New York regulator flags AI in guidance on compliance with cyber risk assessments

“The cybersecurity threat landscape continues to evolve rapidly. Risk Assessments should consider whether emerging technologies or changes in the threat environment materially affect their risk profile,” NYDFS says in the Sept. 10 guidance letter to regulated entities.

“Examples may include the adoption or use of artificial intelligence, advances in quantum computing that may affect future cryptographic protections, increasing software supply chain attacks, evolving ransomware techniques, and significant geopolitical tensions or conflict that result in increased nation-state cyber activity,” according to the guidance. “The Department's cybersecurity guidance and advisories may assist Covered Entities in identifying and evaluating emerging risks relevant to their operations.” The state agency emphasizes in a release that the guidance “does not impose new obligations or requirements on regulated entities. Rather, the guidance is intended to clarify regulatory requirements under the Department’s cybersecurity regulation and share best practices that entities should consider implementing.” New York put in place cyber regulations for the financial services sector in 2017 and updated them in 2023.

The NYDFS release says, “The guidance outlines key elements of effective risk assessment, including expectations related to governance and oversight, methodology, scope, documentation, and the need to integrate assessments into cybersecurity programs. Factors entities should consider when performing a risk assessment include:” Material Technology Change : Reassessing risk before or after major system migration, acquisition, or implementation of a new critical system. Third-Party Risk : Evaluating whether multiple critical functions depend on the same cloud provider, managed service provider, software platform, or other common dependency.

Emerging Risk : Considering how adoption of AI or other emerging technologies changes the entity’s threat exposure, data risks, access controls, or third-party dependencies. Risk-Informed Controls : Assessing identified risks to determine whether existing controls, policies, monitoring, or risk acceptance decisions need to be strengthened or updated. The guidance explains that NYDFS “reviews Covered Entities’ Risk Assessments and information security policies and procedures during examinations and investigations.

In these reviews and in interviews with Covered Entity personnel, DFS has identified common gaps in Risk Assessments which, in turn, have contributed to deficient cybersecurity programs.” It says, “These observations include, among others . . . failure to account for evolving and interconnected risks, including emerging technologies, changes in the threat landscape, interdependencies, concentration risk, and single points of failure that could materially affect the Covered Entity's operations.” In other areas with AI usage implications, the guidance says, “Risk Assessments should evaluate cybersecurity risks associated with Third-Party Service Providers based on the criticality of the services provided, the sensitivity of the information accessed or maintained, the level of connectivity to the Covered Entity's Information Systems, and the potential operational impact should the provider experience an incident or other disruption.” “This evaluation,” it says, “should include, where appropriate, cloud service providers, managed security service providers, software vendors, payment processors, Affiliates, and other organizations that support critical business functions.” Further, NYDFS says, “Risk Assessments should evaluate cyber interdependencies among Information Systems, shared technology platforms, information security services, and Third-Party Service Providers. Technologies, platforms, or vendors that present limited risk when evaluated independently may collectively create significant cyber risk when multiple critical systems or business functions rely on common infrastructure, cloud service providers, software platforms, managed service providers, or other shared dependencies.” The guidance says, “Covered Entities should identify potential single points of failure, assess concentration risk, and evaluate how a Cybersecurity Event affecting one dependency could impact other Information Systems or critical business functions. Understanding these cyber interdependencies enables Covered Entities to better assess systemic cyber risk, prioritize mitigation efforts, and strengthen the resilience of their cybersecurity program.” NYDFS acting Superintendent Kaitlin Asrow said, “Risk assessments are the foundation of a strong cybersecurity program.

As cybersecurity risks evolve and institutions’ risk profiles change, it is critical that their cybersecurity programs adapt, and this guidance outlines those expectations.” NYDFS put out guidance on frontier AI models in May with recommendations to prepare for heightened cybersecurity risks.