Extract to table

However, the cybersecurity regulatory implications of creating, storing, processing, and potentially distributing Derived Data must also be considered under 23 NYCRR 500, as discussed in detail in Sections IV

The cybersecurity program must address both the internal risks (e

In particular, data governance and classification policies must address the classification of Meridian data products and Derived Data; access controls and identity management policies must govern who within Quorum may access the licensed data; vendor and Third-Party Service Provider management policies must address Meridian's status as a Third-Party Service Provider; and incident response policies must address cybersecurity events affecting the Meridian data environment

Quorum must have a designated CISO whose responsibilities encompass oversight of the Meridian data environment

The Information Systems that store, process, or transmit Meridian data — including ingestion pipelines, data warehouses, analytical platforms, and the systems hosting the REST API integration for real-time MCI Consumer Credit File™ queries — must be within the scope of Quorum's annual penetration testing and bi-annual vulnerability assessment programs

06 requires each Covered Entity to implement audit trail systems that serve two distinct purposes: (a) Track and maintain data that allows for the complete and accurate reconstruction of all financial transactions and accounting sufficient to detect and respond to a Cybersecurity Event; these records must be maintained for not less than five years; and (b) Include audit trails designed to detect and respond to Cybersecurity Events that have a reasonable likelihood of materially harming any material part of the normal operations of the Covered Entity; these records must be maintained for not less than three years