New NY DFS Cyber Reg FAQs: Novel Approach to Notifications on Vendor Breaches; Cloud and Other Services Are Part of “Internal Networks” and No Specific Framework Required for Risk Assessment

The New York Department of Financial Services has published three new FAQs that interpret certain requirements under its Cybersecurity Regulation related to breaches by service providers, the use of cloud and other services, and risk assessments.