State Legislation : Rhode Island Enacts New Financial Institutions Cybersecurity Law With Immediate Effect

Rhode Island enacted Senate Bill 603 on July 2, 2025, imposing comprehensive cybersecurity requirements on state‑licensed nonbank financial institutions that largely track NYDFS Part 500. The law requires written information security and incident response programs, risk assessments, MFA, access controls, encryption, annual penetration testing and semiannual vulnerability scans, and mandates notification to the Department of Business Regulation within three business days of determining a security event.