The New York Department of Financial Services (NYDFS) recent $2‑million settlement with Healthplex following an investigation conducted in the wake of a 2021 data breach highlights the financial, operational and reputation risks for all covered entities that fail to meet the stringent requirements of the NYDFS Cybersecurity Regulation. This article examines key aspects of the consent order and its compliance implications, with insights from enforcement specialists, including those who previously served in NYDFS roles, at BakerHostetler, Clifford Chance, Mayer Brown and Norton Rose Fulbright. See our two-part series “Amendment to NYDFS Cyber Regulation Brings New Mandates”: Governance Provisions (Dec. 13, 2023), and First Compliance Steps (Jan. 3, 2024).