Specifically, it provides for: (i) controls relating to the governance framework for a cybersecurity program; (ii) risk-based minimum standards for technology systems for data protection; (iii) minimum standards for cyber breach responses, including notice to the NYDFS of material events; and (iv) identification and documentation of material deficiencies, remediation plans and annual certifications of regulatory compliance to the NYDFS.