Topic starter
09/02/2026 1:47 pm
TL;DR: New York DFS has made PAM mandatory for Class A entities and expanded MFA expectations across nearly all access paths under 23 NYCRR Part 500, with annual certification and auditability now central to compliance, according to Delinea. The policy shift turns privileged access governance into a regulatory baseline, not a discretionary hardening measure.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “PAM at the center of 23 NYCRR Part 500 compliance”.
Key questions
Q: How should security teams implement PAM for 23 NYCRR Part 500 compliance?
A: Security teams should treat PAM as a governed control programme, not a point product.
Q: Why do privileged accounts create so much compliance risk under Part 500?
A: Privileged accounts can change system state, access sensitive data, and bypass normal user boundaries, so they concentrate both security and regulatory exposure.
Q: Where do MFA controls fail in regulated access environments?
A: MFA fails when it is placed only at initial authentication and not at the point where privilege is exercised.
Practitioner guidance
- Implement a formal PAM programme for Class A scope Define the regulated population, map privileged roles and functions, and ensure least-privilege access is enforced across in-scope systems with documented annual review.
- Enforce MFA at every privilege boundary Require MFA not only at initial login but also at session start, server access, and privilege elevation so the control applies when access is actually used.
- Remove standing administrative rights where elevation is time-bound Replace persistent admin access with just-in-time elevation so privileged access exists only for the work being performed and is easier to monitor and certify.
Bottom line: 23 NYCRR Part 500 elevates PAM and MFA from good practice to compliance baseline for regulated entities.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/10/2026 3:00 am
Part 500 converts PAM from a security programme component into a regulated accountability layer. The regulation does not merely encourage stronger privilege control; it requires governed, reviewable, and enforceable access management for covered entities. That means PAM must satisfy both security and evidentiary demands, with access decisions documented well enough for supervision and annual certification.
A few things that frame the scale:
- Only 36% of health IT leaders say their organisation applies a privileged access strategy consistently across the enterprise, according to Ponemon Institute research.
A question worth separating out:
Q: What should organisations prove during annual certification of privileged access?
A: They should prove that privileged access is limited, reviewed, monitored, and tied to retained evidence that supports reconstruction of activity. Certification should show that the control is operating continuously, not merely that a policy exists on paper.
👉 Read our full editorial: PAM and MFA under 23 NYCRR Part 500 now define baseline control