Every covered entity under 23 NYCRR Part 500 must tell the New York Department of Financial Services by 15 April whether it materially complied with the regulation in the previous calendar year, and two named executives sign that statement personally. This template turns the annual notice in section 500.17(b) into a repeatable workflow: scoping, owners, evidence collection, the materiality call, sign-off, filing and record keeping. It is written for CISOs, compliance leads and internal audit teams at banks, insurers, money transmitters and other DFS licensees. It assumes you already know the regulation; for the full control set see the NYDFS Part 500 Guide. Status checked against the DFS published text of Part 500 and the DFS submissions and FAQ pages on 27 October 2026. This template is not legal advice.
How to use this template
- Replace the placeholders: [Organisation], [CISO], [Highest-Ranking Executive], [Evidence Repository] and the dates in square brackets.
- Start in the autumn, not in April: the certification covers the whole prior calendar year, so evidence gaps found in March are already gaps in the year being certified.
- Keep the numbered sections: each one produces evidence you will retain for five years under 500.17(b)(3).
- Decide the form last: whether you file a Certification of Material Compliance or an Acknowledgment of Noncompliance is the output of section 5, not an assumption made at the start.
- Use it with your exemption status: entities with a limited exemption under 500.19(a), (c) or (d) still file, but certify only the sections that apply to them. Entities with a full exemption under 500.19(b), (e) or (g) do not file an annual notice.
1. Scope and triggers
[Organisation] files one annual compliance notification for each covered entity licensed by DFS, by 15 April [Year], covering 1 January to 31 December [Prior Year].
| Scoping question | Where the answer comes from | Record |
|---|---|---|
| Which legal entities hold a DFS licence, registration or charter? | Licensing and legal entity register | Entity list with DFS licence, NAIC, NMLS or institution number |
| Is each entity a Class A company? | 500.1: at least $20 million gross annual revenue in each of the last two fiscal years, plus over 2,000 employees averaged over two years or over $1 billion gross annual revenue in each of those years (check the full 500.1 definition for how affiliates count) | Finance sign-off on revenue and headcount |
| Does a limited exemption apply? | 500.19(a): fewer than 20 employees and independent contractors, under $7.5 million gross annual revenue over three years, or under $15 million year-end total assets | Notice of Exemption on file and the list of sections that still apply |
| Is the programme run by an affiliate or parent? | Group security operating model | Evidence the adopted programme meets every applicable section for this entity |
| Were there in-year changes? | M&A, new systems, outsourcing, loss of exemption (500.19(h) gives 180 days to comply) | Change log reviewed by the CISO |
2. Roles and contacts
| Role | Named person | Responsibility in the certification |
|---|---|---|
| Highest-ranking executive | [Name] | Co-signs the filing; confirms resources and accountability |
| CISO (500.1 "qualified individual") | [Name] | Co-signs; owns the evidence pack and the materiality assessment. If there is no CISO, the senior officer responsible for the cybersecurity programme signs |
| Senior governing body | [Board or committee] | Receives the CISO's annual written report under 500.4(b) and exercises oversight under 500.4(d) |
| Certification coordinator | [Name] | Runs the calendar, tracks evidence requests, files on the DFS Portal |
| Control owners | [Names per section] | Provide dated evidence for their sections |
| Internal audit / independent auditor | [Name] | Tests evidence; for Class A, the independent audit required by 500.2(c) |
| Legal and compliance | [Name] | Reviews wording of any Acknowledgment of Noncompliance |
A CISO employed by an affiliate or a third-party service provider may sign, according to the DFS FAQs, but the covered entity keeps responsibility for compliance and must designate a senior member of its own staff to oversee that CISO. The person who signs as CISO does not need that exact job title if they are the qualified individual responsible for the programme.
