New York cracks down on third-party cybersecurity risks
New York’s top financial regulator has issued new guidance on managing cybersecurity risks tied to third-party service providers, warning that regulated firms remain ultimately responsible for safeguarding consumers and sensitive data.
The advisory from the New York State Department of Financial Services (DFS) follows a sharp rise in cyberattacks targeting supply-chain partners and technology vendors.
Regulators say the guidance is not designed to create new obligations but to clarify existing requirements under DFS’s cybersecurity rule and to highlight best practices that financial institutions should adopt.
“While third-party service providers have driven innovation and enabled significant efficiencies in our financial system, regulated entities are still ultimately accountable for protecting consumers and managing risk,” said Kaitlin Asrow, acting superintendent of the NYDFS, in a statement.
“To ensure the safe and secure operation of financial services and the protection of non-public information, entities must establish and maintain appropriate internal risk management controls when using third-party service providers,” she added
The move comes as the frequency and severity of vendor-related breaches continue to rise.
According to cybersecurity experts, attacks on major corporations’ third-party suppliers doubled in 2024 and are expected to worsen through 2025.
Criminals increasingly target supply-chain ecosystems, where a single compromised vendor can provide access to dozens of organizations.
Tim Erridge, vice president for Europe, the Middle East and Africa at Unit 42 at Palo Alto Networks, told the Financial Times that attackers are exploiting the weakest links in corporate defenses.
“If you breach a supplier and it’s got access into many, many top-end organizations that are consuming their services or connected into them, you’re getting a many-for-one return on investment,” he said.
That risk equation is simple, experts say: more third-party integrations and more human error translate into greater breach opportunity. Data from law firm Blank Rome shows how the legal consequences are accelerating.
“In 2021, there were 400 data breach lawsuits filed,” said Philip Yannella, co-chair of the firm’s privacy, security, and data protection practice. “Last year, there were over 2,000.”
The DFS’s intervention reflects a broader regulatory trend in the United States and globally.
Supervisors are urging financial institutions to build stronger oversight of vendors that provide cloud computing, software, and payment infrastructure.
The guidance reinforces the message that outsourcing a service does not transfer the responsibility for risk.
Meanwhile, DFS leadership is in transition. Adrienne Harris, the outgoing superintendent, recently told PYMNTS CEO Karen Webster that Asrow had played a central role in shaping the agency’s approach to digital finance over the past four years.
She said that leadership continuity is crucial as the regulator navigates a rapidly evolving “Internet of money” landscape.
Harris added that the rise of stablecoins and digital assets could reshape corporate treasury operations.
“Thinking about how we might make especially wholesale payments and treasury functions more efficient for businesses could really be a game changer,” she said.