New York's Department of Financial Services cybersecurity regulation (23 NYCRR 500) has been incrementally strengthening since its first version took effect in March 2017. The amended regulation, which has been phasing in since November 2023, substantially raises the bar — particularly for larger covered entities, but also for the smaller organizations that supply services to the financial services industry or that hold DFS licenses regardless of their size.
This guide is for the IT director, compliance officer, or CEO of a DFS-covered entity that is trying to understand what the regulation actually requires of their cybersecurity program — and specifically what they need from their IT service providers to meet those requirements. This is not legal advice; the regulation's application to specific facts requires counsel familiar with DFS requirements.
Who Is Covered by 23 NYCRR 500
The regulation applies to "covered entities" — companies that are required to be licensed, registered, chartered, authorized, or regulated by DFS under the New York Banking Law, Insurance Law, or Financial Services Law. This includes:
- State-chartered banks and trust companies
- Insurance companies and insurance intermediaries (including agents and brokers) licensed in New York
- Mortgage bankers and brokers
- Money services businesses
- Premium finance companies
- Debt collectors and certain other licensed financial services businesses
Companies don't need to be headquartered in New York to be covered — any company doing licensed financial services business in New York is subject to the regulation. This captures a significant number of out-of-state insurers, banks with New York operations, and national mortgage companies.
The Exemptions: Who Gets a Reduced Program
The 2017 regulation created limited exemptions for smaller entities. The amended regulation maintains exemptions but has tightened some of them.
Limited exemption (applies to covered entities with fewer than 20 employees OR less than $5 million in gross annual revenue over the last 3 years from NY business OR less than $10 million in year-end total assets): These entities are exempt from certain requirements including CISO appointment, penetration testing, independent audit, and some training requirements. They must still comply with the core requirements.
Employee threshold. The calculation for the employee threshold includes employees of affiliates. Many small financial services companies affiliated with larger holding companies are not as small as they appear when evaluated against this threshold.
If you believe you qualify for the limited exemption, document your basis for that belief. DFS examinations do inquire about exemption status and the underlying calculation.
Core Requirements That Apply to All Covered Entities
Even entities qualifying for the limited exemption must comply with these core requirements:
Cybersecurity program. A cybersecurity program designed to protect the covered entity's information systems and nonpublic information. The program must be based on a risk assessment.
Cybersecurity policy. Written cybersecurity policies addressing each of the regulation's required topic areas, reviewed and approved by a senior officer or the board.
Penetration testing and vulnerability assessment. Annual penetration testing and periodic vulnerability assessments of information systems for non-exempt covered entities. Limited-exemption entities are exempt from the penetration testing requirement specifically, but still must conduct risk assessments that may identify the need for testing.
Risk assessment. A periodic risk assessment of the covered entity's information systems to inform the cybersecurity program.
Multifactor authentication. MFA for all access to information systems from external networks (and for privileged access to internal systems for non-exempt entities).
Training and monitoring. Training for all personnel on cybersecurity awareness and the covered entity's cybersecurity policies. Monitoring of authorized users.
Encryption. Encryption of nonpublic information in transit and at rest, unless an alternative compensating control is justified in writing.
Incident response plan. A written incident response plan to respond to, and recover from, cybersecurity events.
Requirements Added by the 2023 Amendment
The November 2023 amendment to 23 NYCRR 500 introduced several significant new requirements, with staggered compliance deadlines:
CEO/CISO certification. Annual written certification to DFS that the covered entity is in compliance with the cybersecurity regulation. Certificates are filed through DFS's online portal.
72-hour breach notification. Notification to DFS within 72 hours of determining that a cybersecurity event has occurred that: (1) impacts the covered entity and requires notice to any government body, self-regulatory agency, or supervisory body under any applicable law, or (2) has a reasonable likelihood of materially harming any material part of the normal operation of the covered entity. The 2023 amendment also added a 24-hour notification requirement for ransomware payments.
