NYDFS Part 500: the amended cybersecurity regulation, explained

Who Part 500 covers, and the three tiers

Part 500 applies to covered entities: any person operating, or required to operate, under a licence, registration, charter or similar authorisation under the New York Banking Law, Insurance Law or Financial Services Law. That reaches beyond banks to insurers, insurance agencies and brokers, money transmitters, mortgage lenders and virtual currency businesses, including many headquartered outside New York.

The 2023 amendment sorts covered entities into three tiers. Most obligations apply to every covered entity. Class A companies carry additional requirements. Entities that qualify for the limited exemption in section 500.19(a) are relieved of some requirements but not all of them.

Covered entity

A person licensed, registered or chartered, or required to be, under New York banking, insurance or financial services law.

Class A company

A covered entity with at least $20 million in gross annual revenue in each of the last two fiscal years from its own business and its affiliates' New York business, and either more than 2,000 employees (averaged over two years, affiliates included) or more than $1 billion in gross annual revenue from all business of the entity and its affiliates.

Limited exemption (500.19(a))

Fewer than 20 employees and independent contractors, or less than $7.5 million in gross annual revenue in each of the last three fiscal years from New York business operations, or less than $15 million in year-end total assets, in each case including affiliates.

Nonpublic information

Business information whose disclosure would materially harm the entity, and personal or health information about individuals as the regulation defines it.

What the Second Amendment changed, and when

DFS adopted the Second Amendment on 1 November 2023. It strengthened governance, made the CISO report to the board, added the Class A tier and phased in the heavier controls over two years. Every phase has now passed, so the full amended regulation applies.

Dates are from the DFS implementation timelines. Some phased items differ for Class A companies and for small businesses under the limited exemption, so check the timeline for your tier.

The core requirements

Part 500 is more prescriptive than most frameworks. The program must rest on a written risk assessment, and the regulation then names the controls it expects, several with a fixed frequency.

• Governance (500.3, 500.4): Written policies approved at least annually by a senior officer or the board. A qualified CISO who reports to the board in writing at least annually, and promptly on material issues. The board must have sufficient understanding of cybersecurity to exercise oversight.
• Testing (500.5): Annual penetration testing from inside and outside the system boundaries, and automated vulnerability scans, with remediation prioritised by risk.
• Access (500.7, 500.12): Least privilege, at least annual review of user access, prompt removal of unneeded accounts, and MFA for any individual accessing any information system.
• Asset inventory (500.13): A documented inventory tracking each asset's owner, location, classification or sensitivity, support expiration date and recovery time requirements, with secure disposal of nonpublic information no longer needed.
• Monitoring and training (500.14): Monitoring of user activity and protection against malicious code, and cybersecurity awareness training at least annually, including social engineering.
• Encryption (500.15): Nonpublic information encrypted in transit over external networks and at rest, or CISO-approved compensating controls reviewed at least annually.
• Incident response and continuity (500.16): Written incident response and business continuity and disaster recovery plans, tested at least annually, including the ability to restore critical systems from backups.
• Third-party service providers (500.11): Written policies for providers that hold or can access nonpublic information, with due diligence, minimum requirements and periodic assessment.

The 72-hour, 24-hour and 30-day notices

Section 500.17 sets the notices a covered entity owes DFS. The 72-hour clock starts when the entity determines that a cybersecurity incident has occurred, whether at the entity itself, an affiliate or a third-party service provider. Notices are filed through the DFS portal.

The annual filing is signed by the highest-ranking executive and the CISO. Entities under the limited exemption still file it. The records supporting it must be kept for five years and produced to DFS on request.

How DFS enforces Part 500

Under section 500.20, a single act prohibited by the regulation, or a single failure to meet an obligation, is a violation. That includes failing to prevent unauthorised access to nonpublic information through noncompliance with any section, and materially failing to comply with any section for any 24-hour period. Penalties are set under the Banking, Insurance and Financial Services Laws, taking into account cooperation, good faith, intent, history and whether the violations were isolated or a pattern.

DFS enforces through consent orders and publishes them. In 2026 these have included a $2.25 million settlement with two Delta Dental companies that cited, among other findings, late notice of a cybersecurity event and missing data disposal policies, and a $250,000 settlement with a money transmitter that DFS found lacked adequate risk assessments.

How Part 500 relates to NIST CSF, ISO 27001 and SOC 2

Part 500 requires a program that performs the core functions of identifying, protecting, detecting, responding and recovering, which follows the language of the NIST Cybersecurity Framework. Many of its controls also have counterparts in ISO 27001 and SOC 2. There is no official DFS mapping to either, so confirm overlaps control by control.

What existing certifications will not cover are the parts specific to DFS: the 72-hour and 24-hour notices, the April 15 filing and its signatories, the CISO's board reporting, the phased MFA and asset inventory scope, and the Class A obligations.