NYDFS Part 500
Also called 23 NYCRR Part 500, NYDFS cybersecurity regulation
NYDFS Part 500 is the New York Department of Financial Services cybersecurity regulation, 23 NYCRR Part 500. It requires banks, insurers and other firms licensed in New York to run a risk-based cybersecurity programme, appoint a CISO, report incidents within 72 hours and certify compliance to the regulator every year.
How it works
A covered entity bases its programme on a risk assessment and sets written policies approved by senior governance. Required controls include access privilege management, multi-factor authentication, encryption, an asset inventory, vulnerability management, penetration testing, third-party service provider policies, incident response and business continuity plans, and training. The CISO reports to the board at least annually on the programme and material risks.
The Second Amendment, finalised on 1 November 2023, added governance duties, stronger controls for larger Class A companies and new notice rules, phased in through 1 November 2025. Firms must notify the regulator within 72 hours of determining that a cybersecurity incident has occurred and within 24 hours of an extortion payment. By 15 April each year, the highest-ranking executive and the CISO sign a certification of material compliance or an acknowledgment of noncompliance.
The rules
Requires a risk-based cybersecurity programme, a CISO, core technical controls, incident notice to the superintendent and an annual compliance filing.
Banks, insurers and other firms licensed or authorised by NYDFSAdds board oversight, CISO independence, extortion payment notice and broader access, MFA and asset inventory controls, phased in over two years.
All covered entities, with extra duties for Class A companiesRequires notice within 72 hours of determining a cybersecurity incident, notice within 24 hours of an extortion payment, and an annual filing by 15 April.
All covered entitiesCommon questions
Who has to comply with Part 500?
Any person operating under, or required to operate under, a licence, registration or similar authorisation from NYDFS, including banks, insurers and money transmitters. Smaller firms can qualify for limited exemptions but still file annually.
What changed with the Second Amendment?
It added board-level oversight, a 24-hour extortion payment notice, a choice between certifying compliance or acknowledging noncompliance, and stronger controls for Class A companies, including MFA for all remote access and an asset inventory.
What is the 72-hour rule?
A covered entity must notify NYDFS electronically as promptly as possible, and in no event later than 72 hours, after determining that a cybersecurity incident has occurred at the firm, an affiliate or a third-party service provider.
