Guide
NYDFS Part 500 Compliance Checklist for Financial Firms
The amended New York cybersecurity regulation is fully phased in. Use this checklist to confirm your IT controls, records and filings meet 23 NYCRR Part 500.
Key takeaways
- Part 500 applies to banks, insurers, agencies, brokers and other firms licensed or registered by the New York State Department of Financial Services.
- The final phase of the 2023 amendments took effect on November 1, 2025: multi-factor authentication for all users and a complete asset inventory.
- Cybersecurity incidents must be reported to DFS within 72 hours, and an extortion payment within 24 hours.
- Every covered entity files a certification of compliance or an acknowledgment of noncompliance by April 15 each year.
The rule
Who Part 500 applies to
Part 500 covers any person operating under, or required to operate under, a license, registration, charter, certificate, permit or similar authorization under New York’s Banking Law, Insurance Law or Financial Services Law. That includes state-chartered banks, insurance companies, insurance agencies and brokers, mortgage companies and many other licensed financial businesses, including firms based outside New York that hold a New York license.
Limited exemptions
Smaller covered entities can qualify for a limited exemption, for example with fewer than 20 employees and independent contractors, less than $7.5 million in gross annual revenue from New York business operations in each of the last three fiscal years, or less than $15 million in year-end total assets. A limited exemption removes some requirements but not all, and the firm must file a notice of exemption with DFS. Confirm your status with your compliance advisor.
Class A companies
The largest covered entities, called Class A companies, have extra requirements, including independent audits of the cybersecurity program, privileged access management and endpoint detection and response with centralized logging and alerting.
Checklist
NYDFS Part 500 IT compliance checklist
- CISO: designate a qualified Chief Information Security Officer, on staff or from a third-party provider, who reports to your senior governing body at least once a year.
- Risk assessment: document it, and review and update it at least once a year and whenever risks change materially.
- Written policies: a cybersecurity program and policies approved at least once a year by a senior officer or the senior governing body.
- Multi-factor authentication for any individual accessing any of your information systems, required since November 1, 2025.
- Asset inventory: a maintained inventory of information systems with each asset’s owner, location, classification, support end date and recovery time objective.
- Access privileges: least privilege, tight limits on privileged accounts, reviews at least once a year and prompt removal when people leave.
- Vulnerability management: automated scans plus penetration testing at least once a year by a qualified party, with timely fixes.
- Monitoring and audit trails designed to detect and respond to cybersecurity events.
- Encryption of nonpublic information in transit over external networks and at rest.
- Email and web filtering against malicious content, plus cybersecurity awareness training at least once a year that includes social engineering.
- Incident response and business continuity plans, tested at least once a year, with backups protected from unauthorized alteration or destruction.
- Third-party service providers: written policies to assess and oversee vendors that access your systems or nonpublic information.
- Notices: report cybersecurity incidents to DFS within 72 hours; report an extortion payment within 24 hours, followed by a written explanation within 30 days.
- Annual filing: a certification of compliance or an acknowledgment of noncompliance by April 15, signed by your highest-ranking executive and your CISO.
Managed IT
How managed IT helps you meet Part 500
Most of Part 500 is day-to-day technical work: multi-factor authentication, an accurate asset inventory, patching and vulnerability scans, monitoring, encryption, tested backups and training records. FinFortify’s managed IT services for New York financial firms put those controls in place and keep the evidence your CISO needs for the annual filing.
We support insurance agencies, banks and other New York-regulated firms. See our IT compliance services and managed cybersecurity services for more.
This guide is general information about IT and cybersecurity practices, not legal advice. Your compliance officer or counsel should confirm how each rule applies to your firm.
FAQ
NYDFS Part 500 questions
When did the last NYDFS Part 500 requirements take effect?
The 2023 amendments were phased in, and the final requirements, including multi-factor authentication for all users and the asset inventory, took effect on November 1, 2025.
Does Part 500 apply to firms outside New York?
Yes, if the firm holds a license, registration or charter from the New York State Department of Financial Services, for example an out-of-state insurance agency licensed in New York.
Can our CISO come from an outside provider?
Yes. The CISO can be employed by an affiliate or a third-party service provider, but the covered entity keeps responsibility for compliance and must designate a senior staff member to oversee the CISO.
Get ready for your next Part 500 filing
Talk with us about a Part 500 gap assessment for your firm.
