Since 1 November 2025 every phase of the amended NYDFS cybersecurity regulation is in force, so a covered entity with accounts lacking MFA, an incomplete asset inventory or an unreviewed privileged account is out of compliance now. 23 NYCRR Part 500 applies to banks, insurers, licensed lenders, money transmitters and other firms licensed by the New York State Department of Financial Services (DFS). The second amendment, effective 1 November 2023, added Class A duties, a 72-hour incident notice that reaches ransomware, a 24-hour notice for extortion payments, CISO reporting to the board and a stricter annual certification. This guide covers scope, the major sections, the phased dates, notification and certification, enforcement and a practical rollout, for CISOs, compliance officers and the identity and security engineers who produce the evidence.
Key takeaways
- All phases now apply. The last transitional periods ended on 1 November 2025, when universal MFA (500.12) and the asset inventory requirement (500.13(a)) took effect.
- Identity is the core of the amendment. Section 500.7 requires least privilege, an annual access review and prompt removal of leavers, and the definition of privileged account expressly includes service accounts.
- Class A companies carry extra duties. Independent audits, a privileged access management solution, automated blocking of common passwords, EDR and centralised logging apply only to the largest covered entities.
- Two clocks, two triggers. A cybersecurity incident must be reported within 72 hours of determination, and an extortion payment within 24 hours of payment, with a written justification within 30 days.
- The certification is a personal statement. By 15 April each year the highest-ranking executive and the CISO sign either a certification of material compliance or an acknowledgment of noncompliance, backed by five years of records.
Who Part 500 covers
A covered entity is any person "operating under or required to operate under a license, registration, charter" or similar authorisation under the New York Banking Law, Insurance Law or Financial Services Law, even if another regulator also supervises it. Covered entities fall into three practical tiers.
| Tier | Definition (500.1 and 500.19) | What changes |
|---|---|---|
| Class A company | At least $20 million gross annual revenue in each of the last two fiscal years, and either over 2,000 employees averaged over the last two fiscal years or over $1 billion gross annual revenue in each of them. Affiliates count only where they share information systems, cybersecurity resources or part of the programme. | Everything, plus independent audits (500.2(c)), privileged access monitoring, a PAM solution and common password blocking (500.7(c)), EDR and centralised logging and alerting (500.14(b)). |
| Standard covered entity | Neither Class A nor exempt. | All sections except the Class A extras. |
| Limited exemption (500.19(a)) | Fewer than 20 employees and independent contractors (including affiliates), or less than $7.5 million gross annual revenue in each of the last three fiscal years, or less than $15 million in year-end total assets. | Exempt from 500.4, 500.5, 500.6, 500.8, 500.10, 500.14(a)(1), (a)(2) and (b), 500.15 and 500.16. Risk assessment, policies, access privileges, MFA for remote and privileged access, asset inventory, TPSP policy, notices and certification still apply. A Notice of Exemption is filed within 30 days. |
DFS FAQs say affiliate staff count toward the exemption threshold "regardless of where any of the employees and independent contractors are located". Document the calculation each year, because crossing a threshold changes which sections apply.
Nonpublic information (NPI) has three limbs: business information whose compromise would materially harm the entity; personal identifiers combined with a Social Security number, driver's licence number, account or card number, access code or biometric record; and health information. A cybersecurity incident is an event at the entity, an affiliate or a third-party service provider that must be reported to another government or self-regulatory body, is reasonably likely to materially harm normal operations, or "results in the deployment of ransomware within a material part of the covered entity's information systems".
The second amendment and the compliance timeline
Section 500.21(b) made the second amendment effective on 1 November 2023, and 500.22 staggered the new duties. DFS publishes the calendar dates in its implementation timelines.
| Date | Sections | What took effect |
|---|---|---|
| 1 December 2023 | 500.17 | New notice duties, including ransomware deployment and extortion payments |
| 15 April 2024 | 500.17(b) | First certification or acknowledgment in the new form, for calendar year 2023 |
| 29 April 2024 | 500.2(c), 500.3, 500.5(a)(1), (b), (c), 500.9, 500.14(a)(3) | Class A independent audit, annual policy approval, annual penetration testing, risk assessment updates, social engineering training |
| 1 November 2024 | 500.4, 500.15, 500.16 | CISO reporting and board oversight, encryption policy, updated incident response and BCDR plans with testing |
| 1 May 2025 | 500.5(a)(2), 500.7, 500.14(a)(2) and (b) | Automated scanning, enhanced access privilege controls, malicious code controls, Class A EDR and centralised logging |
| 1 November 2025 | 500.12, 500.13(a) | MFA for any individual accessing any information system; written asset inventory policies |
The certification due on 15 April 2027 covers calendar year 2026, the first full year in which every phase applied.
