How Identity and Access Management Supports NYDFS 23 NYCRR 500

Access privileges: limit to job need

500.7 Access privileges and management. (a) As part of its cybersecurity program, based on the covered entity’s risk assessment each covered entity shall: (1) limit user access privileges to information systems that provide access to nonpublic information to only those necessary to perform the user’s job;

In practice: People receive access based on their job function through roles, and anything beyond the role goes through a request that a manager or application owner approves.

Privileged accounts: limit number and functions

(2) limit the number of privileged accounts and limit the access functions of privileged accounts to only those necessary to perform the user’s job;

In practice: The team keeps a list of privileged accounts, uses separate admin accounts, limits what each admin role can do, and reviews who belongs to those groups.

Privileged accounts: limit use

(3) limit the use of privileged accounts to only when performing functions requiring the use of such access;

In practice: Administrators raise their rights only for a specific task: elevation is time-bound, credentials are checked out with approval, and the privileged session is recorded.

Periodic access review

(4) periodically, but at a minimum annually, review all user access privileges and remove or disable accounts and access that are no longer necessary;

In practice: At least once a year, and often more frequently, reviewers go through every user's access in a campaign, and removals made during the review are recorded with the completed campaign.

Prompt termination of access

(6) promptly terminate access following departures.

In practice: When HR records a departure, the identity governance platform removes directory, privileged and third-party access, and a reconciliation report catches accounts that stayed active.

Written password policy

(b) To the extent passwords are employed as a method of authentication, the covered entity shall implement a written password policy that meets industry standards.

In practice: The written password policy is applied as actual settings in the directory and identity provider, and the policy notes any applications the entity has moved to passwordless sign-in.

Class A: privileged access management and common-password blocking

(c) Each class A company shall monitor privileged access activity and shall implement: (1) a privileged access management solution; and (2) an automated method of blocking commonly used passwords for all accounts on information systems owned or controlled by the class A company and wherever feasible for all other accounts. To the extent the class A company determines that blocking commonly used passwords is infeasible, the covered entity’s CISO may instead approve in writing at least annually the infeasibility and the use of reasonably equivalent or more secure compensating controls.

In practice: At Class A companies, privileged accounts are managed in a privileged access tool with activity monitored, and an automated banned-password list blocks commonly used passwords.

Multi-factor authentication

500.12 Multi-factor authentication. (a) Multi-factor authentication shall be utilized for any individual accessing any information systems of a covered entity, unless the covered entity qualifies for a limited exemption pursuant to section 500.19(a) of this Part in which case multi-factor authentication shall be utilized for: (1) remote access to the covered entity’s information systems; (2) remote access to third-party applications, including but not limited to those that are cloud based, from which nonpublic information is accessible; and (3) all privileged accounts other than service accounts that prohibit interactive login.

In practice: Employees, remote users, third parties and administrators all complete multi-factor sign-in, with a registration report and a written list of any exclusions.

Cybersecurity policy: access controls and identity management

Each covered entity shall implement and maintain a written policy or policies, approved at least annually by a senior officer or the covered entity’s senior governing body for the protection of its information systems and nonpublic information stored on those information systems. Procedures shall be developed, documented and implemented in accordance with the written policy or policies. The cybersecurity policy or policies and procedures shall be based on the covered entity’s risk assessment and address, at a minimum, the following areas to the extent applicable to the covered entity’s operations: (a) information security; (b) data governance, classification and retention; (c) asset inventory, device management and end of life management; (d) access controls, including remote access and identity management; [remaining areas (e) to (o) omitted]

In practice: The policy owner writes and approves the access policy; identity engineers review the access sections so the written rules describe how the platform is actually configured.

Audit trail

500.6 Audit trail. (a) Each covered entity shall securely maintain systems that, to the extent applicable and based on its risk assessment: (1) are designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the covered entity; and (2) include audit trails designed to detect and respond to cybersecurity events that have a reasonable likelihood of materially harming any material part of the normal operations of the covered entity.

In practice: The audit trail system belongs to security or IT; identity events such as sign-ins, elevations and entitlement changes are retained and forwarded there so they can be searched later.

Risk assessment

(a) Each covered entity shall conduct a periodic risk assessment of the covered entity’s information systems sufficient to inform the design of the cybersecurity program as required by this Part. Such risk assessment shall be reviewed and updated as reasonably necessary, but at a minimum annually, and whenever a change in the business or technology causes a material change to the covered entity’s cyber risk. The covered entity’s risk assessment shall allow for revision of controls to respond to technological developments and evolving threats and shall consider the particular risks of the covered entity’s business operations related to cybersecurity, nonpublic information collected or stored, information systems utilized and the availability and effectiveness of controls to protect nonpublic information and information systems.

In practice: The risk assessment team owns the assessment; identity hands over its account and entitlement inventory and recent review results for the access-related sections.

Third-party service providers: access controls

(b) Such policies and procedures shall include relevant guidelines for due diligence and/or contractual protections relating to third-party service providers including to the extent applicable guidelines addressing: (1) the third-party service provider’s policies and procedures for access controls, including its use of multi-factor authentication as required by section 500.12 of this Part, to limit access to relevant information systems and nonpublic information;

In practice: The vendor management team sets third-party rules; identity gives provider staff sponsored accounts with multi-factor sign-in and lets owners review what those accounts can reach.

