Compliance Program Charter - New York

COMPLIANCE PROGRAM CHARTER — NEW YORK SUPPLEMENT

Company: [________________________________]
Effective Date: [__/__/____]
Approved by: [________________________________]
Version: [____]

TABLE OF CONTENTS

1. Purpose and Authorization
2. New York Regulatory Landscape
3. Scope — New York Compliance Domains
4. Governance Enhancements
5. Core Program Elements — New York Focus
6. NYDFS Compliance (If Applicable)
7. New York Regulatory Change Management
8. New York-Specific Reporting and Metrics
9. Resources
10. Review and Approval
11. Annexes

1. PURPOSE AND AUTHORIZATION

This supplement addresses New York-specific requirements including the SHIELD Act, NYDFS Cybersecurity Regulation (23 NYCRR Part 500), NY consumer protection statutes (GBL §§ 349-350), the NY State Human Rights Law (NYSHRL), and NY whistleblower protections (Labor Law § 740, as amended Jan. 26, 2022, to cover all private-sector employees).

2. NEW YORK REGULATORY LANDSCAPE

3. SCOPE — NEW YORK COMPLIANCE DOMAINS

3.1 Data Security and Privacy

☐ SHIELD Act: reasonable administrative, technical, and physical safeguards for NY private information
☐ Breach notification: AG, DOS, State Police notification for breaches affecting NY residents
☐ NYDFS Part 500 (if covered entity): cybersecurity program, CISO, risk assessment, MFA, encryption, penetration testing, incident notification (72 hours to Superintendent), annual certification

3.2 Consumer Protection

☐ GBL § 349: subsection (a) unfair/deceptive/abusive prohibition and Attorney General route distinguished from subsection (h)'s private deceptive-act-or-practice action
☐ GBL § 350: prohibition of false advertising
☐ Review marketing, advertising, pricing, and disclosures for compliance

3.3 Employment

☐ NYSHRL (Exec. Law § 296): discrimination, harassment, retaliation protections (all employers with 4+ employees; individual liability for supervisors)
☐ NYC Human Rights Law (if NYC operations): among broadest employment protections in the nation
☐ Mandatory sexual harassment prevention training (annual for all employees per Labor Law § 201-g)
☐ Pay transparency (Lab. Law § 194-b): salary range disclosure in job postings (employers with 4+ employees)
☐ Whistleblower protections (Labor Law § 740): expanded protections effective Jan. 26, 2022

3.4 Financial Services (If NYDFS-Covered)

☐ 23 NYCRR Part 500 cybersecurity program
☐ Annual certification to Superintendent (§ 500.17(b))
☐ Third-party service provider security policy (§ 500.11)
☐ CISO designation and Board reporting (§ 500.4)
☐ Reportable cybersecurity incident notice as promptly as possible, no later than 72 hours after determination (§ 500.17(a))

4. GOVERNANCE ENHANCEMENTS

5. CORE PROGRAM ELEMENTS — NEW YORK FOCUS

5.1 Risk Assessment — NY Additions

5.2 Policies — NY-Specific

☐ NY breach notification procedures (AG, DOS, State Police)
☐ SHIELD Act data security policy
☐ NYDFS cybersecurity policy (if applicable, per § 500.3)
☐ Sexual harassment prevention policy (compliant with Labor Law § 201-g model)
☐ Whistleblower policy (Labor Law § 740 compliant)
☐ Pay transparency policy (Lab. Law § 194-b)
☐ GBL §§ 349-350 marketing review procedures

5.3 Training — NY-Specific

5.4 Monitoring and Testing — NY Additions

☐ SHIELD Act safeguards verification (administrative, technical, physical)
☐ NYDFS penetration testing (annual) and vulnerability assessment (bi-annual) (if applicable)
☐ Breach notification tabletop exercise
☐ Harassment complaint tracking and trend analysis
☐ GBL §§ 349-350 marketing/advertising audit
☐ Pay transparency audit (job posting compliance)
☐ NYDFS annual certification preparation (if applicable)

5.5 Third-Party Risk — NY Additions

☐ SHIELD Act vendor safeguards verification
☐ NYDFS § 500.11 third-party service provider policy compliance (if applicable)
☐ MFA verification for vendor access to information systems (§ 500.12)
☐ Vendor breach notification SLA alignment with NY requirements