Governance, risk assessment and policy
- Programme (500.2): based on the risk assessment and covering identify, protect, detect, respond, recover and regulatory reporting. Class A companies must also "design and conduct independent audits" of the programme.
- Policy (500.3): approved at least annually by a senior officer or the senior governing body, covering at least 15 areas, including access controls "including remote access and identity management", vendor management, incident response and vulnerability management.
- CISO reporting (500.4): the CISO must "report in writing at least annually to the senior governing body" on material risks, programme effectiveness, material events and plans for remediating material inadequacies, and escalate significant issues in a timely way. See the Board Cyber Risk Reporting Guide.
- Board oversight (500.4(d)): the senior governing body needs "sufficient understanding" of cyber matters, must require management to run the programme, review its reports and confirm "sufficient resources".
- Risk assessment (500.9): updated at least annually and on material business or technology change. Scan frequency and compensating controls refer back to it, so a stale assessment weakens everything else.
Access privileges and MFA: sections 500.7 and 500.12
Section 500.7 access privileges and management
- Least privilege: limit user access to what the job requires, limit privileged accounts and their functions, and use privileged accounts only when needed.
- Annual review: review access "at a minimum annually" and remove what is no longer necessary. See the Access Reviews Guide.
- Remote control protocols and leavers: disable or securely configure remote control protocols, and promptly terminate access on departure.
- Passwords: where used, a written password policy that meets industry standards (500.7(b)).
- Class A extras (500.7(c)): monitor privileged access activity, implement "a privileged access management solution" and "an automated method of blocking commonly used passwords", with written CISO-approved compensating controls only where blocking is infeasible. See the Privileged Access Management Guide.
Section 500.12 multi-factor authentication
From 1 November 2025, MFA applies to "any individual accessing any information systems of a covered entity", using at least two of knowledge, possession and inherence factors. Exempt entities must at minimum cover remote access, remote access to third-party applications (including cloud applications) holding NPI, and "all privileged accounts other than service accounts that prohibit interactive login". A CISO may approve "reasonably equivalent or more secure compensating controls" in writing, reviewed at least annually. DFS FAQs close three loopholes: two factors of the same type (password plus PIN) do not count, a "remember this device" cookie is not enough on its own, and "SSO alone does not meet the requirements of Section 500.12". See the MFA Guide and the Phishing-Resistant MFA Guide.
Where identity fits: service accounts
A privileged account is "any authorized user account or service account that can be used to perform security-relevant functions" that ordinary users cannot perform. Service accounts are therefore inside the 500.7 limits, the annual review and, for Class A, privileged access monitoring. The MFA carve-out covers only service accounts that prohibit interactive login, so one a person can sign in with needs MFA or a documented compensating control. That means an inventory with owners, interactive logon denied where not needed, credentials vaulted and rotated, and review evidence. See the Service Account Security Guide.
Technical controls examiners test
| Section | Requirement | Evidence to keep |
|---|---|---|
| 500.13 Asset inventory | Written policies for a documented inventory tracking owner, location, classification or sensitivity, support expiration date and recovery time objectives, with a set update and validation frequency; periodic secure disposal of NPI no longer needed | Inventory with all five fields, reconciliation records, disposal logs |
| 500.5 Vulnerability management | Penetration testing "at least annually" from inside and outside the system boundaries; automated scans plus manual review of systems scans miss, at a risk-based frequency and after material changes; risk-prioritised remediation | Test reports, scan coverage against the inventory, remediation ages |
| 500.6 Audit trail | Transaction reconstruction records kept at least five years; audit trails for detecting and responding to events kept at least three years | Retention settings, sample retrievals |
| 500.8 Application security | Secure development procedures and evaluation of external applications, reviewed at least annually | SDLC standard, review sign-off |
| 500.14 Monitoring and training | Malicious code controls; annual training including social engineering; Class A: "an endpoint detection and response solution" and "a solution that centralizes logging and security event alerting", or written CISO-approved equivalents | Training records, EDR coverage, log source list |
| 500.15 Encryption | Written policy for NPI in transit over external networks and at rest; compensating controls allowed only at rest, reviewed annually | TLS configuration, at-rest status, approvals |
| 500.16 Incident response and BCDR | Plans covering roles, communications, root cause and recovery; tested "at a minimum annually", including restores from backups that are protected from alteration | Exercise reports, restore test results |
The inventory is the denominator for scan, EDR and MFA coverage. See the Vulnerability Management Guide and the Penetration Testing Guide.
