New York's Latest Cybersecurity Commitment

As students of the privacy and cybersecurity space will note, New York has long been at the forefront of privacy and cybersecurity at the state level. For instance, seven years ago, the state's Department of Financial Services enacted the Cybersecurity Requirements for Financial Services Companies, which became effective the following year. Among other things, those regulations required financial service firms to evaluate their risk profiles, establish programs to mitigate those risks, and to make cybersecurity a "board room level" priority.  Now, just about on the anniversary of that announcement, on Aug. 9, 2023, Governor Kathy Hochul introduced New York's inaugural comprehensive cybersecurity strategy. In sum, the plan aims to update government networks, bolster county-level digital defenses, and regulate critical infrastructure.

The Problem

The cybersecurity landscape in New York is marked by fragmented defenses and outdated infrastructures, which are ill-equipped to defend against increasingly sophisticated cyber threats. Importantly, the lack of a centralized cybersecurity protocol allows threat actors to exploit vulnerabilities with relative ease. The threat landscape includes data breaches, ransom demands, and the disruption of essential services. New York's systemic vulnerabilities — at the state, local, and private level — not only expose sensitive information, but also impose financial and operational burdens that are borne by New Yorkers. The need for a comprehensive, state-level cybersecurity strategy could not be more pressing.