The New York Department of Financial Service (NYDFS) has published a new cybersecurity regulation draft which might have a direct-indirect impact on the state’s Bitcoin industry growth. Touted as the regulation that would limit consumers’ exposure to cyber attacks, the aforementioned law is likely to put additional legal burdens on the New York’s freshly brewing Bitcoin sector. The state’s FinTech entrepreneurs were already facing troubles in complying with a draconian BitLicense law. Nevertheless, the new regulation is supposed to be the first of its kind in the entire United States, proposed to counter the “growing threat” from terrorists and other criminal organizations. “This regulation is designed to promote the protection of customer information as well as the information technology systems of regulated entities,” — states the introductory section of the new cybersecurity requirements draft. For starters, the Bitcoin industry never wanted to collect customer information in the first place but was forced to do so by the BitLicense. Now, the very department seems to be imposing additional regulations to address one of the potential problems which never existed before BitLicense. Compliance Requirements for the New Cybersecurity Regulation According to the proposed regulation , companies will be required to assess their risk profiles and design a program to address those risks. Financial services companies in the State of New York will be required to draft a cybersecurity policy for their respective organizations to address the following areas: (a). information security, (b). data governance and classification, (c). access controls and identity management, (d). business continuity and disaster recovery planning and resources, (e). capacity and performance planning, (f). systems operations and availability concerns, (g). systems and network security, (h). systems and network monitoring, (i). systems and application development and quality assurance, (j). physical security and environmental controls, (k). customer data privacy, (l). […]