Third party service provider security policy (500.11)
A third-party service provider (TPSP) is a non-affiliate that provides services and maintains, processes or can access NPI. The written policy must cover identification and risk assessment of providers, minimum cybersecurity practices, due diligence and periodic reassessment. Contracts should address the provider's access controls including MFA, encryption in transit and at rest, notice of cybersecurity events that directly affect the covered entity, and cybersecurity representations and warranties. DFS FAQs say a covered entity must report a provider's incident "regardless of whether the Third-Party Service Provider notifies DFS as well". See the Third-Party Risk Management Guide.
Notifications and annual certification (500.17)
| Filing | Trigger | Deadline | Content |
|---|---|---|---|
| Incident notice (500.17(a)) | Determination that a cybersecurity incident occurred at the entity, an affiliate or a TPSP | No later than 72 hours after determination, electronically | The DFS form, then a continuing duty to update on material changes |
| Extortion payment notice (500.17(c)) | Any extortion payment linked to a cybersecurity event | Within 24 hours of payment | Notice of the payment |
| Extortion payment explanation (500.17(c)) | Same payment | Within 30 days | Why payment was necessary, alternatives considered, diligence performed, including OFAC compliance |
| Annual filing (500.17(b)) | Each calendar year | By 15 April, for the prior year | Certification of material compliance, or acknowledgment of noncompliance naming the sections, describing the gap and giving a remediation timeline; signed by the highest-ranking executive and the CISO; records kept five years |
The 72-hour clock runs from determination, so the incident response plan should name who makes that call and record when. An entity "may not submit a Certification of Material Compliance" unless it materially complied throughout the prior year, per DFS FAQs. See the Incident Response Guide.
Enforcement and penalties
Under 500.20 a violation includes "the material failure to comply for any 24-hour period with any section of this Part". Penalty factors include cooperation, good faith, intent, prior violations, consumer harm, timely disclosure, the board's involvement and alignment with "nationally recognized cybersecurity frameworks, such as NIST". Recent DFS settlements:
- Healthplex, $2 million (14 August 2025): a phishing email exposed an employee mailbox; the firm "did not have MFA controls set up on its Microsoft Outlook 365 email environment", had no email retention limit and "waited over four months, well beyond the 72-hour reporting requirement". It agreed to an independent audit of its MFA controls.
- Eight auto insurers, more than $19 million (14 October 2025): attackers took NPI including driver's licence numbers from "public-facing web applications and agent portals" used for quotes, after DFS warnings in 2021; two firms also reported late.
- Delta Dental, $2.25 million (30 April 2026): a MOVEit Transfer zero-day led to NPI theft; DFS cited inadequate incident response procedures and late reporting.
A phased approach to compliance
- Confirm the tier. Recalculate Class A and exemption tests, including affiliates that share systems, and file the result with the certification evidence.
- Build the inventory first. Populate the five 500.13 fields for every asset, including cloud and SaaS.
- Close MFA gaps by risk. Start with remote access, email, cloud applications holding NPI and privileged accounts. Pilot with IT staff, run conditional access policies in report-only mode first, keep two monitored break-glass accounts excluded, and roll back per policy rather than globally if sign-ins fail.
- Tackle privileged and service accounts. Remove standing privilege, deny interactive logon to service accounts, vault and rotate credentials, and for Class A monitor privileged sessions.
- Write down compensating controls. Every reliance on 500.7(c), 500.12, 500.14(b) or 500.15 compensating controls needs a written CISO approval with a review date within a year.
- Rehearse notification. Run a tabletop with a TPSP incident, ransomware and an extortion demand, timing the 72-hour and 24-hour decisions. See the Tabletop Exercise Guide.
- Assemble the certification pack through the year, mapping each section to an owner and evidence.
Decision guidance
- Implement or compensate: compensating controls are allowed for MFA, Class A password blocking, EDR and logging, and encryption at rest, never for encryption in transit over external networks. Use them for legacy systems with a retirement date, not as a permanent design.
