Third-Party Risk Management SOP - New York

THIRD-PARTY RISK MANAGEMENT SOP — NEW YORK SUPPLEMENT

Organization: [________________________________]
SOP Number: TPRM-NY-[____]
Version: [____]
Effective Date: [__/__/____]
Approved By: [________________________________]

TABLE OF CONTENTS

1. Purpose and Scope
2. New York Regulatory Framework
3. Definitions
4. Risk Tiering — New York Enhancements
5. Third-Party Lifecycle — New York Requirements
6. NYDFS 23 NYCRR Part 500 Third-Party Service Provider Requirements
7. Roles and Responsibilities
8. Documentation and Systems of Record
9. Metrics, KRIs, and Reporting
10. Exceptions and Compensating Controls
11. Review Cadence
12. Annexes

1. PURPOSE AND SCOPE

1.1 Purpose

This SOP supplements the Universal TPRM SOP with New York-specific requirements under the NY SHIELD Act (N.Y. Gen. Bus. Law § 899-aa, § 899-bb) and the NYDFS Cybersecurity Regulation (23 NYCRR Part 500). The SHIELD Act requires reasonable safeguards for private information of New York residents. For NYDFS-regulated entities, 23 NYCRR § 500.11 mandates a written third-party service provider security policy, and the November 2023 amendments strengthened requirements for MFA, governance, and incident notification.

1.2 Scope

Applies to all third-party relationships involving:
☐ Private information of New York residents (SHIELD Act)
☐ Nonpublic information of NYDFS-covered entities (23 NYCRR Part 500)
☐ Services delivered to New York-based operations
☐ Vendors subject to New York regulatory oversight (NYDFS, NY AG, NYSE, etc.)

2. NEW YORK REGULATORY FRAMEWORK

3. DEFINITIONS

4. RISK TIERING — NEW YORK ENHANCEMENTS

Vendors processing SHIELD Act private information or NYDFS nonpublic information shall be classified no lower than Medium tier. Vendors with access to NYDFS-covered entity information systems shall be classified no lower than High tier.

5. THIRD-PARTY LIFECYCLE — NEW YORK REQUIREMENTS

5.1 Due Diligence Enhancements

5.2 Contract Requirements — New York Additions

5.3 Ongoing Monitoring — New York Additions

5.4 Offboarding — New York Additions

☐ Confirm deletion of all NY private information and nonpublic information
☐ Obtain written certification of destruction per § 500.13
☐ Verify subprocessors have deleted NY data
☐ Revoke all system access; confirm MFA credentials deactivated
☐ Close audit trail records

6. NYDFS 23 NYCRR PART 500 — THIRD-PARTY SERVICE PROVIDER REQUIREMENTS

6.1 Written Policy (§ 500.11)

NYDFS-covered entities must maintain a written third-party service provider security policy addressing:

☐ Identification and risk assessment of third-party service providers
☐ Minimum cybersecurity practices required of third-party service providers
☐ Due diligence processes used to evaluate third-party service providers
☐ Periodic assessment of third-party service providers based on risk and continued adequacy

6.2 Minimum Cybersecurity Practices (§ 500.11)

The November 2023 amendments require covered entities to include in their third-party policy:

6.3 Due Diligence Evaluation Factors

Per § 500.11, due diligence must evaluate the adequacy of the third party's cybersecurity practices, considering:

☐ The sensitivity and volume of nonpublic information accessible
☐ The third party's cybersecurity policies and procedures
☐ The third party's cybersecurity risk assessments
☐ The third party's ability to protect nonpublic information
☐ Results of audits, certifications, and assessments
☐ The third party's cybersecurity governance and CISO designation

7. ROLES AND RESPONSIBILITIES

8. DOCUMENTATION AND SYSTEMS OF RECORD

Additional TPRM platform fields for NY:

☐ SHIELD Act private information elements processed
☐ NYDFS applicability determination
☐ § 500.11 compliance assessment status
☐ MFA verification status (§ 500.12)
☐ Encryption verification status (§ 500.15)
☐ Annual certification support documentation (§ 500.17(b))

9. METRICS, KRIs, AND REPORTING

Report to [Board/Committee] quarterly, with NYDFS-specific section.

10. EXCEPTIONS AND COMPENSATING CONTROLS

☐ Exceptions to NYDFS requirements must be approved by [CISO / CCO] and documented with reference to specific 23 NYCRR section
☐ SHIELD Act exceptions must include documented compensating controls
☐ Maximum exception duration: [____] days

11. REVIEW CADENCE

12. ANNEXES

Annex A: NYDFS § 500.11 Compliance Checklist

☐ Written third-party service provider security policy adopted
☐ Risk assessment of all third-party service providers completed
☐ Minimum cybersecurity practices defined and communicated
☐ Due diligence process documented
☐ Periodic reassessment schedule established
☐ MFA requirement for third-party access implemented
☐ Encryption requirements communicated and verified
☐ 72-hour notification clause in all applicable contracts
☐ Annual certification support process documented

Annex B: SHIELD Act Safeguards Verification Checklist

☐ Administrative: designated coordinator, risk assessments, training, service provider management
☐ Technical: risk assessment of network/software, threat identification, safeguard testing
☐ Physical: physical storage risk assessment, intrusion detection, access management, disposal

SOURCES AND REFERENCES

• NY SHIELD Act, N.Y. Gen. Bus. Law § 899-aa, § 899-bb (eff. Mar. 21, 2020)
• NYDFS Cybersecurity Regulation, 23 NYCRR Part 500 (2017; amended Nov. 1, 2023)
• 23 NYCRR § 500.11 (Third-Party Service Provider Security Policy)
• 23 NYCRR § 500.12 (MFA, as amended)
• 23 NYCRR § 500.17 (Notices to Superintendent)
• OCC Bulletin 2023-17
• DOJ Evaluation of Corporate Compliance Programs (2023)

This template is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel before use.