Our bank is a 600 million dollar bank with headquarters in Washington, DC and has branch offices in Washington, DC, Northern New Jersey, and New York. Since we have a presence in New York would it be required that the bank have a Chief Information Security officer (CISO) and also a Cyber Security Certification on file? I know that the CISO and the Cyber Certifications are requirements for New York State.

Thank you.

I believe that Part 500 does apply in this situation. You can of course confirm this with legal counsel.

It would depend on your authorization and if your institution has met the exemptions. At $600m I would doubt that the exemptions would be met, I would suggest contacting your legal area.

(c) Covered Entity means any Person operating under or required to operate under a license, registration,
charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or
the Financial Services Law.

for exemptions:
CLICK HERE