DFS Superintendent Adrienne A. Harris Issues New Guidance to Address Cybersecurity Risks Arising from Artificial Intelligence
Guidance, released during National Cybersecurity Awareness Month, helps entities identify cybersecurity risks associated with the use of AI and recommends controls to mitigate the risks.
Adrienne A. Harris, Superintendent of the New York State Department of Financial Services (DFS), today released new guidance to help regulated entities address and combat cybersecurity risks arising from artificial intelligence. The guidance builds on the Department’s ongoing work to protect New Yorkers and DFS-approved entities from cybersecurity risks through its industry-leading cybersecurity regulations (23 NYCRR Part 500) and follows the guidance recently adopted by the DFS to combat discrimination by insurers using artificial intelligence.
“AI has enhanced the ability of businesses to improve their threat detection and incident response strategies, while creating new opportunities for cybercriminals to commit crimes at a larger scale and faster. » said Superintendent Harris. “New York will continue to ensure that as AI-based tools become more prolific, security standards remain rigorous to protect critical data, while allowing the flexibility to meet various risk profiles in a constantly evolving digital landscape.
Institutions regulated by DFS must assess and take appropriate actions to address their cybersecurity risks, including evolving risks arising from AI. In line with the Department’s cybersecurity regulations, this guidance takes a risk-based approach to help the financial services sector better understand, assess and mitigate AI-specific cybersecurity risks, including social engineering, heightened cyberattacks, theft of non-public information, and increased vulnerabilities due to supply chain dependencies.
It is important to note that the cybersecurity measures described in the guidance and required by the cybersecurity regulations provide multiple layers of security controls with overlapping protections. This ensures that if one control fails, other controls are in place to prevent or mitigate the impact of a cybersecurity attack.
This guidance does not impose new requirements, but helps DFS-regulated institutions meet their existing obligations under the Department’s cybersecurity regulations in light of evolving AI risks.
A copy of the guidelines can be found on the Department website. Additional cybersecurity resources can be found on the Department’s website. Cybersecurity Resource Center.
###
