In $2017$ New York State Department of Financial Services promulgated a rule $($i$.$e$.,$ issued a new regulation$)$ that reaches beyond the state$$s borders in requiring corporate boards to implement cybersecurity protections. This regulation was motivated by the increasing number of cyber attacks. The justification for the new regulation was $$to establish and maintain a cybersecurity program designed to protect consumers and ensure the safety and soundness of New York State$$s financial services industry.$$ The law extends beyond New York$$s borders because of the policies mandated place obligations on third party service providers. How does this complicate this regulation?