- Certify or acknowledge: if a section was materially unmet for part of the year, file the acknowledgment with a remediation timeline; good faith and cooperation are mitigating factors.
- Small entities: relying on an affiliate's programme under 500.2(d) is often the efficient route, but the exempt-entity duties above still apply.
- Large groups: Class A status counts affiliates that share systems, so shared identity platforms can pull a whole group in. Plan PAM, EDR and logging at group level.
Measuring compliance
- MFA coverage: percentage of users and inventoried systems enforcing MFA, with every exception backed by a written approval.
- Privileged accounts: count of privileged human and service accounts, and percentage reviewed in the last 12 months.
- Leaver latency: median hours from termination to access removal.
- Inventory completeness: percentage of assets with all five 500.13 fields validated in the policy period.
- Critical vulnerability age: days open against risk-based targets.
- Notification readiness: time from detection to incident determination in exercises.
Framework mapping
| Part 500 section | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A | CIS Controls v8.1 |
|---|---|---|---|---|
| 500.4 Governance | GV.RR, GV.OV | PM-2, PM-9 | A.5.2, A.5.4 | n/a |
| 500.7 Access privileges | PR.AA-05 | AC-2, AC-6 | A.5.15, A.5.18, A.8.2 | 5, 6 |
| 500.12 MFA | PR.AA-03 | IA-2(1), IA-2(2) | A.8.5 | 6.3, 6.4, 6.5 |
| 500.13 Asset inventory | ID.AM-01, ID.AM-02 | CM-8 | A.5.9 | 1, 2 |
| 500.5 Vulnerability management | ID.RA-01 | RA-5, CA-8 | A.8.8 | 7, 18 |
| 500.11 TPSP policy | GV.SC | SA-9, SR-6 | A.5.19 to A.5.22 | 15 |
| 500.16 IR and BCDR | RS.MA, RC.RP | IR-4, CP-2, CP-9 | A.5.24 to A.5.26, A.5.30 | 11, 17 |
Since 500.20 weighs framework alignment, keep a mapping like this in the certification file. See the Global Cybersecurity Regulatory Map for Part 500 beside other regimes.
Common failure patterns
- MFA on the VPN but not on email or SaaS: the Healthplex case centred on an email platform without MFA, and the Change Healthcare breach shows the same gap on a remote access portal.
- Cloud applications left to the vendor: 500.12 reaches third-party cloud applications holding NPI, and the Snowflake breach showed what follows when customer tenants lack MFA.
- Service accounts outside the review: interactive, unowned, unrotated privileged service accounts fail 500.7 and the MFA carve-out.
- Determination delayed to stop the clock: long "under investigation" periods produced late notice findings in several settlements.
- Customer portals missing from the inventory: the auto insurer cases involved quote tools exposing driver's licence numbers.
Practitioner checklist
- Recalculate Class A and exemption status annually and record the inputs.
- Maintain an asset inventory with owner, location, classification, support expiration and RTO for every asset.
- Enforce MFA for every individual on every information system, with written CISO approval for each compensating control.
- Inventory privileged human and service accounts, deny interactive logon where not needed, and review all access at least annually.
- For Class A: deploy PAM with privileged activity monitoring, common password blocking, EDR and centralised logging, and commission the independent audit.
- Run annual penetration tests from inside and outside, and scan at the risk-assessed frequency.
- Build the 72-hour and 24-hour notice decisions, including TPSP incidents, into the incident response plan and test them yearly.
- Deliver the CISO's annual written report to the board with remediation plans.
- Build the 15 April certification pack through the year and keep it five years.
Standards and references
- NYDFS: 23 NYCRR Part 500, Cybersecurity Requirements for Financial Services Companies
- NYDFS: Cybersecurity Implementation Timeline for Class A Businesses
- NYDFS: Cybersecurity Resource Center FAQs
- NYDFS: Cybersecurity Resource Center
- NYDFS: $2 Million Cybersecurity Settlement with Healthplex, Inc.
- NYDFS: More than $19 Million from Auto Insurance Companies over Data Breaches
- NYDFS: $2.25 Million Cybersecurity Settlement with Delta Dental
Related NHI Mgmt Group resources: Financial Services Identity Security Guide · Global Cybersecurity Regulatory Map · Privileged Access Management Guide · Service Account Security Guide · DORA Guide. This guide summarises 23 NYCRR Part 500 as amended in November 2023, its phased compliance dates and DFS enforcement as of 18 October 2026, and is not legal advice.