N.Y. Comp. Codes R. & Regs. tit. 9 § 5014.16
Each courier service shall submit to the commission for approval a written description of its initial system of internal controls prior to the start of operations. Such system of internal controls shall demonstrate to the satisfaction of the commission that such courier service has adequate controls in place to address data security, responsiveness to cybersecurity events to mitigate any negative events, recovery from cybersecurity events and restoration of normal operations and services, risk assessment and mitigation, training, access controls and identity management, systems operations and availability concerns, courier customer data privacy, incident response, disaster recovery, document retention and any other control issue the commission may identify.
N.Y. Comp. Codes R. & Regs. Tit. 9 § 5014.16