Framework Information Security & Privacy
NY DFS 23 NYCRR 500
23 NYCRR Part 500 is the New York Department of Financial Services cybersecurity regulation for entities it licenses or charters: banks, insurers, mortgage companies, money transmitters, virtual currency businesses and others.
First effective in 2017, it was substantially amended in November 2023 (the Second Amendment) with obligations phased in through November 1, 2025, when universal multifactor authentication and written asset inventory procedures became mandatory.
Larger Class A companies (at least $20 million in New York revenue plus either 2,000 employees or $1 billion in global revenue) must also run independent audits of their program, privileged access management and endpoint detection.
The regulation is explicit about what must be in writing: a cybersecurity policy approved by the senior governing body, a cybersecurity program based on a documented risk assessment, a designated CISO who reports in writing to the board at least annually, incident response and business continuity plans, third-party service provider policies, access privilege and asset inventory procedures, and records retained for five years.
Covered entities notify DFS within 72 hours of a cybersecurity incident and within 24 hours of any ransomware payment, and file an annual certification of material compliance (or acknowledgment of noncompliance with a remediation plan) by April 15, signed by the CEO or highest ranking executive and the CISO.
Who has to comply
Any person or entity operating under a license, registration, charter, certificate, permit or similar authorization under New York Banking, Insurance or Financial Services Law, plus their affiliates where relevant.
Limited exemptions apply to entities with fewer than 20 employees, under $7.5 million in gross annual revenue from New York operations, or under $15 million in year-end total assets, but core requirements still apply.
What the assessor asks to see
Board-approved cybersecurity policy; risk assessment; cybersecurity program documentation; CISO designation and annual board report; asset inventory and procedures; access privilege reviews and MFA evidence; penetration test and vulnerability scan reports; encryption of nonpublic information in transit and at rest; incident response and business continuity plans with test results; third-party service provider policy and diligence records; training records; incident notifications and ransomware payment notices; the signed annual certification and supporting records retained five years.
Where the requirement sits: 500.3 policies approved annually; 500.14 training; 500.16 IR/BCDR plans; 500.17 annual certification; 500.19 limited exemption. Technical: 500.5, 500.6, 500.7, 500.12
Second Amendment phase-in
Key dates: November 1, 2023 (amendment effective, 72-hour notice and 24-hour ransomware notice), April 15, 2024 (first certification under the new signatory rules), April 29, 2024 (governance, incident response and business continuity, access privileges), November 1, 2024 (encryption, asset inventory planning, Class A independent audits and PAM), May 1, 2025 (vulnerability scanning and access privilege controls), November 1, 2025 (universal MFA and written asset inventory procedures).
The April 15, 2026 certification was the first to cover the full amended rule.
What AllyMatter does here
The policy-approval, training-acknowledgment and annual-certification evidence layer of Part 500 - most of what a limited-exemption agency owes.
AllyMatter publishes this site.
Assessors
Who assesses NY DFS 23 NYCRR 500
Government enforcement only. DFS examines covered entities and can impose penalties; there is no certification. Class A companies must obtain independent audits of their cybersecurity program (internal or external auditors free from influence over the program), but DFS does not certify those auditors.
No firm has claimed a NY DFS 23 NYCRR 500 assessor listing yet. Claim yours →
Consultants
Who helps with NY DFS 23 NYCRR 500
Yes. Financial services cybersecurity consultancies, law firms and GRC platforms offer Part 500 gap assessments, risk assessments, policy drafting, virtual CISO services, Class A independent audits and certification support. Engagements typically run on an annual cycle aligned to the April 15 filing.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
No firm has claimed a NY DFS 23 NYCRR 500 consultant listing yet. Claim yours →
Software
Tools for NY DFS 23 NYCRR 500
Tools that name this framework in their own material.
Related reading
- NYDFS Part 500, one year later: new requirements effective November 1, 2024Tracks the staged amendment deadlines and what covered entities have to document at each one, written by a firm that defends these exams.Debevoise & Plimpton
- NYDFS: final set of cybersecurity requirements under amended Part 500 take effect November 1, 2025Explains the last tranche, universal multi-factor authentication and written asset inventory procedures, plus the limited exemptions.Hogan Lovells Cadwalader
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Find a Consultant for NY DFS 23 NYCRR 500
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Run the Policy Side of NY DFS 23 NYCRR 500 in AllyMatter
Approve the policies NY DFS 23 NYCRR 500 asks for, keep every version, and record a named acknowledgment from each person who has to read them.