NYDFS Part 500 Compliance for Covered Entities
NYDFS Part 500 (23 NYCRR 500) is New York's cybersecurity regulation for banks, insurers, lenders and other entities licensed by the Department of Financial Services. The amended rule requires a CISO, a risk-based program, MFA, an asset inventory, 72-hour incident notice and an annual certification by April 15. Defensible helps you meet it from 48 Wall Street.
Founded by former Stroz Friedberg leaders. This page is a practical summary, not legal advice.
Who Is Covered by NYDFS Part 500?
A covered entity is any person operating, or required to operate, under a license, registration, charter or similar authorization under New York's Banking, Insurance or Financial Services Laws. That includes many small insurance agencies and mortgage brokers.
Smaller entities may qualify for a limited exemption based on headcount, New York revenue or total assets. An exemption reduces the requirements but does not remove them all, and it must be filed with DFS.
MFA gaps
Legacy systems, shared mailboxes and service accounts get missed.
A CISO in name only
Regulators expect real oversight and an annual written report to the board.
Untested plans
Incident response and continuity plans must be tested at least annually.
Certifying without evidence
If you sign in April, you need the documents behind it.
What Changed in the Amended Rule?
DFS adopted amendments to Part 500 in November 2023 and phased them in through November 2025. Governance expectations rose and larger Class A companies took on extra duties.
The board must understand cyber risk well enough to oversee it.
Required for any individual accessing any information system of the covered entity.
A maintained inventory of information systems and their owners.
72 hours to notify DFS of a reportable incident, and 24 hours for an extortion payment.
How Does Defensible Help You Comply?
The CISO function and the technical work behind it.
CISO and Governance
A qualified security leader who owns the program and reports to your board.
- vCISO — Program ownership, policies and the annual written board report
- Policy set — Written policies approved at least annually
- Third-party oversight — Vendor due diligence and minimum control requirements
Risk and Testing
The assessments and tests the rule expects at least annually.
- Risk assessment — Documented, and updated on material change
- Penetration testing — By a qualified independent party
Controls
Closing common technical gaps.
- MFA — Coverage across users, remote access and privileged accounts
- Asset inventory — Systems, owners, classification and support dates
Response and Certification
Tested plans and a solid evidence pack.
- IR and BC/DR plans — Written, tested and rehearsed with a tabletop
- Evidence pack — Organized for the CEO and CISO to sign
What Does the Amended Rule Require?
A summary of the core obligations. Confirm your specific obligations with counsel and the current regulation text on dfs.ny.gov.
| Requirement | Section | What you need in place |
|---|---|---|
| CISO | 500.4 | A qualified CISO, who may be employed by an affiliate or a third-party provider, reporting to the board at least annually |
| Risk assessment | 500.9 | Documented, reviewed and updated at least annually |
| Penetration testing | 500.5 | At least annually, plus automated vulnerability scans |
| Multi-factor authentication | 500.12 | MFA for any individual accessing any information system |
| Asset inventory | 500.13 | A complete, maintained inventory of information systems |
| IR and BC/DR plans | 500.16 | Written plans, tested at least annually |
| Notification | 500.17(a) | Notify DFS within 72 hours of determining a reportable incident |
| Annual certification | 500.17(b) | By April 15: compliance certification or acknowledgment of non-compliance, signed by the CEO and CISO |
Who We Help With Part 500
Covered entities that need the CISO function without a full-time hire.
Licensed producers holding client data.
Firms handling borrower financial data.
Institutions under DFS oversight.
Vendors whose covered-entity clients expect Part 500-aligned controls.
What Is Our Compliance Roadmap?
From classification to a certification you can sign.
- STEP 1Classify
Confirm whether you are a standard, exempt or Class A entity.
- STEP 2Appoint the CISO
Contract a vCISO or support your existing one.
- STEP 3Assess
Run the risk assessment, inventory systems and test against the rule.
- STEP 4Remediate
Close MFA gaps, update policies, test plans and run the penetration test.
- STEP 5Certify
Compile the evidence pack, brief the board and prepare the April 15 filing.
What Extra Rules Apply to Class A Companies?
Class A companies carry additional obligations on top of the core requirements. The thresholds combine New York revenue with total employees or total revenue, including affiliates, so check the definition in section 500.1 with counsel.
- Independent audits — Independent audits of the cybersecurity program, based on its risk assessment.
- Privileged access — A privileged access management solution and automated blocking of commonly used passwords.
- Detection — Endpoint detection and response plus centralized logging and security event alerting, unless the CISO approves equivalent controls in writing.
How Does a vCISO Fill the CISO Requirement?
A Defensible vCISO acts as your designated CISO. They own the program, approve policies with leadership, direct the risk assessment and testing, and deliver the annual written report to your board. Your senior personnel oversee the engagement.
Our CEO, Steve Doty, served as an outsourced CISO for numerous organizations as a Managing Director at Stroz Friedberg. If an incident does happen, our incident response team is on the same side of the table: our 24/7 hotline is (646) 349-4252, and a senior responder engages within one hour.
Containing a Server Breach for a vCISO Client
- Customer: A long-term vCISO client in the nonprofit sector
- Challenge: Suspicious activity on an internet-facing Confluence server shortly after it moved to Microsoft Azure
- Result: Defensible already knew the environment, confirmed the incident was limited in scope and contained, and found no signs of attacker persistence or spread
"Defensible Technology has proven to be a trusted and capable provider of services in the fields of Information Technology implementation and services, as well as Security Services. I have known and worked closely with Defensible's CEO, Steve Doty, and his colleagues for years. They are excellent professionals and it is a pleasure working with them. I recommend Defensible without hesitation for any organization that is seeking experienced high quality talent that can be trusted to deliver the valuable services they offer."
— Ed Stroz, Founder of Consilience 360, LLC and Stroz Friedberg, LLC
Frequently Asked Questions
Can a virtual CISO satisfy the NYDFS CISO requirement?+
Yes. Part 500 allows the CISO to be employed by an affiliate or a third-party service provider. The covered entity keeps responsibility for compliance and must designate senior personnel to oversee the third-party CISO.
When is the NYDFS annual certification due?+
By April 15 each year, covering the prior calendar year. You file either a certification of material compliance or an acknowledgment of non-compliance with a remediation plan, signed by the CEO or highest-ranking executive and the CISO.
What is a Class A company?+
Class A companies are the largest covered entities, defined by New York revenue combined with total employees or total revenue across the company and its affiliates. They must also conduct independent audits of the program and implement privileged access management and endpoint detection with centralized logging.
We're a small agency. Are we exempt?+
Possibly in part. Limited exemptions are based on headcount, New York revenue and total assets. An exempt entity still has core obligations and must file a notice of exemption. Confirm your status with counsel.
What must be reported within 72 hours?+
Covered entities must notify DFS within 72 hours of determining that a reportable cybersecurity incident has occurred. Extortion payments must be reported within 24 hours, with a written explanation within 30 days.
Get Your Part 500 Program Ready to Certify
We provide the CISO function, the testing and the evidence pack, from 48 Wall Street.