The 72-Hour Clock at a New York-Licensed Mortgage Servicer
You are CISO of a New York-licensed mortgage servicer with $4.2 billion in servicing volume and 310 employees; it is a subsidiary of a Nasdaq-listed parent. On Friday 11 April at 15:40 the SOC spots SMB lateral movement; by 18:00 ransomware has encrypted 30 of 400 servers, including the escrow disbursement system. The forensic firm confirms on Saturday 12 April at 11:00 that an unauthorized third party entered the network on 2 April and exfiltrated 61,000 borrower files. The firm cannot yet say whether the exfiltrated files included Social Security numbers. On Sunday the attacker posts samples on a leak site. The parent's 10-Q is due 5 May, and its securities counsel asks whether the incident is material. The CEO asks: 'When does the clock start, who do we tell, and what do I sign?'
1. Map the notification obligations to the New York Department of Financial Services: when does the clock start, what must be filed, and what happens if a ransom is paid?
Read the worked answer
Rule. 23 NYCRR 500.17(a) requires a covered entity to notify the Superintendent within 72 hours after determining that a 'cybersecurity incident' occurred. The regulated definition covers an act or attempt to gain unauthorized access that either has a reasonable likelihood of materially harming normal operations or material parts of the information systems, or results in unauthorized access to nonpublic information. The 72 hours runs from the determination, not from the first alert. Section 500.17(c), added by the 2023 amendments, requires notice within 30 days after a ransom payment.
Application. The Saturday 11:00 confirmation - unauthorized access plus exfiltration of 61,000 borrower files that likely include SSNs - is reportable on either branch of the definition. The deadline is 11:00 three days after confirmation. But the Friday encryption of the escrow disbursement system, which plainly had a reasonable likelihood of materially harming normal operations, could be argued to have started the clock on Friday at 15:40. The defensible course is to file by the earlier time and supplement as facts develop; the rule permits updating a notification.
Content. Describe the incident, the date of determination, the categories and approximate number of affected persons, the systems affected and the containment steps. Do not wait for a final number. If a ransom is paid, calendar the 30-day notice immediately. Third-party service providers must notify you, but the filing duty remains yours.
2. The parent is a public reporting company. Explain the securities disclosure analysis and the timing, and identify the traps.
Read the worked answer
Rule. Under Item 1.05 of Regulation S-K (adopted 2023), a registrant must file a Form 8-K within four business days after it determines that a cybersecurity incident is material. The materiality determination must itself be made without unreasonable delay. A subsidiary's incident can be material to the parent. The only built-in delay is a written finding by the Attorney General that disclosure would pose a substantial risk to national security or public safety.
Application. The parent must begin and document a materiality analysis now, on both axes: quantitative (revenue and servicing disruption, escrow remediation cost, forensic and legal fees, fines, customer attrition) and qualitative (reputational harm, loss of hospital or GSE counterparties, regulatory scrutiny). The determination date must be recorded, because the four-business-day clock runs from that date. 'We were still investigating' is not a lawful basis for postponing the determination - that reasoning is exactly what the rule was designed to prevent.
Traps. (1) The SEC's cybersecurity disclosure rules have been under active review and proposed amendment in 2025, so verify the current text before filing. (2) Any press release, customer letter or regulator filing must be consistent with the 8-K; inconsistencies are the usual source of follow-on claims. (3) The 10-Q due 5 May must address known trends and the incident's known or reasonably likely impact. (4) Do not let the NYDFS filing drive the securities analysis - they are separate tests with separate clocks.
3. It is April and the entity must file its annual certification under 23 NYCRR 500.17(b). Can the CEO and CISO sign a clean certification? What should they do instead?
Read the worked answer
Rule. Section 500.17(b) requires an annual certification of material compliance with Part 500, signed by the highest-ranking executive and, where the entity has one, the CISO. The certification must be based on data and documentation, and the regulation requires the entity to identify all areas of noncompliance and describe remediation plans and timelines in the certification or an accompanying schedule. A knowing false certification exposes the signers personally, not just the company.
Application. Signing a clean, unqualified certification weeks after a material intrusion that reached the escrow system, and before root-cause analysis is complete, is a bad bet. The likely failures are concrete and identifiable: incomplete asset inventory, MFA gaps that permitted SMB lateral movement, monitoring coverage, and incident-response testing.
What to do. (1) Complete a documented control assessment before signing. (2) Disclose the specific failed requirements and the remediation owner and date for each. (3) Base the certification on evidence - screenshots, logs, vendor attestations - and retain it. (4) Brief the board, which has oversight responsibility for the program, before filing. (5) Do not move the filing date to suit the incident timeline; the deadline is fixed and a late or omitted certification is its own violation. The incident does not require a refusal to certify; it requires an honest, specific one.