Section 500.01
Definitions.
For purposes of this Part only, the following definitions shall apply:
(a) Affiliate means any Person that controls, is controlled by or is under common control with another Person. For purposes of this subsection, control means the possession, direct or indirect, of the power to direct or cause the direction of the management and policies of a Person, whether through the ownership of stock of such Person or otherwise. 1
(b) Authorized User means any employee, contractor, agent or other Person that participates in the business operations of a Covered Entity and is authorized to access and use any Information Systems and data of the Covered Entity.
(c) Covered Entity means any Person operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law.
(d) Cybersecurity Event means any act or attempt, successful or unsuccessful, to gain unauthorized access to, disrupt or misuse an Information System or information stored on such Information System.
(e) Information System means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination or disposition of electronic information, as well as any specialized system such as industrial/process controls systems, telephone switching and private branch exchange systems, and environmental control systems.
(f) Multi-Factor Authentication means authentication through verification of at least two of the following types of authentication factors:
(1) Knowledge factors, such as a password; or
(2) Possession factors, such as a token or text message on a mobile phone; or
(3) Inherence factors, such as a biometric characteristic.
(g) Nonpublic Information shall mean all electronic information that is not Publicly Available Information and is:
(1) Business related information of a Covered Entity the tampering with which, or unauthorized disclosure, access or use of which, would cause a material adverse impact to the business, operations or security of the covered Entity;
(2) Any information concerning an individual which because of name, number, personal mark, or other identifier can be used to identify such individual, in combination with any one or more of the following data elements:
(i) social security number,
(ii) drivers’ license number or non-driver identification card number,
(iii) account number, credit or debit card number,
(iv) any security code, access code or password that would permit access to an individual’s financial account, or
(v) biometric records;
(3) Any information or data, except age or gender, in any form or medium created by or derived from a health care provider or an individual and that relates to (i) the past, present or future physical, mental or behavioral health or condition of any individual or a member of the individual's family, (ii) the provision of health care to any individual, or (iii) payment for the provision of health care to any individual.
(h) Penetration Testing means a test methodology in which assessors attempt to circumvent or defeat the security features of an Information System by attempting penetration of databases or controls from outside or inside the Covered Entity’s Information Systems.
(i) Person means any individual or any non-governmental entity, including but not limited to any nongovernmental partnership, corporation, branch, agency or association.
(j) Publicly Available Information means any information that a Covered Entity has a reasonable basis to believe is lawfully made available to the general public from: federal, state or local government records; widely distributed media; or disclosures to the general public that are required to be made by federal, state or local law.
(1) For the purposes of this subsection, a Covered Entity has a reasonable basis to believe that information is lawfully made available to the general public if the Covered Entity has taken steps to determine:
(i) That the information is of the type that is available to the general public; and
(ii) Whether an individual can direct that the information not be made available to the general public and, if so, that such individual has not done so.
(k) Risk Assessment means the risk assessment that each Covered Entity is required to conduct under section 500.09 of this Part.
(l) Risk-Based Authentication means any risk-based system of authentication that detects anomalies or changes in the normal use patterns of a Person and requires additional verification of the Person’s identity when such deviations or changes are detected, such as through the use of challenge questions.
(m) Senior Officer(s) means the senior individual or individuals (acting collectively or as a committee) responsible for the management, operations, security, information systems, compliance and/or risk of a Covered Entity, including a branch or agency of a foreign banking organization subject to this Part.
(n) Third Party Service Provider(s) means a Person that
(i) is not an Affiliate of the Covered Entity,
(ii) provides services to the Covered Entity, and
(iii) maintains, processes or otherwise is permitted access to Nonpublic Information through its provision of services to the Covered Entity.
