NYDFS Part 500 in 2025 raises the bar for IAM and NHI control

At a glance

What this is: This is a compliance analysis of NYDFS Part 500 in 2025, focused on the move to universal MFA, complete asset management, and executive certification for covered financial institutions.

Why it matters: It matters because IAM and NHI teams now have to prove coverage, evidence, and accountability across every access path, not just implement controls in isolated systems.

By the numbers:

• November 1, 2025 is the final deadline for universal MFA and complete asset management under NYDFS Part 500.
• NYDFS has levied fines up to $30 million for cybersecurity compliance failures.
• The 2023 Second Amendment introduced personal liability for CEOs and CISOs through dual-signature certification requirements.

Context

NYDFS Part 500 has moved from a risk-based cybersecurity framework to a prescriptive control regime with hard deadlines, broader scope, and direct accountability for leadership. For identity teams, the important change is not just that MFA is mandatory, but that proof of coverage now has to be complete, durable, and auditable across both human and non-human access.

The regulation now reaches deeper into governance by requiring complete asset inventories, annual CEO and CISO certification, and documented evidence retained for five years. That changes IAM and NHI work from point-in-time enforcement into lifecycle governance, where coverage, exceptions, and owner attribution all have to be defensible under scrutiny.

For covered financial institutions and especially Class A companies, the article frames compliance as a programme design problem, not a single control deployment. The practical challenge is to align authentication, access reviews, inventory, and executive attestation into one evidence chain that survives audit and enforcement.

Key questions

Q: What breaks when MFA is not enforced on every remote access path?

A: When MFA is inconsistent, a stolen password can still function as a valid enterprise login, which gives attackers a low-friction entry point into critical systems. That failure is especially dangerous in legacy portals and hybrid environments, where exceptions often persist longest and are hardest to audit.

Q: Why do weak MFA methods fail NYDFS Part 500 expectations?

A: They can be relayed, intercepted, or bypassed through fatigue and social engineering, which means they do not materially reduce risk in the way the regulation expects. In practice, the issue is not the presence of a second step, but whether the method is resistant to modern phishing and interception techniques.

Q: What are the signs that identity governance is not ready for Part 500 certification?

A: Missing system inventories, unclear ownership, inconsistent access reviews, and incomplete MFA evidence are all warning signs. If the organisation cannot produce current documentation for access, assets, and exceptions without scrambling, the annual certification process is already under strain.

Q: How should organisations handle NHI and privileged access under NYDFS Part 500?

A: They should govern service accounts, vendor access, and privileged sessions as part of the same access-control and evidence process used for people. The practical difference is lifecycle scope: non-human access often persists longer, changes less visibly, and needs tighter ownership and offboarding discipline.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Universal MFA is now an evidence problem, not only an authentication problem. Part 500 no longer accepts partial MFA coverage for a subset of access paths. The governance burden is to prove that every human and machine access route is covered, including SaaS and third-party access. That shifts IAM programmes from deployment metrics to auditable control evidence, with special pressure on exception handling.

Phishing-resistant MFA has become the real control objective. The article correctly separates factor presence from factor resilience. Push-based and SMS authentication may satisfy legacy deployments, but they do not satisfy the risk profile that NYDFS is now enforcing. For practitioners, the question is no longer whether MFA exists, but whether it can survive modern relay and interception attacks.

Complete asset management is the missing dependency behind every access decision. Part 500 makes inventory completeness a governance requirement because ownership, location, support dates, and RTOs define where access, logging, and review controls must apply. That applies equally to NHI estates, where undocumented service accounts and shared credentials create invisible control gaps. The implication is that identity governance cannot be credible without system governance.

Personal liability changes the economics of control failure. The 2023 Second Amendment turned Part 500 into an executive accountability framework, not just a technical compliance checklist. CEO and CISO certification now depends on defensible evidence across access, inventory, testing, and incident reporting. That raises the bar for cross-functional governance and makes weak documentation a board-level risk.

NHI governance now sits inside a broader regulated access narrative. Although Part 500 is not an NHI-specific rule, its requirements expose the same lifecycle weaknesses that affect service accounts, vendor access, and privileged systems. The strongest programmes will use the regulation to unify human IAM, PAM, and NHI evidence so access governance is tested once and attested once, not fragmented across separate teams.

What this signals

Universal MFA now forces identity teams to treat regulated access as a whole-programme control. The days of protecting only privileged or remote sessions are over. For practitioners, the likely failure mode is not a missing control in one system but an unproven exception somewhere in the access chain.

Part 500 makes inventory completeness a prerequisite for access assurance. If the asset register is incomplete, the identity programme cannot prove where authentication, logging, or review obligations should apply. That is especially important for NHI estates, where undocumented service accounts often hide in plain sight.

Executives will be judged on evidence quality as much as control design. CEO and CISO certification now depends on durable documentation, not informal assurance. The programme question is whether access governance, asset governance, and exception handling can survive audit without reconstruction at the last minute.

For practitioners

• Map every access path to universal MFA coverage Identify all human, privileged, vendor, SaaS, and administrative access routes and confirm each one is enforced with phishing-resistant MFA or a documented compensating control.
• Replace weak MFA methods before the November 2025 deadline Retire SMS, push-based approvals, and reusable OTP workflows where they remain in use for regulated access, and document the replacement standard in policy and architecture records.
• Build a complete system inventory tied to ownership Track every information system with owner, location, classification, support dates, and recovery objectives so identity controls can be assigned and evidenced correctly.
• Create certification evidence for CEO and CISO sign-off Retain the access reviews, asset records, risk assessments, and implementation logs needed to support annual dual-signature certification for five years.
• Align NHI oversight with regulated access governance Include service accounts, vendor access, and shared privileged access in the same governance and evidence process used for human access, rather than treating them as separate control islands.

Key takeaways

• NYDFS Part 500 now turns identity governance into a proof exercise, not a policy exercise, because coverage, exceptions, and ownership must be defensible.
• The article highlights large enforcement exposure, including fines up to $30 million and new personal accountability for CEOs and CISOs.
• Practitioners need to unify MFA enforcement, asset inventory, and evidence retention so human and non-human access can be certified from one control chain.

Key terms

• Universal MFA: Multi-factor authentication enforced for every user, every service, and every access path without exceptions. It reduces the usefulness of stolen passwords and removes common bypass routes that attackers rely on during phishing-led compromise.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Asset Inventory: An asset inventory is a managed record of the systems, identities, and resources an organisation needs to govern. For NHI security, it becomes the starting point for ownership, exposure analysis, and lifecycle action because you cannot rotate or offboard what you cannot reliably see.
• Executive Certification: Executive certification is the formal sign-off by senior officers that disclosures are accurate and that internal controls have been reviewed. It is a legal accountability mechanism, not a ceremonial approval, and it depends on reliable evidence from finance, audit, and identity controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.