NYDFS Part 500: Cybersecurity Regulation Guide for 2026

Last updated: 9 November 2026

Quick answer: NYDFS Part 500 (23 NYCRR 500) is New York’s cybersecurity regulation for banks, insurers and other DFS-licensed entities. Since the 2023 amendment was fully phased in on November 1, 2025, covered entities must run a risk-based program with universal MFA, an asset inventory, 72-hour incident reporting and an annual April 15 compliance filing.

New York’s Department of Financial Services (DFS) was one of the first US regulators to write detailed cybersecurity requirements into law. Its regulation now reads more like a control framework than a set of principles, and DFS enforces it with public consent orders.

This guide is written for CISOs and compliance leads. It covers who is in scope, what the amended rule requires, the deadlines that have already passed, what DFS is focusing on in 2026, and a checklist you can use to test your program before the next certification.

What is NYDFS Part 500 and who does it cover?

NYDFS Part 500 applies to any “covered entity”: a person operating, or required to operate, under a DFS license, registration, charter or similar authorization under New York’s Banking Law, Insurance Law or Financial Services Law. That includes state-chartered banks, licensed lenders, money transmitters, insurers, insurance agencies and virtual currency businesses.

The Second Amendment, adopted November 1, 2023, added tiers that change how much of the rule applies to you:

• Class A companies: covered entities with at least $20 million in gross annual revenue in each of the last two fiscal years from New York business operations (including affiliates), plus either more than 2,000 employees on average or more than $1 billion in total gross annual revenue. They carry extra obligations such as independent audits.
• Limited exemption (500.19(a)): entities with fewer than 20 employees and independent contractors, or less than $7.5 million in New York gross annual revenue in each of the last three fiscal years, or less than $15 million in year-end total assets. They still must meet a core set of requirements.
• All other covered entities: the full rule, without the Class A extras.

Common mistake: Treating a limited exemption as a full exemption. Exempt entities must still file, assess risk, manage third parties, report incidents and, since November 2025, meet the MFA and asset inventory rules. DFS fined Order Express, a company that qualified for exemptions from many requirements, $250,000 in August 2026 for weak update policies, insufficient risk assessments and a deficient program.

What are the core requirements of the amended regulation?

The rule requires a cybersecurity program based on a documented risk assessment, with specific technical and governance controls on top. The main sections are summarized below.

Governance and the CISO

Section 500.4 requires the CISO to report in writing at least annually to the senior governing body on the program and material risks. The board must also exercise oversight and have sufficient understanding of cybersecurity matters to do so, which DFS can test by reviewing board minutes and materials.

Class A extras

Class A companies must design and conduct independent audits of their cybersecurity program based on the risk assessment. According to the DFS Class A timeline, they also had to implement a privileged access management solution and endpoint detection and response by May 1, 2025.

Which NYDFS Part 500 deadlines have already passed?

All of them. The phased transition that began in December 2023 ended on November 1, 2025, so every requirement now applies. The table below is useful for gap reviews and for explaining history to auditors.

In practice: The MFA rule is broad. It covers any individual accessing any information system, not only remote access, unless the CISO has approved reasonably equivalent or more secure compensating controls in writing and reviews them at least annually.

How does incident reporting work under Part 500?

Covered entities must notify DFS as promptly as possible, and in no event later than 72 hours after determining that a reportable cybersecurity incident has occurred. Notice goes through the DFS Portal.

Extortion payments have their own clock under 500.17(c): notice within 24 hours of the payment, and within 30 days a written description of why the payment was necessary, the alternatives considered and the sanctions diligence performed.

Late reporting is a frequent theme in enforcement. In April 2026 DFS secured a $2.25 million settlement with Delta Dental, citing failures to report cybersecurity events on time following the 2023 MOVEit Transfer compromise, alongside program and data control failures.

A structured incident and breach management workflow helps here, because the same event may also trigger state breach laws, HIPAA for health data, or contractual notices.

If you want to track Part 500 controls, incidents and evidence in one place, you can start your 14-day free trial and map them against frameworks such as NIST CSF and ISO 27001.

What goes into the April 15 certification?

By April 15 each year, every covered entity must file either a Certification of Material Compliance for the prior calendar year or an Acknowledgment of Noncompliance. Both must be signed by the highest-ranking executive and the CISO (or senior officer responsible for cybersecurity).

An acknowledgment must identify the sections not complied with, describe the nature and extent of the noncompliance, and give a remediation timeline. Under 500.20(b), the commission of a single prohibited act or a failure to satisfy an obligation constitutes a violation, so signing a certification without evidence is a real risk.

Evidence to assemble before signing

• Current risk assessment and the program decisions that flow from it.
• Board-approved policies with approval dates.
• CISO’s written annual report and board minutes showing oversight.
• Pen test report, vulnerability scan records and remediation tracking.
• Access review records, MFA coverage report and any approved compensating controls.
• Asset inventory with owners, locations, classification and support expiration dates.
• Training completion records, incident response and BCDR test reports.
• Third-party due diligence files for service providers with access to nonpublic information.

