What Is the NYDFS Cybersecurity Regulation (23 NYCRR 500)?

The NYDFS cybersecurity regulation, codified at 23 NYCRR Part 500, is a mandatory set of security rules that applies to banks, insurers, and other financial firms licensed by the New York Department of Financial Services. It requires each covered firm to run a written cybersecurity program, put a chief information security officer in charge of it, encrypt sensitive data, use multi-factor authentication, report serious incidents within 72 hours, and file an annual compliance certification by April 15. The rule was first adopted in March 2017 and significantly expanded by amendments effective November 2023.¹

Who Has to Comply

The regulation reaches any person or organization operating under a license, registration, charter, or similar authorization from the NYDFS under the Banking Law, Insurance Law, or Financial Services Law.¹ That sweeps in state-chartered banks, licensed lenders, insurance companies, mortgage brokers, money transmitters, check cashers, and the New York branches of foreign banks.

Compliance stays with the licensed entity. If a third-party service provider handles data on the firm’s behalf, the firm is still responsible for making sure that provider meets appropriate security standards. Some smaller firms qualify for a limited exemption, discussed further down, but even those firms owe a baseline set of duties.

What Data the Rule Protects

Part 500 is built around protecting “nonpublic information,” which falls into three categories:²

Sensitive business information whose unauthorized disclosure, tampering, or misuse would materially harm the company’s operations or security.
Personal identifiers combined with financial data, such as a name tied to a Social Security number, driver’s license number, account or card number, access code, or biometric record.
Health-related information created by or derived from a healthcare provider about an individual’s physical, mental, or behavioral health, treatment, or payment for treatment, excluding only age and gender.

Information lawfully available to the general public through government records, widely distributed media, or legally required disclosures is not nonpublic. Everything else that fits one of the three categories is in scope.

The Core Program You Must Build

Every covered entity must maintain a cybersecurity program designed to protect the confidentiality, integrity, and availability of its information systems and nonpublic information. Three pieces hold that program together: a designated leader, a written policy, and ongoing risk assessments.

Chief Information Security Officer

Each covered entity must designate a CISO to oversee and implement the program. The CISO does not have to be a direct employee; the role can sit with an affiliate or a third-party provider. When it’s outsourced, the firm must assign a senior internal staff member to direct that provider, and the firm itself remains on the hook for compliance.³

The CISO must report material cybersecurity issues to the firm’s senior governing body (typically the board) in a timely manner, and that body is expected to have enough understanding of cybersecurity risk to exercise meaningful oversight.³

Written Cybersecurity Policy

The program must be anchored by a written policy, or set of policies, addressing at least 15 subject areas including information security, data governance, access controls, business continuity, vendor management, incident response, vulnerability management, and customer data privacy.⁴ This document is what examiners will measure the firm against.

Risk Assessment

Risk assessments drive the rest of the program. Each firm must evaluate its information systems, the nonpublic information it holds, the threats it faces, and the effectiveness of existing controls. The assessment has to be updated at least annually and whenever a business or technology change materially shifts the firm’s risk profile.⁵ Encryption decisions, access controls, and testing frequency all tie back to what the assessment reveals.

Technical Controls

Encryption

Covered entities must use controls, including encryption, to protect nonpublic information both in transit over external networks and at rest. If encryption is not feasible for a particular system, the CISO can approve alternative compensating controls in writing, but the feasibility of switching to encryption has to be reassessed at least annually.²

Multi-Factor Authentication

For most covered entities, MFA is required for any individual accessing the firm’s information systems. Firms that qualify for the limited exemption still must use MFA for remote access to their systems, remote access to cloud-based applications containing nonpublic information, and all privileged accounts other than non-interactive service accounts.⁶ The CISO may approve reasonably equivalent or more secure compensating controls, documented and reviewed annually.

Access Privileges

Access must follow the principle of least privilege. Firms must limit each user’s access to what the job requires, restrict the number and scope of privileged accounts, review all access privileges at least once a year, and promptly terminate access when an employee or contractor leaves. Remote-control protocols must be disabled or securely configured.⁷

Testing, Training, and Retention

Penetration testing is required at least annually, from inside and outside the network boundary, by qualified internal staff or an external firm. Automated vulnerability scans, plus manual review of systems the scans miss, run on a cadence set by the risk assessment and after any material system change.⁸ Discovered vulnerabilities must be analyzed, prioritized, and remediated, not simply logged.

All personnel must receive cybersecurity awareness training covering social engineering at least once a year.¹ Dedicated cybersecurity staff need ongoing updates sufficient to address the firm’s specific risks, and key personnel are expected to stay current on evolving threats and countermeasures.

On data retention, firms must have policies for periodically destroying nonpublic personal and health information no longer needed for business operations, with exceptions when another law requires retention or targeted disposal is not reasonably feasible.² Audit trail records must be kept at least five years, and records of cybersecurity events at least three.