3. Detection and triage: find the gaps
Walk every applicable section and collect dated evidence that the requirement operated throughout the year. Use the table as the master evidence register in [Evidence Repository].
| Section | Requirement to evidence | Typical evidence |
|---|---|---|
| 500.2, 500.3 | Risk-based programme and board-approved policies reviewed at least annually | Policy set with approval minutes and review dates |
| 500.4 | CISO written report to the senior governing body at least annually; board oversight | Report, minutes showing review, resource decisions |
| 500.5 | Penetration testing from inside and outside at least annually by a qualified party; automated scans; risk-prioritised remediation | Test report, scan schedule, remediation SLA metrics |
| 500.6 | Audit trails: financial transaction records five years, cybersecurity event records three years | Log retention configuration and sample retrieval |
| 500.7 | Least privilege, limited privileged accounts, user access review at least annually, prompt termination; Class A: privileged access monitoring, a PAM solution, blocking common passwords | Access review sign-offs, leaver reports, PAM coverage report |
| 500.8 | Application security procedures for in-house and external applications | Secure development standard, review records |
| 500.9 | Risk assessment reviewed and updated at least annually and on material change | Dated risk assessment and change triggers |
| 500.10 | Qualified cybersecurity personnel and threat intelligence | Staffing plan, training records |
| 500.11 | Third-party service provider policy: assessment, minimum practices, due diligence, periodic reassessment, contract terms on access, MFA, encryption and incident notice | Vendor inventory, assessments, contract clause review |
| 500.12 | MFA for any individual accessing information systems (in force from 1 November 2025) | MFA coverage report, CISO-approved compensating controls reviewed annually |
| 500.13 | Asset inventory with owner, location, classification, support expiry and recovery time objective (from 1 November 2025); secure disposal of nonpublic information | Inventory extract, validation records, disposal logs |
| 500.14 | User activity monitoring, malicious code protection, annual awareness training including social engineering; Class A: EDR and centralised logging | Training completion, EDR coverage, SIEM coverage |
| 500.15 | Encryption of nonpublic information in transit over external networks and at rest, or CISO-approved compensating controls | Encryption standard, exceptions register |
| 500.16 | Incident response and BCDR plans, tested at least annually; backup restore tested at least annually; backups protected | Exercise reports, restore test results |
| 500.17(a), (c) | 72-hour incident notice; 24-hour and 30-day extortion payment notices | Incident log showing each notification decision |
Where identity evidence usually breaks
- Service accounts and API keys: 500.7 limits privileged accounts and their functions, and the annual access review should include non-human accounts with owners. The 500.12 limited-exemption wording carves out only service accounts that prohibit interactive login, so document which accounts rely on that and why. See the Service Account Security Guide.
- Third-party access: vendor accounts are where MFA and termination evidence is weakest. See the Third-Party Access Guide.
- PAM coverage (Class A): report the share of privileged accounts, human and machine, under the PAM solution, not just the number of vaulted passwords.
4. Containment: handle gaps found mid-cycle
- Log each gap in the certification register with section, entity, start date, end date or "open", and affected systems.
- Assign a remediation owner and target date the same week.
- Where a control cannot be fixed quickly, record any interim compensating control and, for 500.12 or 500.15, whether the CISO approved it in writing.
- Check whether the gap also caused a cybersecurity incident that needed a 72-hour notice under 500.17(a). A missed notice is a separate problem from the annual filing.
5. Eradication: make the materiality decision
A Certification of Material Compliance may only be filed if the entity materially complied with every applicable section during the prior calendar year. The DFS FAQs say the entity must judge materiality from its industry, size, data and the nature, duration, scope and impact of the noncompliance. They give failing to conduct a risk assessment and failing to secure third-party provider systems as examples of material noncompliance, and say a brief minor lapse is not likely to be material, while several immaterial violations together might be.
| Gap | Duration | Scope and impact | Material? (rationale) | Decision owner |
|---|---|---|---|---|
| [e.g. MFA missing on legacy VPN] | [dates] | [users, data reachable] | [Yes/No, why] | [CISO] |
| [e.g. annual access review late for one application] | [dates] | [accounts affected] | [Yes/No, why] | [CISO] |
Keep this table: DFS says entities must retain documentation of why they chose a particular filing type. When in doubt, the honest filing is the Acknowledgment of Noncompliance, which must identify each section not complied with, describe the nature and extent of the noncompliance, and give a remediation timeline or confirm that remediation is complete.
