Anticipating the First Cybersecurity Enforcement Action by NYDFS

The question gets asked quite frequently in regulatory circles: “Will the New York State Department of Financial Services bring an enforcement action under its cybersecurity regulation, and if so, when?” The probable answers are “yes” and “soon.” A number of traditional factors that animate decisions about enforcement point to a likelihood in the near term of an enforcement proceeding against one or more regulated entities for a violation of the DFS cybersecurity regulation, known as “Part 500.” (23 N.Y.C.R.R.