N.Y. Comp. Codes R. & Regs. tit. 11, § 421.10
Each licensee shall establish policies and systems and implement an information security program pursuant to this Part by June 1, 2002.