NYDFS Part 500 (23 NYCRR 500) is the New York Department of Financial Services cybersecurity regulation for banks, insurers, money transmitters and other entities licensed under New York's banking, insurance or financial services laws. The amended rule, adopted in November 2023, was phased in through November 2025. Covered entities now need a CISO, a risk-based program, MFA for all users, an asset inventory, 72-hour incident notice and an annual certification by 15 April.
This checklist is a practical summary, not legal advice. Confirm obligations with counsel and the current regulation text on dfs.ny.gov.
Who is covered
- Covered entities: any person operating (or required to operate) under a licence, registration, charter or similar authorisation under New York's Banking, Insurance or Financial Services Laws. That includes many small insurance agencies, mortgage brokers and lenders.
- Limited exemptions (section 500.19) apply to smaller entities, based on headcount, New York revenue and total assets. An exemption reduces requirements but doesn't remove them all, and it must be filed.
- Class A companies are larger entities (based on New York revenue plus total employees or total revenue). They carry extra duties such as independent audits and enhanced monitoring.
The checklist
| Requirement | What you need in place |
|---|---|
| Cybersecurity program and policies (500.2โ500.3) | A risk-based program and written policies approved at least annually by a senior officer or the board |
| CISO (500.4) | A qualified CISO, who can be from an affiliate or a third party such as a vCISO, and who reports to the board at least annually |
| Governance | The senior governing body must have enough understanding of cyber risk to exercise oversight, and must receive regular reports |
| Risk assessment (500.9) | A documented risk assessment, reviewed and updated at least annually and on material change |
| Vulnerability management (500.5) | Penetration testing by a qualified independent party at least annually, plus automated vulnerability scanning and timely remediation |
| Access privileges (500.7) | Least privilege, limited privileged accounts, and access reviews at least annually |
| Multi-factor authentication (500.12) | MFA for any individual accessing any information system of the covered entity (in force from November 2025) |
| Asset inventory (500.13) | A complete, maintained inventory of information systems with owners, locations, classification and support dates (in force from November 2025) |
| Monitoring and training (500.14) | Controls to detect unauthorised activity, and annual cybersecurity awareness training that includes social engineering |
| Encryption (500.15) | Encryption of nonpublic information in transit and at rest, or approved compensating controls |
| Incident response and BCDR (500.16) | Written incident response and business continuity / disaster recovery plans, tested at least annually |
| Notification (500.17) | Notify DFS within 72 hours of determining a reportable cybersecurity event. Notify extortion payments within 24 hours, and give a written explanation within 30 days |
| Annual certification (500.17(b)) | By 15 April each year: a certification of material compliance, or an acknowledgment of non-compliance with a remediation plan, signed by the CEO (or highest-ranking executive) and the CISO |
| Third-party service providers (500.11) | Policies for vendor due diligence, minimum controls and contractual protections |
Where small covered entities usually fall short
- MFA gaps on legacy systems, shared mailboxes and service accounts. "All individuals" means more than email.
- Asset inventory kept in a spreadsheet nobody updates.
- A CISO in name only. Regulators expect real oversight and an annual written report to the board.
- Untested plans. An incident response plan nobody has rehearsed fails the "tested annually" requirement.
- Certifying without evidence. If you sign in April, you need the documents that support it.
Extra requirements for Class A companies
Class A companies carry additional obligations on top of the core checklist:
- An independent audit of the cybersecurity program, at least annually.
- A privileged access management solution, and an automated way to block commonly used passwords.
- Endpoint detection and response plus centralised logging and security event alerting, unless the CISO approves equivalent controls in writing.
Evidence to keep for the 15 April certification
- Board or senior-officer approval of the policies (minutes or signed approvals)
- The CISO's annual written report to the board
- The current risk assessment and evidence it was reviewed
- Penetration test report and remediation tracking; vulnerability scan history
- MFA coverage report showing all users and systems
- Asset inventory export with owners and support dates
- Training completion records
- Incident response and BC/DR test reports
- Third-party service provider due-diligence records
DFS can request documentation supporting a certification. If the evidence doesn't exist, the safer filing is an acknowledgment of non-compliance with a remediation timeline.
A 90-day path to a defensible certification
- Days 1โ30: confirm your classification (standard, exempt or Class A); appoint or contract the CISO; run the risk assessment; inventory systems.
- Days 31โ60: close MFA gaps, update policies and get them approved, test the incident response plan, run the penetration test.
- Days 61โ90: remediate high findings, compile the evidence pack, brief the board, and prepare the certification for the CEO and CISO to sign.
Frequently Asked Questions
Can a virtual CISO satisfy the NYDFS CISO requirement?
Yes. Part 500 allows the CISO to be employed by an affiliate or a third-party service provider, provided the covered entity keeps responsibility and oversight.
When is the NYDFS annual certification due?
By 15 April each year, covering the prior calendar year.
How quickly must a cybersecurity event be reported to NYDFS?
Within 72 hours of determining that a reportable cybersecurity event has occurred. Extortion payments must be reported within 24 hours.
Does NYDFS require penetration testing?
Yes. Covered entities must have penetration testing by a qualified internal or external independent party at least annually, unless exempt.
Are small companies exempt from NYDFS Part 500?
Some qualify for limited exemptions based on size, but they must still meet core requirements, such as MFA and a risk assessment, and file the exemption.
Certifying to NYDFS this April? Defensible provides the CISO function, the risk assessment, the annual penetration test and the evidence pack, from our office at 48 Wall Street. Book an NYDFS readiness call.
