What the NYDFS cybersecurity rule requires now
The NYDFS cybersecurity regulation, formally 23 NYCRR Part 500, now functions as a mature compliance regime for financial services companies regulated by the New York State Department of Financial Services. The main practical shift is that the amended rule’s major transition periods have passed, including the two-year deadline that ran to November 1, 2025 for expanded multi-factor authentication and asset inventory obligations. In 2026, covered entities should treat Part 500 less as a project plan and more as an evidence-based cybersecurity program rule: risk assessments must shape controls, senior leadership must oversee cyber risk, incidents must be reported quickly, and annual filings must be supported by records rather than broad assurances.
For financial institutions, insurers, money transmitters, virtual currency businesses and other DFS-regulated entities, the issue is not simply paperwork. It is traceability. Can the organization show why a control was selected, how it maps to risk, who owns it, when it was tested, and what changed after new threats or business changes emerged?
For more cybersecurity coverage and regulatory updates, visit the Roads News cybersecurity section.
Who must comply with Part 500
Part 500 applies to a covered entity, generally meaning any person or organization operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation or similar authorization under New York’s Banking Law, Insurance Law or Financial Services Law. That definition matters because an organization can be subject to Part 500 even if another regulator also supervises it.
The rule reaches a broad range of financial services participants, including banks, insurers, licensed lenders, mortgage companies, money transmitters and certain virtual currency businesses. It also affects individual licensees and smaller firms, although some may qualify for limited exemptions. A limited exemption does not usually mean there are no cybersecurity obligations. It means the entity may be exempt from selected sections while still needing to maintain applicable safeguards, submit required notices and keep its exemption status current.
The 2023 amendments also created a Class A company category for larger covered entities. Class A companies face additional obligations, including independent audits of the cybersecurity program, privileged access monitoring, privileged access management and stronger monitoring and logging expectations. The classification is based on revenue and either employee count or total revenue thresholds, taking into account certain affiliate relationships where cybersecurity resources or information systems are shared.
The compliance timeline has moved from transition to operation
DFS adopted the Second Amendment to Part 500 effective November 1, 2023. The amended rule used staggered transition periods rather than making every new requirement enforceable at once. That schedule is now central to understanding the current state of compliance.
| Date | What changed | Why it matters now |
|---|---|---|
| March 1, 2017 | Original Part 500 became effective. | Established New York’s baseline cybersecurity requirements for covered financial services companies. |
| November 1, 2023 | Second Amendment became effective. | Expanded governance, reporting, incident response, control and exemption provisions. |
| December 1, 2023 | New Section 500.17 incident and extortion payment notice requirements began after a 30-day transition period. | Covered entities needed to align incident escalation with the 72-hour cyber incident notice rule and separate extortion payment notice obligations. |
| April 29, 2024 | General 180-day transition period for many new amendment requirements ended. | Organizations needed updated programs, policies and documentation for the amended baseline rule. |
| November 1, 2024 | One-year transition items became due, including amended governance, encryption, incident response and certain exemption-related requirements. | Cybersecurity became more directly tied to senior governing body oversight, written plans and defensible compensating-control decisions. |
| May 1, 2025 | Eighteen-month transition items became due, including selected vulnerability management, access management and monitoring requirements. | Entities needed stronger evidence around testing, access privileges, user monitoring and training controls. |
| November 1, 2025 | Two-year transition items became due for expanded multi-factor authentication and asset inventory requirements. | The amended rule’s final major implementation phase ended, shifting attention to sustained operation and examination readiness. |
| September 10, 2026 | DFS issued risk assessment guidance clarifying expectations and best practices. | DFS emphasized that risk assessments must be dynamic, documented, scoped to real assets and used to support control decisions. |
The practical result is that covered entities should no longer frame amended Part 500 as a future project. By late 2026, the stronger question is whether the organization can demonstrate continuing compliance across assessment cycles, board reporting, vendor reviews, access controls, incident exercises and annual filings.
Risk assessment is the organizing principle
Part 500 is risk-based, but risk-based does not mean discretionary or vague. A covered entity must maintain a cybersecurity program designed to protect the confidentiality, integrity and availability of its information systems and nonpublic information. That program must be based on the entity’s risk assessment.
The risk assessment requirement is now one of the most important parts of the NYDFS cybersecurity framework. The rule requires periodic risk assessments that are reviewed and updated at least annually and whenever a business or technology change causes a material change to cyber risk. The assessment must be documented and conducted under written policies and procedures that define how risks are evaluated, how information systems and nonpublic information are assessed, and how risks are mitigated or accepted.
