New York Department of Financial Services Guidance on AI-Related Cybersecurity Risks

On October 16, 2024, the New York Department of Financial Services (“NYDFS”) issued guidance (“Guidance”) concerning cybersecurity risks that arise in response to the advancements in artificial intelligence (“AI”). AI technology has, in many cases, positively impacted cybersecurity and businesses, improving the ability of entities – including those regulated by DFS (referred to herein as “Covered Entities”) – to prevent cyberattacks, enhance threat detection, and improve incident response strategies. However, AI has also opened the door to a myriad of opportunities for cybercriminals to infiltrate secure information systems containing Nonpublic Information (“NPI”).

The Department has received inquiries about how AI is changing cyber risk and how Covered Entities can mitigate risks associated with AI. The Guidance is intended to be a tool to assist Covered Entities in understanding and assessing cybersecurity risks associated with the use of AI and the controls that may be used to mitigate those risks.

The Guidance does not impose any new requirements beyond those in NYDFS’s cybersecurity regulation codified at 23 NYCRR Part 500 (the “Cybersecurity Regulation”); it is meant to explain how Covered Entities should use the framework set forth in the Cybersecurity Regulation to assess and mitigate cyber risks associated with AI.

While there are many risks related to the use of AI, there are certain threats that are specific to cybersecurity. The Guidance highlights some of the more concerning threats identified by cybersecurity experts, but it is not exhaustive.

One of the most important requirements for combatting AI-related risks is to maintain Third-Party Service Provider (‘TPSP”) policies and procedures that include guidelines for conducting due diligence before a Covered Entity uses a TPSP that will access its Information Systems and/or NPI.

Implementing robust access controls is another defensive measure used to combat the threat of deepfakes and other forms of AI-enhanced social engineering attacks, and to prevent threat actors from gaining unauthorized access to a Covered Entity’s Information Systems and the NPI maintained on them.

How Centri Can Help

At Centri, we understand the evolving landscape of cybersecurity risks, particularly with the advancements in AI. Our IT risk and cybersecurity advisory experts collaborate with your senior management to:

  • Assess cybersecurity threats and vulnerabilities to your organization via a comprehensive risk-based approach.
  • Align your internal controls with recognized industry frameworks.
  • Provide valuable insight and actionable takeaways & implementation plans.
  • Serve as trusted risk advisors, including developing roadmaps to address the cybersecurity challenges that are unique to your organization.

Contact us to learn more about how we can support your organization in managing AI-related cybersecurity risks and maintaining compliance with evolving regulations.

Kevin McLaughlin

Partner | Artificial Intelligence & Cannabis Practice Leader | CPA

Kevin is a Partner at Centri Business Consulting, where he leads the firm’s Artificial Intelligence and Cannabis practice groups. Since joining Centri in December 2014, Kevin has specialized in supporting high-growth companies, particularly those in the AI, technology and cannabis industries, through critical stages of their business lifecycle.. View Kevin McLaughlin's Full Bio

Rich Sowalsky

Managing Director | IT Risk & Cybersecurity Practice Leader | CISA

Rich is a Managing Director at Centri Business Consulting and the leader of the firm’s IT Risk & Cybersecurity Practice. He has more than 14 years of combined experience in internal control consulting, IT risk, cybersecurity advisory, and risk-based internal audits and accounting. View Rich Sowalsky's Full Bio

John Swanick

Senior Director | Insurance Practice | CPA

John is a Senior Director at Centri Business Consulting within the firm’s Insurance Practice. He has over 38 years of public accounting and management consulting experience serving both public and non-public clients within the Financial Services and Insurance sectors. View John Swanick's Full Bio

Joe Hayes

Managing Director | Insurance Practice Leader | CPA

Joe is a Managing Director at Centri Business Consulting and the leader of the firm’s Insurance Practice. He has over 30 years of global leadership experience performing and leading complex regulatory compliance, risk, internal audit, and controls engagements for large multinational companies. View Joe Hayes's Full Bio

Doug Borell

Senior Manager | CPA

Doug is a Senior Manager at Centri Business Consulting.  He has more than 15 years of experience in professional services supporting startups to Fortune 50 companies.  He joined Centri in July 2024 and assists insurance clients with risk advisory services, technical accounting advisory, outsourced accounting, and financial transformation services.. . View Doug Borell's Full Bio

About Centri Business Consulting, LLC

Centri Business Consulting provides the highest quality advisory consulting services to its clients by being reliable and responsive to their needs. Centri provides companies with the expertise they need to meet their reporting demands. Centri specializes in financial reportinginternal controlstechnical accounting researchvaluationmergers & acquisitions, and tax, CFO and HR advisory services for companies of various sizes and industries. From complex technical accounting transactions to monthly financial reporting, our professionals can offer any organization the specialized expertise and multilayered skillsets to ensure the project is completed timely and accurately.

Centri’s Capital Conference

The Centri Capital Conference is a one-day event held at Nasdaq on April 22, 2025. This platform will connect investors with executives from presenting companies in various emerging and rapid-growth sectors, including disruptive technologylife scienceshealthcare, and more. The conference will feature industry panels, dynamic speakers, and networking opportunities and will give growth-oriented private and public companies a place to showcase their innovations.

For more details, contact us at capitalconference@centriconsulting.com.

Philadelphia
Eight Penn Center
1628 John F Kennedy Boulevard
Suite 500
Philadelphia, PA 19103
New York City
530 Seventh Avenue
Suite 2201
New York, NY 10018
Raleigh
4509 Creedmoor Rd
Suite 206
Raleigh, NC 27612
Tampa
615 Channelside Drive
Suite 207
Tampa, FL 33602
Atlanta
1175 Peachtree St. NE
Suite 1000
Atlanta, GA 30361
Boston
50 Milk St.
18th Floor
Boston, MA 02109
Tysons Corner
1775 Tysons Blvd
Suite 4131
McLean, VA 22102
Denver
One Tabor Center
1200 17th St.
Floor 26
Denver, CO 80202
Centri Everywhere
1-855-CENTRI1
virtual@CentriConsulting.com

11/20/2024

Bridging The GAAP: November 2024

Centri’s Bridging the GAAP newsletter highlights this month’s news, developments and emerging...

Read More

11/13/2024

Key Tax Insights for Loss Corporations: Navigating Sections 382, 383, and 384

Many corporations, even if profitable from a book perspective, may generate tax...

Read More

11/13/2024

How Centri Can Help Your Foreign Listing on a U.S. Exchange

The United States continues to be the destination of choice for many...

Read More

Related Services