Financial sector data and resilience rules

SEC Regulation S-PUnited States (Federal)

Smaller entities must comply

Smaller covered institutions (24 months after Federal Register publication) must comply with the amended Regulation S-P.

NYDFS Cybersecurity Regulation (Part 500)New York

Annual compliance notification

Annual certification or acknowledgment covering calendar year 2025 due.

SEC Regulation S-PUnited States (Federal)

Larger entities must comply

Larger covered institutions (18 months after Federal Register publication) must have incident response programs, 30-day customer notification, and service-provider oversight in place.

First critical ICT third-party providers designated

The ESAs published the first list of 19 critical ICT third-party providers (including AWS, Google Cloud and Microsoft), which now come under direct EU oversight.

NYDFS Cybersecurity Regulation (Part 500)New York

Universal MFA and asset inventory

500.12 multi-factor authentication for all users and 500.13(a) asset inventory requirements apply.

DOJ Bulk Data RuleUnited States (Federal)

Due diligence, audit and reporting obligations apply

Subpart J (data compliance program, due diligence and audits for restricted transactions) and reporting requirements in 202.1103 and 202.1104 apply.

TLPT regulatory technical standards enter into force

Commission Delegated Regulation (EU) 2025/1190 (published 18 June 2025) sets criteria for which financial entities must run threat-led penetration testing, plus methodology and tester requirements.

NYDFS Cybersecurity Regulation (Part 500)New York

Vulnerability scans, access privileges, malware controls, Class A monitoring

500.5(a)(2) automated scans, 500.7 access privilege restrictions, 500.14(a)(2) malicious code protection, and 500.14(b) Class A endpoint detection and centralized logging apply.

First registers of information submitted to the ESAs

Competent authorities had to submit financial entities' registers of ICT third-party contractual arrangements (reference date 31 Mar 2025) to the ESAs by 30 Apr 2025. National authorities set earlier deadlines for entities.

DOJ Bulk Data RuleUnited States (Federal)

Prohibitions and restrictions take effect

Core prohibitions on covered data transactions and security requirements for restricted transactions apply.

DORA applies

All DORA obligations (ICT risk management, incident reporting, testing, third-party risk, register of information) apply from 17 Jan 2025 (Art 64).

SEC Cyber Disclosure RulesUnited States (Federal)

Inline XBRL tagging of Item 1.05 disclosures

Form 8-K Item 1.05 and Form 6-K incident disclosures must be tagged in Inline XBRL.

SEC Cyber Disclosure RulesUnited States (Federal)

Inline XBRL tagging of annual cybersecurity disclosures

Item 106 / Item 16K disclosures must be tagged in Inline XBRL for fiscal years ending on or after this date.

NYDFS Cybersecurity Regulation (Part 500)New York

Governance, encryption, IR/BCDR, exemptions

500.4 governance, 500.15 encryption, 500.16 incident response and business continuity plans, and 500.19(a) revised exemptions apply.

SEC Regulation S-PUnited States (Federal)

Amendments effective

The Regulation S-P amendments became effective; compliance tiered by entity size.

SEC Cyber Disclosure RulesUnited States (Federal)

Smaller reporting companies: Item 1.05 compliance

Smaller reporting companies must begin complying with Form 8-K Item 1.05 incident disclosure.

GLBA Safeguards RuleUnited States (Federal)

FTC breach notification requirement effective

Section 314.4(j) requires notice to the FTC within 30 days of discovering a notification event involving at least 500 consumers.

NYDFS Cybersecurity Regulation (Part 500)New York

General 180-day transition ends

Most new Second Amendment requirements apply, e.g. annual reporting to the board and risk assessment updates.

NYDFS Cybersecurity Regulation (Part 500)New York

Annual compliance notification

Certification of compliance or acknowledgment of non-compliance due (recurs every April 15).

SEC Cyber Disclosure RulesUnited States (Federal)

Form 8-K Item 1.05 incident disclosure begins

All registrants other than smaller reporting companies must file material incident disclosures from this date.

SEC Cyber Disclosure RulesUnited States (Federal)

Annual cybersecurity disclosures begin (Item 106 / 16K)

Required in annual reports for fiscal years ending on or after this date.

NYDFS Cybersecurity Regulation (Part 500)New York

Amended notification requirements (500.17)

New 72-hour event notice, 24-hour extortion payment notice and certification changes apply (30 days).

NYDFS Cybersecurity Regulation (Part 500)New York

Second Amendment effective

Second Amendment takes effect; 500.19(e)-(h), 500.20, 500.21, 500.22 and 500.24 apply immediately.

GLBA Safeguards RuleUnited States (Federal)

Compliance with expanded security program elements

Applicability of the 314.5 provisions (qualified individual, written risk assessment, encryption, MFA, pen testing, incident response plan, board reporting) was delayed from December 9, 2022 to this date.

DORA enters into force

Entered into force on the twentieth day after publication in OJ L 333 of 27 Dec 2022 (Art 64).

GLBA Safeguards RuleUnited States (Federal)

2021 Safeguards Rule amendments effective

The amended Safeguards Rule published December 9, 2021 took effect, with the more detailed program elements in 314.5 deferred.

NYDFS Cybersecurity Regulation (Part 500)New York

Part 500 effective

Original cybersecurity regulation takes effect.