DFS’s September 10, 2026 guidance sharpened this expectation. It described common gaps such as incomplete asset visibility, weak or inconsistent methodologies, failure to address evolving threats, insufficient governance, and risk assessments that do not actually inform the cybersecurity program. For compliance teams, the message is clear: the risk assessment should not sit apart from the program. It should explain how the program is designed and why specific controls, exceptions and remediation decisions are defensible.
A defensible risk assessment should cover more than servers and laptops. It should account for cloud environments, third-party service providers, business processes, nonpublic information flows, single points of failure, emerging technologies, operational resilience and concentration risk. It should also distinguish inherent risk from residual risk and show how management decided to remediate, transfer, mitigate or accept specific risks.
Controls that now deserve closer attention
The amended regulation contains many requirements. Several areas deserve particular scrutiny because they connect directly to recent compliance deadlines and DFS guidance.
Multi-factor authentication
Section 500.12 now requires multi-factor authentication for any individual accessing a covered entity’s information systems, unless a limited exemption changes the scope. For entities relying on limited exemptions, MFA still applies to remote access, remote access to third-party applications from which nonpublic information is accessible, and privileged accounts other than certain service accounts that prohibit interactive login.
The rule allows a CISO to approve reasonably equivalent or more secure compensating controls in writing, with periodic review at least annually. Compensating controls should therefore not be treated as informal exceptions. They need ownership, a documented rationale, evidence of review and a clear connection to risk.
Asset inventory
The two-year transition period also applied to Section 500.13(a), which requires written policies and procedures designed to produce and maintain a complete, accurate and documented asset inventory of information systems. At a minimum, the inventory process must track key information such as owner, location, classification or sensitivity, support expiration date and recovery time objectives, where applicable.
This is more than an IT asset list. DFS’s 2026 risk assessment guidance describes asset inventory as a foundational input into risk assessment. If an entity cannot identify where nonpublic information resides, which systems are unsupported, which third parties connect to critical processes or which assets have high recovery requirements, it will struggle to show that its risk assessment is complete.
Governance and board-level oversight
Part 500 requires each covered entity to designate a CISO, though the CISO may be employed by the entity, an affiliate or a third-party service provider if oversight requirements are met. The CISO must report at least annually in writing to the senior governing body on the cybersecurity program, material cyber risks, program effectiveness, material cybersecurity events and plans for remediating material inadequacies.
The senior governing body must exercise oversight of cybersecurity risk management. This includes receiving and reviewing management reports and confirming that management has allocated sufficient resources to implement and maintain an effective cybersecurity program. In practice, minutes, reporting packages, risk dashboards and budget decisions may become important evidence of oversight.
Vulnerability management and monitoring
Covered entities must maintain written vulnerability management policies and procedures, conduct annual penetration testing from inside and outside information system boundaries, run automated vulnerability scans or manual reviews at a risk-based frequency and after material system changes, and remediate vulnerabilities based on risk. See also: AI.
Class A companies have additional monitoring obligations, including endpoint detection and response and centralized logging and security event alerting unless a CISO approves reasonably equivalent or more secure compensating controls. DFS’s 2026 heightened threat guidance also encourages faster remediation of known exploited vulnerabilities, phishing-resistant MFA, validation of cloud configurations and stronger monitoring when the threat environment changes.
Incident response and business continuity
Part 500 requires written incident response, business continuity and disaster recovery plans. These plans must address roles, decision authority, communications, remediation, documentation, regulatory reporting, recovery from backups, root cause analysis and updates after events. Covered entities must test incident response and BCDR plans at least annually with relevant staff and management, and must test the ability to restore critical data and systems from backups.
For examination purposes, a plan that has not been tested is weak evidence. Regulators are likely to care not only that a plan exists, but also whether personnel understand it, whether it aligns with actual systems and vendors, and whether lessons from exercises or incidents lead to updates.
Reporting and annual certification carry higher documentation risk
Part 500 requires covered entities to notify the DFS Superintendent as promptly as possible and no later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, an affiliate or a third-party service provider. The rule also requires continuing updates when material changes or new information become available.
The amended rule added explicit requirements for extortion payments. A covered entity that makes an extortion payment in connection with a cybersecurity event must provide notice within 24 hours of the payment and, within 30 days, provide a written explanation covering why payment was necessary, what alternatives were considered, what diligence was performed to find alternatives and what diligence was performed to ensure compliance with applicable rules, including sanctions requirements.
