NYDFS Part 500

Part 500 is the New York Department of Financial Services' cybersecurity regulation for the banks, insurers and other financial companies it licenses. It is one of the most prescriptive cybersecurity rules in the United States: it names the controls a covered entity must have, requires a chief information security officer who reports to the board, and requires an annual certification of compliance signed by the chief executive and the CISO.

Its second amendment, adopted in November 2023, phased in stricter requirements through November 2025, including multi-factor authentication for all access to information systems and a complete asset inventory. All of those phases now apply.

• Covered entities: any person operating, or required to operate, under a license, registration, charter or similar authorization under New York's Banking Law, Insurance Law or Financial Services Law, including many out-of-state and foreign institutions with New York licenses.
• Class A companies, the largest covered entities by New York revenue and headcount or global revenue, carry extra duties such as independent audits and privileged access management.
• Limited exemptions apply to small covered entities below employee, revenue or asset thresholds, and to some entities that hold no nonpublic information. Exempt entities must still file a notice of exemption and meet the parts of the rule that still apply to them (500.19).

DFS enforces under the Banking, Insurance and Financial Services Laws. The regulation treats a single act prohibited by the rule, or a failure to comply for any 24-hour period with a requirement, as a violation (500.20). DFS has reached multimillion-dollar settlements, often citing inaccurate compliance certifications, and the certification makes the signing executives personally accountable for its accuracy.

1. Confirm your status: covered entity, Class A company, or eligible for a limited exemption.
2. Map your program to each section of Part 500 and assign an owner to each.
3. Check multi-factor authentication covers every individual accessing any information system, and document any approved compensating controls.
4. Complete the asset inventory and the annual risk assessment, and keep both current.
5. Brief the board at least annually through the CISO's written report.
6. Rehearse the 72-hour notice and the 24-hour notice for extortion payments.
7. Build the evidence file that supports the annual certification before it is signed.