Multi-factor authentication: compensating controls

(b) If the covered entity has a CISO, the CISO may approve in writing the use of reasonably equivalent or more secure compensating controls. Such controls shall be reviewed periodically, but at a minimum annually.

In practice: If the CISO approves a substitute for multi-factor sign-in, identity keeps a register of those approvals with the affected systems and a date for the annual review.

Asset inventory

(a) As part of its cybersecurity program, each covered entity shall implement written policies and procedures designed to produce and maintain a complete, accurate and documented asset inventory of the covered entity’s information systems. The asset inventory shall be maintained in accordance with written policies and procedures. At a minimum, such policies and procedures shall include: (1) a method to track key information for each asset, including, as applicable, the following: (i) owner; (ii) location; (iii) classification or sensitivity; (iv) support expiration date; and (v) recovery time objectives; and (2) the frequency required to update and validate the covered entity’s asset inventory.

In practice: IT owns the asset inventory; identity contributes named owners for systems and service accounts and device identity records that the inventory can draw on.

Monitoring of authorized user activity

500.14 Monitoring and training. (a) As part of its cybersecurity program, each covered entity shall: (1) implement risk-based policies, procedures and controls designed to monitor the activity of authorized users and detect unauthorized access or use of, or tampering with, nonpublic information by such authorized users;

In practice: Security monitors user activity; sign-in events and identity-based alerts, such as an unusual administrator login, feed that monitoring.

Class A: endpoint detection and centralized logging

(b) Each class A company shall implement, unless the CISO has approved in writing the use of reasonably equivalent or more secure compensating controls: (1) an endpoint detection and response solution to monitor anomalous activity, including but not limited to lateral movement; and (2) a solution that centralizes logging and security event alerting.

In practice: Security runs the central logging solution; identity audit and detection events are forwarded to it so alerts can draw on who signed in and what changed.

Cybersecurity program

(a) Each covered entity shall maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of the covered entity’s information systems and nonpublic information stored on those information systems.

Chief information security officer

(a) Chief information security officer. Each covered entity shall designate a CISO. The CISO may be employed by the covered entity, one of its affiliates or a third-party service provider. If the CISO is employed by a third-party service provider or an affiliate, the covered entity shall: (1) retain responsibility for compliance with this Part; (2) designate a senior member of the covered entity’s personnel responsible for direction and oversight of the third-party service provider; and (3) require the third-party service provider or affiliate to maintain a cybersecurity program that protects the covered entity in accordance with the requirements of this Part.

Vulnerability management

Each covered entity shall, in accordance with its risk assessment, develop and implement written policies and procedures for vulnerability management that are designed to assess and maintain the effectiveness of its cybersecurity program. These policies and procedures shall be designed to ensure that covered entities: (a) conduct, at a minimum: (1) penetration testing of their information systems from both inside and outside the information systems’ boundaries by a qualified internal or external party at least annually; and (2) automated scans of information systems, and a manual review of systems not covered by such scans, for the purpose of discovering, analyzing and reporting vulnerabilities at a frequency determined by the risk assessment, and promptly after any material system changes; (b) are promptly informed of new security vulnerabilities by having a monitoring process in place; and (c) timely remediate vulnerabilities, giving priority to vulnerabilities based on the risk they pose to the covered entity.

Remote control protocols

(5) disable or securely configure all protocols that permit remote control of devices;

Application security

(a) Each covered entity’s cybersecurity program shall include written procedures, guidelines and standards designed to ensure the use of secure development practices for in-house developed applications utilized by the covered entity, and procedures for evaluating, assessing or testing the security of externally developed applications utilized by the covered entity within the context of the covered entity’s technology environment.

Cybersecurity personnel: updates and training

(2) provide cybersecurity personnel with cybersecurity updates and training sufficient to address relevant cybersecurity risks;

Secure disposal of nonpublic information

(b) As part of its cybersecurity program, each covered entity shall include policies and procedures for the secure disposal on a periodic basis of any nonpublic information identified in section 500.1(k)(2)–(3) of this Part that is no longer necessary for business operations or for other legitimate business purposes of the covered entity, except where such information is otherwise required to be retained by law or regulation, or where targeted disposal is not reasonably feasible due to the manner in which the information is maintained.

Malicious code protection

(2) implement risk-based controls designed to protect against malicious code, including those that monitor and filter web traffic and electronic mail to block malicious content; and

Awareness training

(3) provide periodic, but at a minimum annual, cybersecurity awareness training that includes social engineering for all personnel that is updated to reflect risks identified by the covered entity in its risk assessment.

Encryption of nonpublic information

(a) As part of its cybersecurity program, each covered entity shall implement a written policy requiring encryption that meets industry standards, to protect nonpublic information held or transmitted by the covered entity both in transit over external networks and at rest.

Incident response plan

(1) Incident response plan. Incident response plans shall be reasonably designed to enable prompt response to, and recovery from, any cybersecurity event materially affecting the confidentiality, integrity or availability of the covered entity’s information systems or the continuing functionality of any aspect of the covered entity’s business or operations. Such plans shall address the following areas with respect to different types of cybersecurity events, including disruptive events such as ransomware incidents: [list of areas (i) to (ix) omitted]

Notice of cybersecurity incident

(1) Each covered entity shall notify the superintendent electronically in the form set forth on the department’s website as promptly as possible but in no event later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, its affiliates, or a third-party service provider.