N.Y. Comp. Codes R. & Regs. tit. 11, § 421.3 – Objectives of information security program.

(a) ensure the security and confidentiality of customer information;
(b) protect against any anticipated threats or hazards to the security or integrity of such information; and
(c) protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.

A licensee's information security program shall be designed to: