NY DFS Clarifies Criteria for Small Business Exemptions

Covered entities are exempt from certain cybersecurity requirements when they and all of their affiliates have a combined total of fewer than 10 employees (including independent contractors) who are located in New York or are responsible for business of the covered entity; when filing a Notice of Exemption for a limited exemption, maintain supporting data and documentation for 5 years and make the information available to the DFS upon request.