# NYDFS Part 500 cybersecurity compliance > NYDFS 23 NYCRR Part 500 is New York's cybersecurity regulation for banks, insurers and other financial services companies licensed by the Department of Financial Services. Amended in November 2023, its obligations were fully phased in by November 2025. CyberAccord assesses your program against Part 500, writes required policies, provides CISO support and prepares your annual compliance filing. Source: https://www.cyberaccord.com/compliance/nydfs-500 ยท Last reviewed: 2026-10-21 We help financial services companies regulated by the New York Department of Financial Services meet the amended cybersecurity regulation. That runs from risk assessment and policies to CISO support and incident response. ## Key facts - **Who it applies to:** Entities licensed, registered or chartered by NYDFS - **Current version:** Second amendment adopted November 2023; fully phased in November 2025 - **Annual filing:** Certification of compliance or acknowledgment of noncompliance, due April 15 - **Incident notice:** Within 72 hours of determining a cybersecurity incident occurred ## Who must comply with Part 500? Part 500 applies to covered entities: organizations operating under a license, registration, charter or similar authorization under New York's Banking Law, Insurance Law or Financial Services Law. That includes banks, insurers, mortgage companies, money transmitters and many insurance agencies and brokers. Smaller entities may qualify for limited exemptions, but even exempt entities usually keep core obligations such as risk assessment and the annual filing. Larger Class A companies carry additional requirements, including independent audits. ## What changed with the 2023 amendment? NYDFS adopted the second amendment in November 2023 and phased its requirements in through November 2025. It strengthened governance and board oversight, set new CISO reporting duties and tightened access controls. - Multi-factor authentication for any individual accessing information systems - A complete, maintained asset inventory - Annual certification signed by the CEO and CISO, or an acknowledgment of noncompliance with a remediation plan - Business continuity and disaster recovery planning, with testing - Notice of extortion payments within 24 hours - Annual cybersecurity awareness training that includes social engineering ## What we do We assess your current program against each section of Part 500, focusing first on the requirements companies find hardest: a documented cybersecurity program and policy, risk assessment, access controls and incident response. Part 500 requires a qualified CISO, who can be provided by a third party. Our virtual CISO service can fill that role or support your existing CISO, including the written report to your senior governing body. We also help you assemble the evidence behind your annual April 15 filing. ## What you get - Gap assessment against each section of 23 NYCRR Part 500 - Cybersecurity risk assessment - Cybersecurity program documentation and required policies - Incident response and business continuity plans - Virtual CISO support and board reporting - Evidence package supporting the annual compliance filing ## How it works 1. **Classify and scope.** We confirm your covered entity status, any exemptions and whether Class A requirements apply. 2. **Assess.** We review your program, policies and controls against Part 500 and run the required risk assessment. 3. **Remediate.** We help close gaps, from MFA and asset inventory to incident response and training. 4. **Certify with confidence.** We assemble the evidence that supports your annual certification or acknowledgment of noncompliance. ## Frequently asked questions ### Does Part 500 require a full-time in-house CISO? No. Covered entities must designate a qualified CISO, but that person can work for an affiliate or a third-party service provider. The covered entity remains responsible for compliance and must oversee the third party. ### What is due on April 15 each year? Covered entities must submit either a certification of material compliance for the prior calendar year or an acknowledgment of noncompliance that identifies the gaps and a remediation timeline. It must be signed by the highest-ranking executive and the CISO. ### How quickly do we have to report a cybersecurity incident? Notice to NYDFS is due within 72 hours of determining that a reportable cybersecurity incident has occurred. Extortion payments made in connection with an incident must be reported within 24 hours, with a written explanation to follow. ### We qualify for a limited exemption. What do we still need to do? Exempt entities still have meaningful obligations, including a risk assessment, certain policies, MFA and the annual filing. The exact list depends on which exemption applies, and we confirm it during scoping. ### Can you help if we are already partway through compliance? Yes. Many companies implemented the original 2017 requirements but not every 2023 change. We focus on the amended requirements and anything that has drifted since your last assessment. ## Related - [vCISO](https://www.cyberaccord.com/services/advisory/vciso): A part-time, U.S.-based security executive who leads your security program, manages risk, and reports to leadership. - [Managed Security](https://www.cyberaccord.com/services/managed-security): Managed device, email, cloud app, and AWS security, with a team that monitors alerts and responds to incidents for you. - [Penetration Testing](https://www.cyberaccord.com/services/security-testing/penetration-testing): Manual, senior-led penetration testing of web apps, APIs, mobile apps, and networks, with prioritized findings and a re-test of fixes. - [NIST](https://www.cyberaccord.com/compliance/nist): NIST gap assessments against CSF 2.0, SP 800-171 and SP 800-53, with scored findings and a prioritized remediation plan. ## Contact CyberAccord - Book a free consultation: https://www.cyberaccord.com/contact - Phone: +1 (832) 429-5665 - Email: info@cyberaccord.com - Office: 8990 Kirby Dr, Suite 220, Houston, TX 77054