Cybersecurity Policy Report, New York Financial Firms Accountable for Third-Party Cyber Risks, State Agency Advises, (Oct 21, 2025)
The New York Department of Financial Services (DFS) today warned entities it regulates that they remain responsible for cybersecurity incidents at their third-party service providers (TPSPs).
“Covered Entities may not delegate responsibility for compliance with the [DFS] Cybersecurity Regulation to an affiliate or a TPSP,” according to guidance released by the department.
“DFS has identified areas where Covered Entities should strengthen their TPSP programs, including how they monitor, assess, and manage TPSP cybersecurity risk. Specifically, DFS has identified the need for more robust due diligence, contractual provisions, monitoring and oversight, and TPSP risk management policies and procedures,” the guidance says.
“Moreover, DFS has observed a trend in which some Covered Entities outsource critical cybersecurity compliance obligations to TPSPs without ensuring appropriate oversight,” it adds.
“Covered Entities’ exposure to threats will continue to grow as their reliance on technologies managed by TPSPs—such as cloud computing, file transfer systems, artificial intelligence (‘AI’), and fintech solutions—increases. The growing scale and complexity of cyber risks posed by TPSPs demands a proactive, risk-based, and continuously adaptive approach to third-party governance,” it notes.
“While third-party service providers have driven innovation and enabled significant efficiencies in our financial system, regulated entities are still ultimately accountable for protecting consumers and managing risk,” Kaitlin Asrow, the acting DFS superintendent, said in a news release. “To ensure the safe and secure operation of financial services and the protection of nonpublic information, entities must establish and maintain appropriate internal risk management controls when using third-party service providers.”
News: StateLegislation DataSecurity