6. Recovery: sign-off and filing
- [1 March] Evidence register closed; materiality table drafted.
- [15 March] Internal audit or second line challenge session on the materiality table.
- [25 March] CISO and highest-ranking executive briefing; draft filing wording reviewed by legal.
- [1 April] Both signatories approve. Confirm both have DFS ID accounts with MFA set up on an authenticator app.
- [By 10 April] Submit on the DFS Portal (myportal.dfs.ny.gov), choosing either the Certification of Material Compliance or the Acknowledgment of Noncompliance. The filing window opens on 1 January.
- [Same day] Save the email with the receipt number, which DFS says is the only confirmation. If none arrives, email DFS with "Confirm My Submission" in the subject line and the licence or identification number.
Rollback: if a material gap is found after filing a certification, take legal advice promptly on correcting the filing. Do not wait for the next cycle.
7. Communication and notification
- Board: the senior governing body sees the materiality table and the final filing before submission, alongside the CISO's 500.4(b) report.
- Affiliates: where a group programme is used, share the entity-level evidence and gaps with each entity's signatories, since each signs for its own entity.
- Third parties: request attestation or evidence from providers early (January), because 500.11 evidence depends on them.
- Separate duties: the 72-hour incident notice and the extortion payment notices in 500.17(a) and (c) are filed as events happen, not with the annual notice. See the Cyber Incident Reporting Requirements Map.
8. Post-incident review: after the filing
- Archive the evidence pack, materiality table, sign-off record and portal receipt in [Evidence Repository] for at least five years (500.17(b)(3)), ready to provide to DFS on request.
- Run a lessons-learned session in May: which evidence was late, which owners struggled, which controls need continuous monitoring rather than an annual scramble.
- Track remediation dates promised in any Acknowledgment of Noncompliance as board-level commitments.
- Re-scope for the coming year: Class A status, exemptions and new systems.
Implementation guidance
Why it matters: under 500.20, a single prohibited act or a material failure to comply for any 24-hour period with any section is a violation, and penalty factors listed in the regulation include cooperation, good faith, prior violations and whether policies are consistent with nationally recognised frameworks such as NIST. A certification signed without evidence turns a control gap into a statement problem for two named executives. See the CISO Personal Liability Guide.
| Measure | Target |
|---|---|
| Applicable sections with complete dated evidence by 1 March | 100% |
| Open gaps with owner and date | 100% |
| Privileged accounts (human and non-human) under PAM, Class A | Trend to 100% |
| MFA coverage of in-scope access paths | 100% or documented compensating control |
| Days between filing and window close | At least 5 |
Small entities: a limited-exemption licensee can run this as a one-day exercise, but should still keep the materiality rationale. Large groups: run one evidence register with entity tags, and map controls once to NIST CSF 2.0 Guide so the same evidence supports other regimes such as the GLBA Safeguards Rule Guide requirements.
Standards and references
- New York DFS: 23 NYCRR Part 500 Cybersecurity Requirements for Financial Services Companies
- New York DFS: Cybersecurity Regulation Submissions
- New York DFS: Cybersecurity Regulation FAQs
- New York DFS: Cybersecurity Resource Center
- New York DFS: Cybersecurity Regulation Exemptions
Related NHI Mgmt Group resources: NYDFS Part 500 Guide · Privileged Access Management Guide · Access Review Checklist · Board Cyber Risk Reporting Guide. This guide summarises the NYDFS Part 500 annual compliance notification and is not legal advice.