NYDFS Cybersecurity Regulation (23 NYCRR 500)

What the NYDFS Cybersecurity Regulation Is and Why It Exists

The New York Department of Financial Services Cybersecurity Regulation, codified at 23 NYCRR Part 500, requires companies regulated by NYDFS to implement a risk-based cybersecurity program. First effective in 2017 and significantly amended in 2023, it was one of the first prescriptive US state cybersecurity rules for the financial sector and has influenced regulation elsewhere. It sets concrete expectations rather than general principles.

It exists because New York is a global financial center, and the sensitive financial data and critical services its institutions handle make them prime targets. NYDFS sought to ensure consistent, demonstrable protection.

Who It Applies To

Part 500 applies to "covered entities" licensed or authorized by NYDFS, including banks, insurance companies, mortgage lenders, and many other financial-services firms operating in New York. Smaller firms may qualify for limited exemptions from certain provisions, but most still must meet core requirements. The 2023 amendments added heightened obligations for larger "Class A" companies.

Key Requirements

• Cybersecurity program and policy: based on a periodic risk assessment.
• Chief Information Security Officer: a qualified CISO must oversee the program and report to the board.
• Technical controls: multi-factor authentication, encryption of nonpublic information, access privilege management, and vulnerability management.
• Monitoring and testing: including penetration testing and, for larger firms, more frequent assessments.
• Incident reporting: notify NYDFS of qualifying cybersecurity events, generally within 72 hours, and report ransomware payments.
• Governance: annual certification of compliance by a senior officer.

Penalties for Non-Compliance

NYDFS can bring enforcement actions and impose substantial monetary penalties for violations, and has done so in cases involving inadequate controls and unreported incidents. Penalties can be assessed per violation, which can compound quickly. Beyond fines, enforcement brings consent orders with mandated remediation and significant reputational consequences in the financial sector.

How to Comply

• Conduct a documented risk assessment and build a cybersecurity program and policies on it.
• Appoint a qualified CISO with board-level reporting.
• Implement required technical controls, especially multi-factor authentication and encryption of nonpublic information.
• Establish a 72-hour incident-reporting process to NYDFS.
• Run periodic penetration testing and vulnerability assessments.
• Prepare for the annual senior-officer certification with evidence of control effectiveness.

Mapping Part 500 to a framework such as the NIST Cybersecurity Framework helps satisfy both the regulation and broader security goals.

The 2023 Amendments and Class A Companies

The 2023 amendments meaningfully raised the bar, introducing the "Class A" category for the largest covered entities and imposing tougher requirements such as independent audits, enhanced privileged-access controls, and endpoint detection and response. They also strengthened governance, requiring deeper board engagement and expanded CISO reporting, and added explicit obligations around asset inventories and expanded multi-factor authentication. New notification duties cover ransomware deployments and extortion payments. For covered entities, the practical effect is that Part 500 has moved from a baseline toward a detailed, prescriptive program, and larger firms in particular must demonstrate mature, independently verified controls rather than self-asserted compliance.