NYDFS, partie 500

Part 500 is the New York Department of Financial Services' cybersecurity regulation for the banks, insurers and other financial companies it licenses. It is one of the most prescriptive cybersecurity rules in the United States: it names the controls a covered entity must have, requires a chief information security officer who reports to the board, and requires an annual certification of compliance signed by the chief executive and the CISO.

Its second amendment, adopted in November 2023, phased in stricter requirements through November 2025, including multi-factor authentication for all access to information systems and a complete asset inventory. All of those phases now apply.

• Covered entities: any person operating, or required to operate, under a license, registration, charter or similar authorization under New York's Banking Law, Insurance Law or Financial Services Law, including many out-of-state and foreign institutions with New York licenses.
• Class A companies, the largest covered entities by New York revenue and headcount or global revenue, carry extra duties such as independent audits and privileged access management.
• Limited exemptions apply to small covered entities below employee, revenue or asset thresholds, and to some entities that hold no nonpublic information. Exempt entities must still file a notice of exemption and meet the parts of the rule that still apply to them (500.19).

Le DFS assure l’application en vertu des lois sur la banque, l’assurance et les services financiers. Le règlement considère comme une violation un acte unique interdit par la règle, ou le non-respect d’une exigence pendant toute période de 24 heures (500.20). Le DFS a obtenu des transactions de plusieurs millions de dollars, invoquant souvent des certifications de conformité inexactes, et la certification rend les dirigeants signataires personnellement responsables de son exactitude.

1. Confirm your status: covered entity, Class A company, or eligible for a limited exemption.
2. Map your program to each section of Part 500 and assign an owner to each.
3. Check multi-factor authentication covers every individual accessing any information system, and document any approved compensating controls.
4. Complete the asset inventory and the annual risk assessment, and keep both current.
5. Brief the board at least annually through the CISO's written report.
6. Rehearse the 72-hour notice and the 24-hour notice for extortion payments.
7. Build the evidence file that supports the annual certification before it is signed.