Shared vendors, AI, and quantum computing are among the risks covered in new guidance from the New York State Department of Financial Services. The guide was issued to financial services entities that operate under a license from the Department.
As discussed in our sister blog, the guidance clarifies best practices and gaps for conducting cybersecurity risk assessments, based on the Department’s past examinations and investigations. In our related post, we discussed governance, oversight, methodologies, scope, and documentation. Here, we delve into two related items: vendors and AI/quantum.
For vendors, the guidance looks beyond whether a provider has security measures in place. Instead, NYDFS states in the guidance that companies should weigh a variety of factors. This includes how much it relies on the vendor’s services. Other factors to assess include the type of data the vendor holds or can access, its links to the firm’s systems, and what could happen if its service stops. The guidance also looks at risks from shared vendors and systems. This includes the extent to which one failure could spread to other systems or parts of the business.
With respect to AI and quantum computing, the guidance recommends that companies assess whether these new tools or threats might change a firm’s cyber risk. For example, if AI use and advances in quantum computing might affect how encryption protects data in the future. The guidance does not set a deadline for changing encryption or name a required replacement.
Putting it Into Practice. This guidance highlights regulators’ ongoing concerns with how companies conduct risk assessments. Even if a company is not regulated by NYDFS, there are helpful ideas in the guidance that may assist in the build-out of any risk assessment process.