Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

Minneapolis

New York

Washington, D.C.

<a>The New York Department of Financial Services (“DFS”) published a </a><a href="https://www.dfs.ny.gov/system/files/documents/2022/10/rp23a2_text_20221109_0.pdf">proposed Second Amendment</a> (“Second Amendment”) to Regulation 500 (23 NYCRR 500) on November 9, 2022. The Second Amendment is a proverbial shot across the bow as it directly affects cyber liability for covered entities (financial service entities) regulated by the DFS in the state of New York, including banks, insurers and similar entities. It also significantly impacts liability exposures of the members of boards of directors, “senior officers” (C-suite officers), chief information security officers (“CISO”) and possibly some affiliates of covered entities. The Second Amendment was published on November 9th and has a 60-day comment period before it becomes effective. It appears to be on track for adoption with only minor changes.

contentpilot/introduction

<a>The Second Amendment raises the compliance bar but also raises questions, including how the proposed new liability provisions will dovetail with the recent protections for C-suite executives (e.g., CEOs and CFOs) implemented under </a><a href="https://delcode.delaware.gov/title8/c001/index.html#P-1_0" target="_blank" rel="noreferrer noopener">Delaware’s General Corporations Law</a> (“DGCL”) that, generally, allow companies to extend limitations for monetary liability and damages for breaches of the generally applied duty of care.

core/paragraph

core/heading

In July and then again in October 2022, the DFS signaled that it would be expanding officers’ and directors’ exposures for covered entities, at least for cyber-risk responsibilities and corresponding liabilities under <a href="https://www.dfs.ny.gov/system/files/documents/2019/02/dfsrf500txt.pdf">New York Regulation No. 500</a>. Those exposures also directly and significantly impact covered entities. In November 2022, the DFS’s proposal was formally included in the Second Amendment. In the regulators’ view, the Second Amendment largely conforms to the SEC’s disclosure requirements under Items 1.05 of Form 8k and 106 (new) and 4.07(j) to Regulation S-K and additional disclosures under Forms 10-Q and 10-K (including 1(c) Cybersecurity to Form 10-K). For a more complete review of these SEC changes, see Thompson Hine’s Legal Update, <a href="https://www.thompsonhine.com/insights/sec-issues-proposed-rules-on-mandatory-cybersecurity-disclosure/">SEC Issues Proposed Rules on Mandatory Cybersecurity Disclosure</a>, dated March 10, 2022.

The most significant proposed changes under the Second Amendment include:

core/list

The Second Amendment imposes a heightened level of these obligations on Class A companies only. It also allows limited exemptions for companies that do not qualify as Class A companies, although the exemptions often apply to filings and not to compliance or incident reporting or cyber protection standards. There is a transition period (ranging from 30 days for some sections to 19 months for others) to allow companies to implement the requirements.

Since the mid-80s, the DGCL permitted companies to include charter provisions that limited the personal liability for monetary and certain other damages of the members of the board of directors arising from a director’s failure to make an informed decision, resulting in a breach of the duty of care. That liability protection, together with the business judgement rule, in effect, helped directors perform their legal and fiduciary duties without fear of being liable for monetary damages due to a mistake. In August 2022, by statute, those DGCL protections were extended to C-suite officers, (provided, the statutory shield does not extend to claims brought by shareholders on behalf of the corporation against the officers). Overall, assuming the company adopts the DGCL charter provisions, officers and directors will be protected from liabilities arising from allegations of the duty of care, in many instances, including when the director exercises its business judgement, even if there are adverse results for the company. The Delaware standard appears to conflict with the Second Amendment, the latter of which seemingly imposes liability for cyber incident breach on the directors and officers under a lower standard.

Given the aggressive recent nature of the DFS, this is a clear warning to companies, boards, CISOs and senior executives doing business in or, in some instances, affiliated with covered entities doing business in NYS. Covered entities, particularly larger Class A companies, need to take preparation steps or face the DFS’s fines, penalties and other sanctions. (See recent fines and sanctions imposed by the DFS under the <a href="https://www.dfs.ny.gov/reports_and_publications/press_releases/pr202210181" target="_blank" rel="noreferrer noopener">EyeMed matter</a>). Companies of all sizes need to prepare now to avoid problems later. Those steps include:

Although, <em>arguendo</em>, C-suite officers of covered entities may be afforded protections under the DGCL, it is unlikely the DFS will recognize the Delaware statutory and charter protections and allow C-suite officers to wall off cyber related liability exposures under the Second Amendment.

<em>This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.</em>

https://admin.thompsonhine.com/wp-content/uploads/2022/11/NY-DFS-Shakes-up-Board-and-Management-Exposures-for-Cyber-Breaches.pdf

NY DFS Shakes up Board and Management Exposures for Cyber Breaches

Services