Which statement is NOT correct regarding the cyber security regulation in New York?

A$-$ covered entities are required to complete a risk assignment profile or review

B$-$ covered entities that required to create a program that toward potential cyberattacks

C$-$ covered entities must have appointed individual responsible for overseeing the security of the program

D$-$ covered entities can create their own security program as there are no minimum state requirements