What is DFS focusing on in 2026?

DFS has signaled three priorities this year through industry letters and enforcement.

Risk assessment quality

On September 10, 2026, DFS issued guidance on conducting and using risk assessments. It lists gaps seen in examinations, including incomplete asset inventories, weak or inconsistent methodologies, overlooked emerging technologies and concentration risk, and programs that cannot show they are based on identified risks. Expect examiners to ask how each control traces back to a documented risk; a structured risk management process makes that traceable.

Frontier AI and vulnerability speed

A May 21, 2026 industry letter on heightened risks from frontier AI models asked regulated entities to accelerate vulnerability detection and remediation, map dependencies on critical service providers, and add testing and human oversight for AI-generated code.

Third-party risk

Both letters point back to 500.11. Your third-party policy should cover risk-based due diligence, minimum controls such as MFA and encryption, incident notice obligations and periodic reassessment. A vendor risk management program that records these steps gives you the evidence DFS asks for. Our piece on third-party risk as an executive liability covers the board angle.

How does Part 500 compare with other frameworks?

Part 500 is prescriptive, but most of its controls overlap with frameworks you may already follow. Mapping once avoids duplicate work.

• NIST CSF 2.0: the Govern function lines up with 500.3 and 500.4; Identify maps to 500.9 and 500.13. See our guide to the NIST CSF 2.0 governance function.
• ISO 27001: Annex A controls cover access, supplier security, logging and incident management, but ISO does not set the 72-hour DFS clock or the April 15 filing.
• SOC 2: a report from a service provider supports 500.11 due diligence but does not replace your own program.

AI cross-mapping in the Compliance Universe links one control to every framework that needs it, so a single MFA or access review record can support NIST CSF and ISO 27001 at the same time and double as evidence for your Part 500 filing.

A 10-point Part 500 readiness checklist

1. Confirm your tier: Class A, limited exemption or full covered entity, and refile exemption notices if status changed.
2. Refresh the risk assessment and record how it drives control choices.
3. Have the senior governing body approve policies and minute its oversight.
4. Get the CISO’s annual written report on the board agenda.
5. Verify MFA covers every user and system, or document CISO-approved compensating controls.
6. Reconcile the asset inventory against discovery tools.
7. Complete access reviews and remove stale accounts.
8. Test incident response and BCDR plans with critical staff and management.
9. Rehearse the 72-hour and 24-hour notification paths, including who files on the DFS Portal.
10. Reassess critical third parties and update contract terms.

Key takeaways

• Every Part 500 requirement has applied since November 1, 2025, including universal MFA and asset inventory.
• Limited exemptions reduce, but do not remove, obligations; DFS still fines exempt entities.
• Report incidents within 72 hours and extortion payments within 24 hours.
• The April 15 filing is signed by the top executive and CISO, so evidence must exist before signature.
• DFS’s 2026 focus is risk assessment quality, AI-driven vulnerability speed and third-party risk.

Frequently asked questions

Who must comply with NYDFS Part 500?
Any person operating, or required to operate, under a license, registration, charter or similar authorization under New York’s Banking Law, Insurance Law or Financial Services Law. That includes banks, insurers, insurance agencies, lenders, money transmitters and virtual currency firms. Smaller entities may qualify for a limited exemption but still must meet core requirements and file with DFS.

What is the deadline for reporting a cybersecurity incident to DFS?
Covered entities must notify DFS as promptly as possible and no later than 72 hours after determining that a reportable cybersecurity incident has occurred. If an extortion payment is made, a separate notice is due within 24 hours, followed by a written explanation within 30 days covering why it was necessary, alternatives considered and sanctions checks.

Is MFA required for all users under Part 500?
Yes. Since November 1, 2025, section 500.12 requires multi-factor authentication for any individual accessing any of the covered entity’s information systems. The CISO may approve reasonably equivalent or more secure compensating controls in writing, but those must be reviewed at least annually. Document every exception and the reason for it.

What happens if we cannot certify compliance by April 15?
You file an Acknowledgment of Noncompliance instead. It must identify the sections you did not meet, describe the nature and extent of the gaps, and set out a remediation timeline or confirm remediation is complete. It is signed by the highest-ranking executive and the CISO. Filing honestly is far safer than certifying without evidence.

Does a SOC 2 or ISO 27001 certificate satisfy Part 500?
No. They provide useful evidence and overlapping controls, but Part 500 has specific requirements such as the 72-hour DFS notice, extortion payment reporting, CISO board reporting and the annual certification. Map your existing controls to Part 500 and close the gaps rather than relying on a certificate alone.

Building a Part 500 program you can certify

NYDFS Part 500 is now fully in force, and DFS is testing whether programs are genuinely risk-based, not just documented. Treat the April 15 filing as the output of year-round evidence collection, keep the risk assessment at the center, and map controls once across the frameworks you already follow.

Enactia’s AI-powered GRC platform brings risk assessments, policies, vendors, incidents and evidence together and cross-maps them across frameworks such as NIST CSF and ISO 27001, so your Part 500 evidence is ready when you need it. To see how it fits your program, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.