NYDFS 23 NYCRR 500 · United States
Part 500 readiness for banks, insurers and other DFS-licensed firms, with evidence your CISO can sign.
The sections your CISO certifies
Your size and New York revenue decide how much of Part 500 applies.
Simplified from sections 500.1 and 500.19. Class A also applies above $1 billion in total revenue, and the $15M total-assets test can qualify you for the limited exemption.
You’ll see which part of the regulation likely applies.
Key sections still apply, including risk assessment, access controls, MFA, incident notice and the yearly filing.
The full regulation applies, including a CISO, annual penetration testing, MFA, monitoring and the April 15 certification.
Everything a covered entity does, plus a yearly independent audit, endpoint detection and response with central logging, and privileged access management.
Certify compliance for the previous year, or acknowledge non-compliance with a remediation plan. Your highest-ranking executive and your CISO both sign.
Notify DFS after determining a cybersecurity incident occurred.
Notice of any ransom payment made.
Why the payment was necessary and what you considered.
Penetration test, risk assessment review and a CISO report to the board.
The controls we put in place, so your CISO can sign on April 15.
Risk assessment, board-approved policies and CISO reporting
Annual penetration test, audit trail, monitoring and training
Least privilege, access reviews and MFA for everyone who logs in
Vendor policy and due diligence for anyone touching your data
Tested incident response and business continuity plans
The 72-hour runbook and evidence for April 15
Simplified grouping of Part 500. We map evidence section by section during the engagement.
Gap assessment, risk assessment, policies, third-party program and evidence for the certification.
External, internal, web, API and cloud tests, with a retest and evidence formatted for your filing.
Monitoring, threat hunting and a 72-hour notification runbook, with evidence preserved.
Your category, current controls and certification timeline.
.webp)
We reply within 1 business day.
Pixel icons by Streamline, CC BY 4.0. This page summarises 23 NYCRR 500 and is not legal advice.
