NYDFS Cybersecurity Regulation - Compliance Guide

· About NYDFS Cybersecurity Regulation

Key Takeaways

  • 23 NYCRR Part 500 applies to New York Department of Financial Services (NYDFS) “covered entities,” including banks, insurers, and other DFS-licensed or chartered financial services firms, and it is enforced by NYDFS. [2][4]
  • The Second Amendment to Part 500 took effect in stages, with the final major phase becoming effective on 1 November 2025 for expanded MFA and written asset inventory requirements. [2][5][7]
  • Covered entities must provide annual compliance certification signed or approved by the CEO and CISO, and the annual certification due after the final 2025 phase had to reflect those controls. [7][14]
  • NYDFS requires prompt incident reporting, including 72-hour notice of cybersecurity events that meet the regulation’s reporting threshold and 24-hour notice of ransomware payment in covered circumstances. [2][9]
  • Violations can lead to NYDFS enforcement actions, including civil monetary penalties, remediation orders, and other supervisory consequences under the New York Financial Services Law. [2][4]
  • The rule has continued to evolve through 2026 guidance, including NYDFS FAQs and threat-environment guidance, but there was no published delay to the 1 November 2025 final phase in the materials reviewed. [4][6][9]

What It Is

23 NYCRR Part 500 is NYDFS’s cybersecurity regulation for financial services companies. It sets minimum cybersecurity standards for covered financial institutions and related entities operating under DFS supervision, covering governance, risk assessment, access controls, incident response, third-party security, and other baseline safeguards. [2][4]

NYDFS is the enforcing body through its cybersecurity program and supervisory authority. The regulation was originally adopted in 2017, then materially amended in 2023 by the Second Amendment, which introduced phased-in enhancements extending through 1 November 2025. [2][10]

The key phase-in milestones reflected in the official text and regulator materials are:

  • 16 November 2023: Second Amendment adopted/finalized and published. [10]
  • 1 May 2024: earlier implementation wave for several governance, monitoring, and security controls. [10]
  • 1 May 2025: second wave for items such as automated vulnerability scanning and additional access-control and protection requirements. [1][2][10]
  • 1 November 2025: final wave for expanded MFA and written asset inventory obligations. [1][2][7][10]

Who Must Comply

Part 500 applies to covered entities, meaning entities operating under, or licensed, chartered, or otherwise supervised by, NYDFS in the financial services sector. That generally includes banks, trust companies, credit unions, insurers, and many financial services businesses subject to DFS jurisdiction. [2][4]

The regulation has exemptions and limited carve-outs. Certain small entities and other specified businesses may qualify for limited exemptions in particular sections, but the 2023 amendments narrowed some earlier relief, especially around MFA. [2][5][6]

The rule has extraterritorial reach in practice because it applies based on DFS regulatory status, not only on physical location. A covered entity outside New York can still be in scope if it is DFS-regulated, and third-party service arrangements do not remove the regulated entity’s responsibility to maintain compliance. [2][4]

Class A companies face additional obligations beyond baseline covered entities, including more demanding technical controls and enhanced oversight requirements. [2][15]

Core Requirements

  1. Cybersecurity program and policy. Covered entities must maintain a cybersecurity program and written cybersecurity policy designed to protect information systems and nonpublic information, with controls scaled to the entity’s risk profile. [2][4]
  1. Risk-based governance. Entities must perform periodic risk assessments, designate responsible security leadership, and maintain board or equivalent governing-body oversight of cybersecurity risk. [2][4]
  1. Access control and MFA. The final 2025 phase requires multi-factor authentication for access to information systems subject to the rule, subject only to limited exceptions or approved compensating controls in defined circumstances. [1][2][6]
  1. Asset inventory. Covered entities must maintain a written, accurate, and regularly updated asset inventory covering systems and components necessary to support cybersecurity controls. [1][2][7]
  1. Monitoring, vulnerability management, and logging. The regulation requires risk-based vulnerability scanning, logging, and monitoring measures proportionate to the entity’s environment and risk, with additional expectations for Class A companies. [1][2][15]
  1. Incident response and notification. Covered entities must maintain incident response plans and notify NYDFS of qualifying cybersecurity events within 72 hours, and must notify within 24 hours of certain ransomware payment decisions. [2][9]
  1. Annual certification. Each covered entity must file an annual certification of compliance or identify material compliance issues, supported by CEO/CISO involvement and underlying documentation. [7][14]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Second Amendment adopted | 16 November 2023 | NYDFS finalized the 2023 amendments to Part 500. [10] | | First phase-in wave | 1 May 2024 | Early amended requirements began to apply on a rolling basis. [10] | | Second phase-in wave | 1 May 2025 | Additional technical and access-control requirements took effect. [1][2][10] | | Final phase-in wave | 1 November 2025 | Expanded MFA and written asset inventory obligations became effective. [1][2][7][10] |

