The NYDFS Cybersecurity Regulation, codified at 23 NYCRR Part 500, is New York’s mandatory cybersecurity rule for financial companies licensed by the state’s Department of Financial Services. It requires every covered entity to run a written cybersecurity program, meet specific technical and governance standards, report incidents on tight deadlines, and certify compliance to the Superintendent each year. The rule took effect in March 2017 and was significantly expanded by amendments adopted November 1, 2023, which added company tiers, new technical requirements, and sharper enforcement tools.1Department of Financial Services. Cybersecurity Resource Center
Who the Rule Covers
The regulation applies to any person or company operating under a license, registration, charter, certificate, or similar authorization under New York’s Banking Law, Insurance Law, or Financial Services Law.2Cornell Law Institute. 23 NYCRR 500.1 – Definitions That pulls in state-chartered banks, trust companies, insurance carriers, mortgage brokers, money transmitters, and licensed lenders. Federal regulation elsewhere does not get you out from under it. If DFS has jurisdiction over your license, Part 500 applies.
Who Qualifies for a Limited Exemption
Section 500.19 carves out a limited exemption for smaller organizations that meet any one of these thresholds:3Legal Information Institute. 23 NYCRR 500.19 – Exemptions
- Fewer than 20 employees and independent contractors across the entity and all its affiliates
- Less than $7.5 million in gross annual revenue in each of the last three fiscal years, counting the entity’s total operations and its affiliates’ New York operations
- Less than $15 million in year-end total assets under GAAP, including affiliates
Qualifying is not a free pass. Limited-exempt entities are excused from the CISO designation, penetration testing, audit trails, application security, dedicated staffing, parts of the training requirement, encryption, and incident response plans. They still must maintain a cybersecurity program, a written cybersecurity policy, access controls, and risk assessments.3Legal Information Institute. 23 NYCRR 500.19 – Exemptions Any entity claiming an exemption must file a Notice of Exemption electronically through the DFS portal within 30 days of determining it qualifies.
Class A Companies
The 2023 amendments added a higher tier called “Class A company” for larger, more complex organizations. You are Class A if your entity and its New York-based affiliates generated at least $20 million in gross annual revenue in each of the last two fiscal years and you also meet one of these conditions:
- More than 2,000 employees averaged over the last two fiscal years across the entity and all affiliates, regardless of location
- More than $1 billion in gross annual revenue in each of the last two fiscal years across the entity and all affiliates
Only affiliates that share information systems, cybersecurity resources, or any part of a cybersecurity program with the covered entity count toward these calculations.4New York Codes, Rules and Regulations. 23 NYCRR 500.1 – Definitions Class A companies face added obligations beyond the standard baseline, including independent audits of their cybersecurity program and enhanced governance requirements.
The Cybersecurity Program and Written Policy
Every covered entity must maintain a cybersecurity program designed to protect the confidentiality, integrity, and availability of its information systems and the nonpublic information stored on them. The program must be grounded in the entity’s own risk assessment.5Legal Information Institute. 23 NYCRR 500.2 – Cybersecurity Program
Backing the program, each entity must adopt a written cybersecurity policy covering data governance, asset management, business continuity, and system protection. The policy needs at least annual approval from a senior officer or the entity’s senior governing body.6Cornell Law Institute. 23 NYCRR 500.3 – Cybersecurity Policy
CISO and Qualified Personnel
Each covered entity must designate a qualified Chief Information Security Officer to oversee the cybersecurity program. The CISO must report in writing at least annually to the senior governing body, covering current risks, control effectiveness, material cybersecurity events, and remediation plans.7Cornell Law Institute. 23 NYCRR 500.4 – Cybersecurity Governance The CISO does not have to be an in-house employee. The role can be filled through a third-party service provider or affiliate, as long as the entity retains ultimate responsibility.
Beyond the CISO, each entity must employ or contract qualified cybersecurity personnel sufficient to manage its risks, and those personnel must receive ongoing training on evolving threats.8Legal Information Institute. 23 NYCRR 500.10 – Cybersecurity Personnel and Intelligence
Technical Controls You Must Have in Place
Multi-Factor Authentication
For standard covered entities, MFA is required for any individual accessing any of the entity’s information systems. Limited-exempt entities face a narrower requirement: MFA for remote access to systems, remote access to cloud-based applications containing nonpublic information, and all privileged accounts other than non-interactive service accounts.9Legal Information Institute. 23 NYCRR 500.12 – Multi-Factor Authentication
Encryption
Each entity must have a written encryption policy requiring industry-standard encryption to protect nonpublic information both at rest and in transit over external networks.10Cornell Law School. 23 NYCRR 500.15 – Encryption of Nonpublic Information Internal network transmissions are not explicitly covered by the encryption mandate, though a risk assessment may still call for it.
Access Privileges
User access must be limited to the systems and data necessary for the person’s job. Privileged accounts get the same treatment: both the number of privileged accounts and the functions available to them must be restricted to what’s actually needed.11Legal Information Institute. 23 NYCRR 500.7 – Access Privileges and Management Permissions that accumulate as employees change roles are a common examination finding.
