Skip to content
CyberAccord

NYDFS 23 NYCRR Part 500

NYDFS Part 500 cybersecurity compliance

We help financial services companies regulated by the New York Department of Financial Services meet the amended cybersecurity regulation. That runs from risk assessment and policies to CISO support and incident response.

Book a free consultationor call +1 (832) 429-5665

At a glance

NYDFS 23 NYCRR Part 500 is New York's cybersecurity regulation for banks, insurers and other financial services companies licensed by the Department of Financial Services. Amended in November 2023, its obligations were fully phased in by November 2025. CyberAccord assesses your program against Part 500, writes required policies, provides CISO support and prepares your annual compliance filing.

Who it applies to
Entities licensed, registered or chartered by NYDFS
Current version
Second amendment adopted November 2023; fully phased in November 2025
Annual filing
Certification of compliance or acknowledgment of noncompliance, due April 15
Incident notice
Within 72 hours of determining a cybersecurity incident occurred

Who must comply with Part 500?

Part 500 applies to covered entities: organizations operating under a license, registration, charter or similar authorization under New York's Banking Law, Insurance Law or Financial Services Law. That includes banks, insurers, mortgage companies, money transmitters and many insurance agencies and brokers.

Smaller entities may qualify for limited exemptions, but even exempt entities usually keep core obligations such as risk assessment and the annual filing. Larger Class A companies carry additional requirements, including independent audits.

What changed with the 2023 amendment?

NYDFS adopted the second amendment in November 2023 and phased its requirements in through November 2025. It strengthened governance and board oversight, set new CISO reporting duties and tightened access controls.

  • Multi-factor authentication for any individual accessing information systems
  • A complete, maintained asset inventory
  • Annual certification signed by the CEO and CISO, or an acknowledgment of noncompliance with a remediation plan
  • Business continuity and disaster recovery planning, with testing
  • Notice of extortion payments within 24 hours
  • Annual cybersecurity awareness training that includes social engineering

What we do

We assess your current program against each section of Part 500, focusing first on the requirements companies find hardest: a documented cybersecurity program and policy, risk assessment, access controls and incident response.

Part 500 requires a qualified CISO, who can be provided by a third party. Our virtual CISO service can fill that role or support your existing CISO, including the written report to your senior governing body. We also help you assemble the evidence behind your annual April 15 filing.

How it works

  1. 1

    Classify and scope

    We confirm your covered entity status, any exemptions and whether Class A requirements apply.

  2. 2

    Assess

    We review your program, policies and controls against Part 500 and run the required risk assessment.

  3. 3

    Remediate

    We help close gaps, from MFA and asset inventory to incident response and training.

  4. 4

    Certify with confidence

    We assemble the evidence that supports your annual certification or acknowledgment of noncompliance.

Questions, answered

Does Part 500 require a full-time in-house CISO?

No. Covered entities must designate a qualified CISO, but that person can work for an affiliate or a third-party service provider. The covered entity remains responsible for compliance and must oversee the third party.

What is due on April 15 each year?

Covered entities must submit either a certification of material compliance for the prior calendar year or an acknowledgment of noncompliance that identifies the gaps and a remediation timeline. It must be signed by the highest-ranking executive and the CISO.

How quickly do we have to report a cybersecurity incident?

Notice to NYDFS is due within 72 hours of determining that a reportable cybersecurity incident has occurred. Extortion payments made in connection with an incident must be reported within 24 hours, with a written explanation to follow.

We qualify for a limited exemption. What do we still need to do?

Exempt entities still have meaningful obligations, including a risk assessment, certain policies, MFA and the annual filing. The exact list depends on which exemption applies, and we confirm it during scoping.

Can you help if we are already partway through compliance?

Yes. Many companies implemented the original 2017 requirements but not every 2023 change. We focus on the amended requirements and anything that has drifted since your last assessment.

Related

Not sure where to start?

Book a free 20-minute consultation. We'll learn what's driving the need and recommend a scoped next step with a fixed quote.

Book a free consultation+1 (832) 429-5665