In the News: Lauren Godfrey and Sydney Hardy Break Down New NYDFS MFA Rules and Compliance Challenges in Cyber Defense Magazine

Constangy cybersecurity and data privacy attorneys Lauren Godfrey and Sydney A. Hardy authored an article for Cyber Defense Magazine examining the New York State Department of Financial Services' (NYDFS) enhanced multi-factor authentication (MFA) requirements under Section 500.12 of the Amended Cybersecurity Regulation. The covered entities required to abide by the enhanced MFA requirements include businesses or other entities licensed or authorized to operate under banking, insurance or financial services law.

Godfrey and Hardy explained that MFA requires at least two distinct verification factors, such as a PIN paired with a mobile authenticator or a physical key paired with a fingerprint, and caution that auto-fill features and software-stored certificates do not qualify as valid possession factors. The article also addresses compliance challenges around push-based MFA fatigue, single sign-on (SSO) systems, cloud-based email and document hosting platforms and external-facing systems. Notably, SSO alone does not satisfy MFA requirements and cloud platforms that store or transmit nonpublic information must incorporate MFA or a written, annually reviewed CISO-approved equivalent control. 

"MFA can significantly reduce, although not eliminate, the risk of access to a network from an unauthorized actor," said Godfrey and Hardy. "Entities covered by New York's enhanced MFA requirements should review the new FAQs in their entirety and ensure that their systems are compliant." 

To view the full article, subscribers may click here.