The annual filing requirement is also more demanding than a simple check-the-box certification. By April 15 each year, covered entities must submit either a certification of material compliance for the prior calendar year or an acknowledgment of noncompliance identifying the relevant sections, describing the nature and extent of noncompliance, and providing a remediation timeline or confirmation that remediation is complete. The filing must be signed by the highest-ranking executive and the CISO, or by the highest-ranking executive and responsible senior officer if the entity does not have a CISO.
Supporting documentation must be retained for five years. That retention requirement makes the annual filing a governance and evidence exercise. If an organization certifies material compliance, it should be able to produce the policies, risk assessments, test results, access reviews, incident exercises, vendor records, board reports and remediation tracking that support the certification.
Recent enforcement shows what DFS may test
Recent DFS actions show that the regulator is focused on whether cybersecurity programs work in practice, not merely whether policy documents exist. In April 2026, DFS announced a $2.25 million settlement with Delta Dental Insurance Company and Delta Dental of New York after an investigation related to the MOVEit Transfer vulnerability. DFS said the companies had inadequate incident response policies and procedures, problems with secure disposal of nonpublic information and failures to timely report cybersecurity events.
In August 2026, DFS announced a $250,000 settlement with Order Express, a licensed money transmitter. DFS said its investigation identified deficiencies including inadequate risk assessments and insufficient cybersecurity policies for system updates. The case is notable because DFS also stated that Order Express qualified for exemptions from many Part 500 requirements based on limited revenue. In other words, limited exemption status did not eliminate scrutiny of the cybersecurity program, risk assessment and core policies that still applied.
These enforcement examples point to a practical checklist for covered entities. Risk assessments must address the company’s actual cyber risks, not generic operational categories. Patch and system update policies need to cover the real software environment. Data retention and disposal settings need governance. Incident response plans need clear regulatory reporting triggers. If an incident involves a third-party system, the entity still needs a process for determining whether Part 500 notice is required.
What covered entities should do next
For late 2026 planning, the most useful approach is to move from deadline tracking to evidence mapping. Covered entities should compare each major Part 500 obligation with the artifacts that prove implementation and review. That includes risk registers, asset inventories, MFA coverage reports, privileged access reviews, vulnerability scan results, penetration test reports, incident exercise records, BCDR test results, vendor assessments, CISO reports and board materials.
- Refresh the risk assessment. Confirm that it reflects current systems, nonpublic information flows, cloud services, third-party dependencies, emerging technologies and material threat changes.
- Validate asset inventory quality. Test whether the inventory is complete, current and useful for risk assessment, recovery planning and vulnerability management.
- Review MFA gaps and exceptions. Document any compensating controls and ensure they are approved and reviewed as required.
- Connect governance to resources. Make sure senior leadership receives meaningful reports and that decisions on funding, staffing and risk acceptance are recorded.
- Test incident and recovery procedures. Include regulatory reporting triggers, third-party events, backup restoration and communications in exercises.
- Prepare for the April 15 filing cycle early. Treat annual certification as the endpoint of a year-round evidence process, not a last-minute legal form.
The broader takeaway is that NYDFS cybersecurity compliance is now an operational resilience discipline. The amended rule expects regulated entities to know their environment, assess risk dynamically, maintain controls that match that risk, and prove that governance and reporting processes function under pressure. That is a higher bar than maintaining a policy library, but it also gives financial services firms a clearer roadmap for reducing cyber risk.
Frequently asked questions
What is the NYDFS cybersecurity regulation?
It is 23 NYCRR Part 500, a cybersecurity regulation issued by the New York State Department of Financial Services for covered financial services entities. It requires risk-based cybersecurity programs, governance, access controls, incident response, reporting and annual compliance filings.
Did the amended Part 500 deadlines already pass?
Yes. The major phased deadlines from the 2023 Second Amendment have passed. The final major transition date was November 1, 2025 for expanded MFA and asset inventory requirements. Covered entities should now focus on ongoing operation, documentation and examination readiness.
Does a limited exemption remove all obligations?
No. A limited exemption may reduce the number of applicable sections, but covered entities can still have important obligations under Part 500, including maintaining applicable cybersecurity controls, filing notices and supporting exemption status.
Why is risk assessment so important under Part 500?
The cybersecurity program must be based on the covered entity’s risk assessment. DFS guidance issued in 2026 emphasized that risk assessments should be documented, repeatable, current, scoped to real assets and used to support control selection, compensating controls and risk acceptance decisions.
When is the annual NYDFS cybersecurity filing due?
Covered entities must submit either a certification of material compliance or an acknowledgment of noncompliance by April 15 each year for the prior calendar year. Supporting records must be retained for examination and inspection.