave of directors and officers (D&O) claims following the introduction of tough new cybersecurity rules for financial institutions by The New York State Department of Financial Services (DFS). Prompted by recent high profile cyber attacks on JPMorgan Chase,
Sony, Target, and others, the state regulations are the first of their kind and went
into effect on March 1.
The new rules require banks, insurers and other financial institutions to
establish an enterprise-wide cybersecurity program and adopt a written policy that
must be reviewed by the board and approved by a senior officer annually.
The regulation also requires the more than 3,000 financial services firms
operating in the state to appoint a chief information security officer to oversee the
program, to report possible breaches within 72 hours, and to ensure that third-party vendors meet the new standards.
Companies will have until September 1 to comply with most of the new
requirements, and beginning February 15, 2018, they will have to submit an
annual certification of compliance.
The responsibility for cybersecurity will now fall squarely on the board and
senior management actively overseeing the entity’s overall program. Some experts
fear that the D&O insurance market is far from prepared to absorb this risk.
“The new rules could raise compliance risks for financial institutions
and, in turn, premiums and loss potential for D&O insurance underwriters,”
warned Fitch Ratings in a statement. “If management and directors of financial
institutions that experience future cyber incidents are subsequently found to be
noncompliant with the New York regulations, then they will be more exposed to
litigation that would be covered under professional liability policies.”
Judy Selby, managing director in BDO Consulting’s technology advisory
services practice, said that while many directors and officers rely on a CISO to
deal with cybersecurity, under the new rules the buck stops with the board.
“The common refrain I hear from directors and officers is ‘we have a great IT
guy or CIO,’ and while it’s important to have them in place, as the board, they are
ultimately responsible for cybersecurity oversight,” she said.
William Kelly, senior vice president, underwriting at Argo Pro, said that unknown
cyber threats, untested policy language and developing case laws would all make it
more difficult for the D&O market to respond accurately to any such new claims.
“Insurers will need to account for the increased exposures presented by these
new regulations and charge appropriately for such added exposure,” he said.
Going forward, said Larry Hamilton, partner at Mayer Brown, D&O
underwriters also need to scrutinize a company’s compliance with the regulations.
“To the extent that this risk was not adequately taken into account in the first
place in the underwriting of in-force D&O policies, there could be unanticipated
additional exposure for the D&O insurers,” he said.
Michelle Lopilato, Hub International’s director of cyber and technology
solutions, added that some carriers may offer more coverage, while others may
“How the markets react will evolve
as we see how involved the department
becomes in investigating and fining
financial institutions for noncompliance
and its result on the balance sheet and
dividends,” she said.
Christopher Keegan, senior
managing director at Beecher Carlson,
said that by setting a benchmark,
the new rules would make it easier
for claimants to make a case that the
company had been negligent.
Insurers, on their part, will
need to account for the
increased exposures presented
by these new regulations and
charge appropriately for such
—William Kelly, senior vice president,
underwriting, Argo Pro.
• New cybersecurity rules place
added burdens of financial
• Boards of directors will bear the
brunt of compliance responsibility.
• Companies must establish
cybersecurity programs and vet