6. NYDFS COMPLIANCE (IF APPLICABLE)

For organizations subject to 23 NYCRR Part 500 (as amended November 1, 2023):

6.1 Program Requirements

☐ Written cybersecurity policy (§ 500.3)
☐ CISO designated with Board reporting (§ 500.4(b))
☐ Annual penetration testing; risk-assessment-based vulnerability scans, including promptly after material system changes (§ 500.5(a))
☐ Audit trail systems (§ 500.6) — 5 years financial transactions, 3 years otherwise
☐ Access privileges and management (§ 500.7)
☐ Application security (§ 500.8)
☐ Risk assessment (§ 500.9) — annual, documented
☐ Cybersecurity personnel and intelligence (§ 500.10)
☐ Third-party service provider security policy (§ 500.11)
☐ Multi-factor authentication (§ 500.12) — expanded by Nov. 2023 amendments
☐ Data retention limitations (§ 500.13)
☐ Training and monitoring (§ 500.14)
☐ Encryption (§ 500.15)
☐ Incident response plan (§ 500.16)
☐ Reportable cybersecurity incident notice to Superintendent as promptly as possible, no later than 72 hours after determination (§ 500.17(a))
☐ Annual certification (§ 500.17(b))

6.2 Enhanced Requirements (Nov. 2023 Amendments)

☐ CISO must report to Board or senior governing body at least annually (§ 500.4(b))
☐ Board must have sufficient understanding of cybersecurity to exercise oversight (§ 500.4(d))
☐ Business continuity and disaster recovery plan required (§ 500.16)
☐ Governance framework: written policies approved by senior officer (§ 500.3)
☐ Asset management and inventory requirements (§ 500.13)
☐ Enhanced access controls including privileged access management (§ 500.7)

7. NEW YORK REGULATORY CHANGE MANAGEMENT

8. NEW YORK-SPECIFIC REPORTING AND METRICS

9. RESOURCES

☐ CISO/cybersecurity team (NYDFS compliance, if applicable)
☐ Privacy/data security for SHIELD Act
☐ Employment counsel for NYSHRL/NYC HRL
☐ External NY regulatory counsel

10. REVIEW AND APPROVAL

Review annually or upon material NY regulatory change (including NYDFS amendments).

11. ANNEXES

Annex A: NY Breach Notification Checklist

☐ Breach determination (date: [__/__/____])
☐ Affected NY residents identified
☐ NY AG notified (N.Y. Gen. Bus. Law § 899-aa(8)(a))
☐ NY DOS Division of Consumer Protection notified (§ 899-aa(8)(a))
☐ NY State Police notified (§ 899-aa(8)(a))
☐ Individual notice sent "in the most expedient time possible and without unreasonable delay"
☐ If NYDFS-covered: Superintendent notified as promptly as possible, no later than 72 hours after determining a reportable cybersecurity incident occurred (§ 500.17(a))

Annex B: NYDFS Annual Certification Preparation Checklist

☐ Cybersecurity program reviewed and updated
☐ Risk assessment completed
☐ Penetration test and vulnerability assessments current
☐ Third-party service provider assessments current
☐ CISO Board report delivered
☐ Incident response plan tested
☐ Training completed
☐ Certification of material compliance or acknowledgment of noncompliance filed by April 15 and signed by the highest-ranking executive and CISO (or responsible senior officer)

SOURCES AND REFERENCES

• NY SHIELD Act, N.Y. Gen. Bus. Law § 899-aa, § 899-bb
• NYDFS Cybersecurity Regulation, 23 NYCRR Part 500 (2017; amended Nov. 1, 2023)
• N.Y. Gen. Bus. Law §§ 349, 350
• NYSHRL, N.Y. Exec. Law § 290 et seq.
• NY Labor Law § 740 (Whistleblower, as amended Jan. 26, 2022)
• NY Labor Law § 194-b (Pay Transparency)
• NY Labor Law § 201-g (Sexual Harassment Prevention)
• DOJ Evaluation of Corporate Compliance Programs (Updated September 2024)
• U.S. Sentencing Guidelines § 8B2.1

This template is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel before use.