What it is
23 NYCRR Part 500 is the New York Department of Financial Services (NYDFS) cybersecurity regulation, originally effective March 1, 2017 and substantially amended November 1, 2023 (Second Amendment). It applies to any person or entity operating under a license, registration, charter, certificate, permit, accreditation, or similar authorization from NYDFS, including banks, insurance companies, mortgage brokers, virtual currency businesses, and consumer lenders.
Who it applies to
Covered entities as defined in section 500.1(e). Owner-run firms may qualify for limited exemptions under section 500.19 (fewer than 20 employees, less than $7.5M revenue, less than $15M in assets), but even exempted entities must implement core security requirements.
Class A Companies (added in the 2023 amendment), entities with over $20M in NY revenue over the past three fiscal years and either 2,000+ employees or over $1B in revenue, face heightened requirements including endpoint detection and response, independent audits, and privileged access management controls.
Key provisions
Key cybersecurity program requirements
- Written cybersecurity program (section 500.2) based on a risk assessment (section 500.9)
- Written cybersecurity policy approved annually by the senior governing body (section 500.3)
- CISO designation (section 500.4) with annual written report to the senior governing body
- Penetration testing (annual) and vulnerability assessments (bi-monthly)
- Multi-factor authentication for all remote access and privileged accounts
- Encryption of nonpublic information in transit and at rest
- Written incident response plan including business continuity and disaster recovery
- Training and monitoringannual cybersecurity awareness training; monitoring authorized users
- Third-party service provider security policy (section 500.11)
Cybersecurity event notification
Section 500.17 requires notification to the Superintendent within 72 hours from determination that a cybersecurity event has occurred if either:
- Notice is required to be provided to any government body, self-regulatory agency, or supervisory body, OR
- There is a reasonable likelihood of materially harming any material part of the normal operations of the covered entity, OR
- (Second Amendment addition) A cybersecurity event involves ransomware payment or an extortion payment was made
Ransomware payments require 24-hour separate notice of the payment (section 500.17(c)).
Annual compliance certification
Section 500.17(b) requires covered entities to file an annual Notice of Compliance or Notice of Acknowledgment of Non-Compliance by April 15 for the prior calendar year. Filing a false certification can support enforcement action.
Penalties
NYDFS enforcement powers include monetary penalties, license revocation, and consent orders. Notable enforcement includes First American Title Insurance ($1M, 2023), OneMain Financial ($4.5M, 2023), Genesis Global Trading ($8M, 2023) NYDFS pursues violations of Part 500 as violations of the underlying Banking Law, Insurance Law, or Financial Services Law with corresponding penalty schedules.
Recent amendments
- Nov 2023Status under review
Second Amendment effective, introduced Class A Company category, ransomware payment reporting, enhanced governance requirements, phased through November 2025. - May 2024Phased Second Amendment provisions effective, incident response and business continuity plans, encryption controls.
- Nov 2024Additional Second Amendment provisions, automated blocking of commonly used passwords, additional risk assessments.
- Nov 2025Status under review
Final Second Amendment provisions effective, asset inventory, additional access privilege controls.
How LeakTrace maps to it
An External Cybersecurity Assessment reads what a firm exposes from outside: email settings, the firm’s addresses in monitored breach databases, lookalike domains, exposed services and keys left in the firm's own website code. The Rules and Insurance Briefing that comes with it maps each finding to NYDFS Part 500, with the proof behind it, so the firm can see which obligation a finding touches. The assessment is human-verified before it is released.
- 23 NYCRR Part 500, Cybersecurity Requirements for Financial Services Companies, authoritative text (www.dfs.ny.gov/industry_guidance/cybersecurity)