N.Y. Comp. Codes R. & Regs. tit. 15, § 10.7 – Monitoring internet pre-licensing courses.

(a) Department sponsors must permit the department, or any designee of the department, to supervise and/or monitor the internet pre-licensing courses.
(b) All internet pre-licensing courses are subject to routine evaluation by authorized representatives of the commissioner. Any violations or irregularities with respect to course presentation, instructional quality, adherence to curriculum or any requirement prescribed by the commissioner may result in sanctions against the course sponsor. Such sanctions may include suspension or revocation of the sponsor’s approval to provide this course using the internet. Sponsors must allow the department or its designee to make periodic unscheduled inspections of all sponsor facilities and records related to the delivery and administration of the internet pre-licensing course. Any refusal or denial by an approved sponsor or its employee, agent, or representative to allow a designee of the department to make an evaluation of the internet pre-licensing course may be due cause for a sanction.
(c) Sponsors must monitor the parameters of program delivery and adherence to a sponsor’s approved course and timeframes, internal controls, and other measures to ensure that the participant receives a complete and effective course in full compliance with all applicable laws and regulations.
(d) In addition to any monitoring conducted by the department or a third-party monitor selected by the department, sponsors are responsible for policing their own program. Sponsors must implement sufficient controls to ensure that the approved internet pre-licensing course, including any time frames, testing, identity, and participation validation techniques, as well as customer service and support functions, remain accurate and functional at all times. System failures, unapproved changes, or absence of internal controls may result in suspension or revocation of the sponsor’s internet pre-licensing course.
(e) Sponsors must procure an independent third-party monitor to ensure program integrity at their own expense. All reports prepared by such monitor must be provided to the department. A minimum of one report per quarter prepared by such monitor must be provided to the department.
1. (1) A contract between a third-party monitor and a sponsor must include, but not be limited to, the following types of oversight:
  1. (i) that the third-party monitor visit the sponsor locations on an annual basis to review compliance with department course requirements;
  2. (ii) that sponsors give the third-party access to information consistent with that provided to the department. Third-party monitors must adhere to all State and Federal privacy laws relative to data provided to any other party;
  3. (iii) that the third-party monitor completes each course offering at a minimum of twice per quarter so as to verify all requirements are being met;
  4. (iv) that the third-party monitor will receive regular data transmission according to a defined record format of student reporting requirements for the internet pre-licensing course and that the monitor will analyze data for trends and patterns of abuse. Sponsors must adhere to all State and Federal privacy laws relative to data provided to any other party;
  5. (v) that the third-party monitor must conduct at least two onsite audits of the sponsor’s data hosting and reporting process, policies, and implementation, during the first and third year of the sponsor’s participation in the pilot to ensure data collected, stored, and reported is consistent with what the sponsor received; and
  6. (vi) that during the onsite audit, third-party monitors will review sponsor’s security of motorist personal information to ensure adherence with security policies as prescribed by the commissioner.
2. (2) Monitors must cooperate with the department’s supervision and monitoring of internet pre-licensing courses and must allow the department access to all records related to such courses. The department shall be permitted to contact sponsor’s third-party monitors directly, without prior approval of, or notification to, sponsors.
3. (3) The department reserves the right to require the replacement of third-party monitors, including those procured by the sponsor. The department shall not be held liable for the actions of any third-party monitors. Monitors must cooperate with the department’s supervision and monitoring of internet pre-licensing courses and must allow the department access to all records related to such courses. The department may contact sponsors’ third-party monitors directly, without prior approval of, or notification to, sponsors.
(f) In the event that a course is monitored and found to be deficient by the sponsor’s third-party monitor, a review of data transmission is found to be suspect, or the review of the sponsor’s hosting, reporting, or security process appears deficient, a report of such deficiencies must be delivered in writing to both the department and sponsor within 24 hours of identification. When notified of a deficiency, sponsors must investigate as soon as possible, but in no event shall the investigation be completed more than 10 calendar days after notification of such deficiency. Where a deficiency is confirmed, the sponsor must provide the department with a remediation plan within 10 calendar days. Sponsors must correct the deficiency within 30 calendar days. The department, in its discretion may, but is not required to, consider requests for extensions of time on a case-by-case basis. If such request is considered, the department may grant or deny the request.
(g) The department may periodically audit any and all sponsor records and third-party monitor records related to the internet pre-licensing course. The sponsor must cooperate with such periodic audit conducted by the department.
(h) The department reserves the right to review and approve the use of third-party data or information for the purpose of validating student identity, this includes the review of any contracts, agreements, security protocols, and policies, and may consult any third-party data provider without permission from the sponsor.