Maximum fines and sanctions: NYDFS can impose civil monetary penalties under the Financial Services Law, issue consent orders, require remediation, and pursue other supervisory or enforcement actions for noncompliance. The exact penalty amount depends on the legal basis, the violation, and the facts; for continuing violations, exposure can increase materially. [2][4]

How to Comply

  1. Map scope first. Confirm which legal entities, branches, systems, and vendors are in Part 500 scope, including any Class A status, and document the rationale in the compliance register. [2][15]
  1. Build the control framework. Use ISO 27001 as the management-system backbone, then map Part 500 requirements to policies, risk treatment, access control, incident response, and supplier-security controls. [2][4]
  1. Harden identity and access. Implement MFA broadly, review privileged access, tighten remote access pathways, and document any compensating controls and approvals where an exception is permitted. [1][6]
  1. Create and maintain the asset inventory. Establish a continuously updated inventory of hardware, software, cloud services, and security-relevant assets, with ownership and lifecycle metadata sufficient to support control testing and incident response. [1][7]
  1. Operationalize detection and response. Align incident handling to NIST CSF 2.0 functions—Govern, Identify, Protect, Detect, Respond, and Recover—so 72-hour and 24-hour reporting clocks can be met reliably. [2][9]
  1. Test third-party and resilience controls. Validate service-provider oversight, backup recovery, and business continuity, and tie critical recovery testing to the risk assessment rather than to a fixed annual checklist. [2][4]
  1. Formalize cyber governance. Use ISO 42001 only where AI systems are part of the security or operations stack, especially for governance, accountability, and lifecycle controls over AI-enabled monitoring or triage tools. [2][4]
  1. Prepare certification evidence early. Maintain auditable evidence for each required control, assign control owners, and run a pre-certification review so the annual CEO/CISO filing rests on tested facts rather than manual attestation alone. [7][14]

Related Regulations

NY SHIELD Act overlaps on reasonable safeguards for New York personal information, but Part 500 is more prescriptive and applies to DFS-regulated financial entities. [2][4]

GLBA Safeguards Rule overlaps heavily on information-security program, risk assessment, and service-provider oversight requirements, though Part 500 has distinct DFS-specific reporting and certification duties. [2][4]

SEC Regulation S-P can conflict operationally for dual-regulated firms because it imposes separate incident-response and privacy obligations, so firms need a unified breach workflow. [2][4]

NYDFS insurance cybersecurity rules overlap for insurers subject to both DFS insurance supervision and Part 500, but Part 500 remains the central cybersecurity baseline for DFS covered entities. [2][4]

EU NIS2 may matter for multinational groups, but it does not displace Part 500; instead, it creates parallel governance and incident-reporting obligations for EU-facing operations. [2][4]

FAQ

Does NYDFS Part 500 apply to companies outside New York?

Yes, if the company is a DFS-regulated covered entity. The trigger is regulatory status, not headquarters location, so out-of-state or foreign firms can be in scope when they are licensed, chartered, or supervised by NYDFS. [2][4]

Does the 1 November 2025 phase mean universal MFA?

Practically, yes for the covered information systems in scope, subject to narrow exceptions and compensating controls recognized by the rule. NYDFS’s 2026 guidance and law-firm analyses describe the final phase as a near-universal MFA requirement for access to information systems. [1][6][9]

What is required for the annual certification?

The annual certification requires the covered entity to attest to compliance or explain areas of noncompliance, with accountability extending to executive oversight and CISO involvement. The post-2025 certification cycle had to reflect the final MFA and asset-inventory requirements. [7][14]

How fast must a cybersecurity incident be reported to NYDFS?

The rule requires notice within 72 hours for qualifying cybersecurity events and separate 24-hour notice for certain ransomware payment decisions. Firms should assume the clock starts as soon as the reporting threshold is met and preserve evidence of timing decisions. [2][9]

Are there any 2026 delays or extensions to the 2025 deadlines?

No published delay was identified in the materials reviewed. NYDFS guidance in 2026 discusses implementation expectations and heightened-threat measures, but the final 2025 phase remained effective on 1 November 2025. [4][6][9]

What happens if a firm cannot fully comply?

A firm should document the gap, implement compensating controls where allowed, and remediate on an expedited timeline. NYDFS can still enforce the rule through penalties, remediation orders, and supervisory action if the gap is material or prolonged. [2][4]

Sources

Put it into practice

More compliance guides