Asset Inventory
Each entity must maintain complete and accurate documentation of its information systems, tracking the owner, location, classification, support expiration date, and recovery time objectives for each asset. The inventory must be validated and updated on a schedule defined in written policies.12Legal Information Institute. 23 NYCRR 500.13 – Asset Management and Data Retention
Testing, Monitoring, and Training
Each covered entity must conduct penetration testing of its information systems at least annually, from both inside and outside the system boundaries. Separately, entities must run automated vulnerability scans and manually review systems not covered by those scans. Scanning frequency is set by the entity’s risk assessment and must happen promptly after any material system changes.13New York Codes, Rules and Regulations. 23 NYCRR 500.5 – Vulnerability Management
Audit trail requirements split by purpose. Records designed to reconstruct material financial transactions must be kept for at least five years. Audit trails designed to detect and respond to cybersecurity events that could materially harm operations must be kept for at least three years.14New York Codes, Rules and Regulations. 23 NYCRR 500.6 – Audit Trail
Risk assessments must be reviewed and updated at least annually or whenever a business or technology change materially alters the entity’s cyber risk. The assessment must account for the entity’s specific operations, the types of nonpublic information it collects, the systems it uses, and the effectiveness of its current controls.15Cornell Law Institute. 23 NYCRR 500.9 – Risk Assessment
All personnel must receive cybersecurity awareness training at least annually. The training must cover social engineering and reflect risks identified in the most recent risk assessment.16Legal Information Institute. 23 NYCRR 500.14 – Monitoring and Training Everyone is in scope, not just IT staff.
Third-Party Service Providers
Outsourcing a function does not outsource the obligation. Each covered entity must implement written policies and procedures to protect information systems and nonpublic information that are accessible to or held by third-party service providers. Those policies must cover identifying and assessing each provider’s risk, setting minimum cybersecurity standards providers must meet, conducting due diligence, and periodically reassessing providers as risks change.17Legal Information Institute. 23 NYCRR 500.11 – Third-Party Service Provider Security Policy
Contractual protections or due diligence guidelines must address the provider’s access controls and MFA practices, its use of encryption for data in transit and at rest, its obligation to notify the entity of any cybersecurity event affecting the entity’s systems or data, and representations about its overall cybersecurity posture.
Incident Response and Reporting Deadlines
Every covered entity must maintain a written incident response plan designed for rapid response to and recovery from any cybersecurity event that materially affects its systems or operations. The plan must define roles and decision-making authority, address internal and external communications, document remediation, and include a process for revising the plan after an actual event.18New York State Department of Financial Services. 23 NYCRR 500 Cybersecurity Requirements for Financial Services Companies
When a cybersecurity incident occurs, the covered entity must notify the Superintendent of Financial Services electronically within 72 hours of determining the event took place. The duty applies whether the incident occurred at the entity, at an affiliate, or at a third-party service provider.19Legal Information Institute. 23 NYCRR 500.17 – Notices to Superintendent The clock starts when the entity determines an incident has occurred, not when it first detects anomalous activity.
The 2023 amendments added a separate reporting obligation for extortion payments. If a covered entity makes a ransomware or other extortion payment, it must notify the Superintendent within 24 hours of the payment. Within 30 days after the payment, the entity must submit a written description explaining why the payment was necessary, what alternatives were considered, what diligence was performed to find alternatives, and what steps were taken to ensure the payment complied with applicable rules, including those of the Office of Foreign Assets Control.19Legal Information Institute. 23 NYCRR 500.17 – Notices to Superintendent
Annual Compliance Filing
By April 15 each year, every covered entity must submit one of two filings electronically to the Superintendent. The first is a certification of material compliance confirming the entity met all applicable requirements during the prior calendar year, supported by sufficient documentation. The second, added by the 2023 amendments, is a written acknowledgment of noncompliance identifying every section the entity failed to meet, the nature of each gap, and a remediation timeline or confirmation that remediation is complete.19Legal Information Institute. 23 NYCRR 500.17 – Notices to Superintendent
Whichever filing goes in, both the entity’s highest-ranking executive and its CISO must sign it. Personal accountability sits with the people who can direct cybersecurity resources.
Penalties for Noncompliance
The Superintendent enforces the regulation under the Banking Law, Insurance Law, and Financial Services Law. The amended Section 500.20 states that a single failure to comply with any provision for any 24-hour period counts as a separate violation, and unauthorized access to nonpublic information caused by noncompliance is itself a violation.20Legal Information Institute. 23 NYCRR 500.20 – Enforcement Penalties accumulate day by day, which is how a modest technical gap can grow into a serious fine.
Enforcement is active. As of late 2025, DFS under Superintendent Harris had entered into consent orders with 27 entities for cybersecurity regulation violations, producing over $144 million in total fines. Individual penalties in a single batch of auto insurance enforcement actions ran from $1.85 million to $3 million per company.21Department of Financial Services. Superintendent Harris Secures More Than $19 Million from Auto Insurance Companies Consent orders routinely include mandated remediation plans supervised by DFS, and persistent noncompliance can lead to license revocation.