Cyber(in)security: New York Levies Fine for Failure to Implement Written Policies

On November 27, 2023, the New York State Department of Financial Services (“DFS”) and First American Title Insurance Company (“First American”) entered into a consent order¹ that resolved litigation over First American’s cybersecurity practices. Though the associated fine ($1 million) was relatively small, the order serves as a reminder to all organizations that simply having cybersecurity policies and procedures in place is insufficient when they are not in fact implemented.