Expanded CISO governance. The original 2017 regulation already required appointment of a Chief Information Security Officer (CISO); the 2023 amendment expanded CISO responsibilities, including direct reporting to the board on material cybersecurity issues and enhanced annual written reporting requirements. The CISO may be a third-party service provider (virtual CISO). See our virtual CISO cost guide for the cost and capability comparison.
Third-party service provider security. Written policies and procedures designed to ensure the security of information systems and nonpublic information accessible to or held by third-party service providers. This directly applies to your IT managed services providers, cloud infrastructure providers, and any other third party with access to your systems or nonpublic information. Covered entities must assess the adequacy of third-party security practices and ensure appropriate cybersecurity requirements are in contracts.
Asset management. Policies and procedures for maintaining a complete, accurate inventory of information systems and data classification.
What This Means for Your IT Provider
The third-party service provider security requirements are directly actionable for covered entities evaluating or renegotiating IT provider relationships.
Your MSP or MSSP must be: assessed for their cybersecurity practices as part of your third-party risk management program, subject to contractual cybersecurity requirements (the regulation requires that contracts include specific provisions), and capable of providing the documentation and cooperation needed for your annual certification and examination readiness.
Concretely, this means your MSP contract should address: their security controls (encryption, access controls, MFA, logging), their incident notification obligations to you (within your 72-hour DFS notification window), their cooperation with DFS examinations, their data handling and confidentiality practices, and their own cybersecurity insurance coverage. DFS is unlikely to be your only reporting clock — see our guide to CIRCIA's 72-hour federal reporting requirement for how overlapping obligations with different triggers and recipients should be mapped before an incident rather than during one.
An MSP that is unwilling to execute an appropriate service agreement with these provisions, or that cannot provide documentation of their own security controls, is not an appropriate vendor for a DFS-covered entity. See our MSP contract negotiation guide for the contractual framework.
Annual Certification and Examination Readiness
DFS has been actively examining covered entities for compliance with 23 NYCRR 500 since the first version took effect. Examinations have resulted in consent orders and fines for entities with inadequate compliance programs.
The annual certification process requires a senior officer to attest to compliance. In practice, this means the covered entity needs to maintain ongoing compliance documentation — not scramble to assemble evidence at certification time. Working with your MSP to maintain continuous documentation (patch records, access reviews, penetration test results, training completion records, incident logs) is the sustainable compliance approach.
Frequently Asked Questions
Does NY DFS apply to companies that are only licensed in other states?
Only companies that are required to be licensed or authorized by DFS are covered. A company licensed solely in Texas that has no New York license is not directly covered. However, if that company writes insurance in New York, manages New York accounts, or conducts financial services business that requires a New York license, it is covered. Review your specific licensing footprint carefully.
Can a virtual CISO satisfy the CISO requirement?
Yes. The regulation explicitly permits the CISO to be a third-party service provider (virtual CISO). The CISO must provide a report annually (at minimum) to the covered entity's board or senior officer addressing the entity's cybersecurity posture. For small covered entities, a virtual CISO engagement is often the most practical way to satisfy this requirement without the cost of a full-time CISO hire.
What is nonpublic information under 23 NYCRR 500?
The regulation defines nonpublic information to include: information about individuals (name plus financial account numbers, SSN, driver's license number, biometric information, health information, or other identifying data); business information of a covered entity that is not generally known and whose disclosure would cause material harm; and certain other categories. This is broader than just customer PII — it includes internal business information.
How does 23 NYCRR 500 interact with HIPAA for healthcare-financial services companies?
Companies subject to both (e.g., companies that provide financial services and handle health information, or health insurers with New York DFS licensure) must comply with both frameworks. There's significant overlap in the security controls each requires, but the specific documentation, notification, and governance requirements differ. Both frameworks require written policies, risk assessments, encryption, access controls, and incident response — but the specifics of each requirement differ, and the enforcement mechanisms are separate regulators. See our HIPAA IT services guide for the healthcare compliance context.