Incident Response and the 72-Hour Clock

Every covered entity needs an incident response plan built for prompt reaction to and recovery from events that materially affect data confidentiality, system integrity, or business operations. The plan must define roles, decision-making authority, internal and external communication, root-cause analysis, and recovery-from-backup procedures, and it must specifically address ransomware scenarios. A separate business continuity and disaster recovery plan has to identify essential personnel, data, and infrastructure, establish backup procedures, and lay out how operations resume after a cybersecurity-related disruption.⁹

When a cybersecurity incident occurs, the firm must notify the DFS Superintendent electronically as soon as possible, and no later than 72 hours after determining the incident has happened. A reportable incident is one that triggers any of three conditions: it requires the firm to notify a government body or regulatory agency, it has a reasonable likelihood of materially harming the firm’s normal operations, or it involves ransomware deployed within a material part of the firm’s systems.¹⁰

Ransomware payments carry their own clock. If a covered entity makes an extortion payment connected to a cybersecurity event, it must notify the Superintendent within 24 hours of the payment. Within 30 days, the firm must also submit a written explanation of why the payment was necessary, what alternatives were considered, what due diligence was performed, and how the payment complied with applicable rules, including OFAC sanctions requirements.¹⁰

The April 15 Annual Certification

By April 15 each year, every covered entity must file either a written certification that it materially complied with the regulation during the prior calendar year, or a written acknowledgment that it did not, identifying the areas of noncompliance.¹¹ The filing must be signed by the firm’s highest-ranking executive and its CISO. If there is no CISO, the senior officer responsible for the cybersecurity program signs instead.¹⁰ Supporting records must be kept five years in case the DFS examines them.²

The dual-signature structure puts the business leader and the security leader on record together, creating personal accountability for the certification.

Smaller-Firm Exemption

Not every covered entity faces the full regulation. A firm qualifies for a limited exemption if it meets any one of three size thresholds, counting the firm and its affiliates:¹²

Fewer than 20 employees and independent contractors.
Less than $7,500,000 in gross annual revenue in each of the last three fiscal years from all business operations of the firm and its New York affiliates.
Less than $15,000,000 in year-end total assets, calculated under GAAP, including affiliate assets.

Qualifying firms are excused from requirements such as appointing a CISO, conducting penetration testing, maintaining detailed audit trails, and running a full incident response plan. They still owe the core duties, including MFA for remote access and privileged accounts, annual cybersecurity awareness training, and the regulation’s reporting and certification requirements. To claim the exemption, the firm files a Notice of Exemption electronically through the DFS portal within 30 days of determining it qualifies.¹²

Class A Company Add-Ons

At the other end, the 2023 amendments created a “Class A company” tier. A firm is Class A if it generated at least $20,000,000 in gross annual revenue in each of the last two fiscal years (firm plus New York affiliates) and also meets one of two further tests: more than 2,000 employees averaged over the last two fiscal years across the firm and all affiliates regardless of location, or more than $1,000,000,000 in gross annual revenue across the firm and all affiliates.¹³

Class A companies carry three additional obligations: an independent audit of the cybersecurity program based on the risk assessment; a privileged access management solution combined with an automated method of blocking commonly used passwords, plus monitoring of privileged access activity; and an endpoint detection and response solution along with a centralized logging and security event alerting solution. The CISO may approve written compensating controls for the endpoint and password-blocking requirements, reviewed annually.

Penalties for Noncompliance

The DFS enforces Part 500 under the Banking Law, Insurance Law, and Financial Services Law, and the Superintendent has broad discretion in setting penalties. The regulation lists 16 factors the department weighs, including the severity and duration of the violation, whether it was intentional, consumer harm, cooperation with investigators, and whether the firm’s policies aligned with recognized frameworks such as NIST.¹⁴

Settlements have been substantial. OneMain Financial paid $4.25 million in 2023 to resolve allegations of cybersecurity failures, and EyeMed settled for $4.5 million in 2022 following an email data breach. The Superintendent can also pursue license suspension or revocation, and individuals who knowingly certify false compliance statements face personal exposure.

One boundary worth noting: the regulation does not create a private right of action. Individuals cannot sue a company directly for a Part 500 violation. Noncompliance can still surface as evidence of negligence in separate litigation stemming from a breach.

2023 Amendments: All Phases Now in Effect

The November 2023 overhaul introduced the Class A tier, expanded MFA, added the ransomware notification rules, and strengthened board-level governance. The new requirements phased in on this schedule:¹

December 1, 2023: updated reporting requirements, including the 24-hour ransomware payment notification.
April 29, 2024: most new requirements, including enhanced governance and CISO reporting.
November 1, 2024: MFA and annual awareness training extended to limited-exemption firms.
May 1, 2025: privileged account restrictions, secure remote-control configurations, prompt access termination on departure, and written password policies meeting industry standards.
November 1, 2025: asset management requirements under Section 500.13.

All phases are now live, and the DFS expects full compliance rather than aspirational roadmaps.

1
Department of Financial Services. Cybersecurity Resource Center
2
New York State Department of Financial Services. 23 NYCRR 500 Cybersecurity Requirements for Financial Services Companies
3
Legal Information Institute. New York Code 23 NYCRR 500.4 – Cybersecurity Governance
4
New York Codes, Rules and Regulations. 23 CRR-NY 500.3 – Cybersecurity Policy
5
Legal Information Institute. New York Code 23 NYCRR 500.9 – Risk Assessment
6
New York Codes, Rules and Regulations. 23 CRR-NY 500.12 – Multi-Factor Authentication
7
Legal Information Institute. New York Code 23 NYCRR 500.7 – Access Privileges and Management
8
New York Codes, Rules and Regulations. 23 CRR-NY 500.5 – Vulnerability Management
9
Legal Information Institute. New York Code 23 NYCRR 500.16 – Incident Response and Business Continuity Management
10
Legal Information Institute. New York Code 23 NYCRR 500.17 – Notices to Superintendent
11
Department of Financial Services. Instructions on How to File Certification of Compliance
12
Legal Information Institute. New York Code 23 NYCRR 500.19 – Exemptions
13
Legal Information Institute. New York Code 23 NYCRR 500.1 – Definitions
14
Legal Information Institute. New York Code 23 NYCRR 500.20 – Enforcement