New York Department of Financial Services Guidance on AI-Related Cybersecurity Risks

On October 16, 2024, the New York Department of Financial Services (“NYDFS”) issued guidance (“Guidance”) concerning cybersecurity risks that arise in response to the advancements in artificial intelligence (“AI”). AI technology has, in many cases, positively impacted cybersecurity and businesses, improving the ability of entities – including those regulated by DFS (referred to herein as “Covered Entities”) – to prevent cyberattacks, enhance threat detection, and improve incident response strategies. However, AI has also opened the door to a myriad of opportunities for cybercriminals to infiltrate secure information systems containing Nonpublic Information (“NPI”).

The Department has received inquiries about how AI is changing cyber risk and how Covered Entities can mitigate risks associated with AI. The Guidance is intended to be a tool to assist Covered Entities in understanding and assessing cybersecurity risks associated with the use of AI and the controls that may be used to mitigate those risks.

The Guidance does not impose any new requirements beyond those in NYDFS’s cybersecurity regulation codified at 23 NYCRR Part 500 (the “Cybersecurity Regulation”); it is meant to explain how Covered Entities should use the framework set forth in the Cybersecurity Regulation to assess and mitigate cyber risks associated with AI.

While there are many risks related to the use of AI, there are certain threats that are specific to cybersecurity. The Guidance highlights some of the more concerning threats identified by cybersecurity experts, but it is not exhaustive.

One of the most important requirements for combatting AI-related risks is to maintain Third-Party Service Provider (‘TPSP”) policies and procedures that include guidelines for conducting due diligence before a Covered Entity uses a TPSP that will access its Information Systems and/or NPI.

Implementing robust access controls is another defensive measure used to combat the threat of deepfakes and other forms of AI-enhanced social engineering attacks, and to prevent threat actors from gaining unauthorized access to a Covered Entity’s Information Systems and the NPI maintained on them.

How Centri Can Help

At Centri, we understand the evolving landscape of cybersecurity risks, particularly with the advancements in AI. Our IT risk and cybersecurity advisory experts collaborate with your senior management to:

• Assess cybersecurity threats and vulnerabilities to your organization via a comprehensive risk-based approach.
• Align your internal controls with recognized industry frameworks.
• Provide valuable insight and actionable takeaways & implementation plans.
• Serve as trusted risk advisors, including developing roadmaps to address the cybersecurity challenges that are unique to your organization.

Contact us to learn more about how we can support your organization in managing AI-related cybersecurity risks and maintaining compliance with evolving regulations.