Get ready: regulators are looking hard at cybersecurity of third-party vendors

The guidelines also call for every financial company to designate a chief information security officer who would be required to submit annual reports to the NYDFS, and for companies to conduct annual penetration testing and quarterly vulnerability assessments.