On February 16, 2017, the New York Department of Financial Services (“DFS”) issued the final version of its cybersecurity regulation. The regulation, which has seen several iterations since it was first proposed in September 2016, is detailed, far-reaching, and—in some respects—unprecedented. New York Governor Andrew Cuomo has called the new rules a “first-in-the-nation regulation” designed to protect financial institutions and their consumers from cybercrime. For the financial institutions and insurance companies affected, the regulation’s scope and requirements will require a fresh and in-depth look at their overall cybersecurity planning, preparedness, governance, and defenses.