NYDFS Cybersecurity Regulation
23 NYCRR 500 as amended in 2023, for entities regulated by the New York Department of Financial Services.
What NYDFS Cybersecurity Regulation is
The NYDFS Cybersecurity Regulation, 23 NYCRR Part 500, requires Covered Entities — organisations licensed, chartered or registered under New York Banking, Insurance or Financial Services Law — to maintain a cybersecurity programme protecting Nonpublic Information and the systems holding it. It was the first prescriptive state cybersecurity regulation of its kind in the United States and remains among the most demanding.
The November 2023 Second Amendment substantially expanded it, phasing in through November 2025. It promoted risk assessment, personnel, third-party management, multi-factor authentication, data retention limits, training and encryption into their own numbered sections, having previously folded them into the general programme and policy requirements. It also introduced Class A company obligations for the largest entities, tightened incident notification, and — the part that gets senior attention — requires an annual certification of material compliance signed by the highest-ranking executive and the CISO.
Two features make it operationally distinctive: the CISO role and its reporting obligations are specified in the regulation itself rather than left to discretion, and the notification window for a cybersecurity event is 72 hours to the Superintendent.
Who it applies to
- Banks, insurers, mortgage servicers, money transmitters and other entities licensed or chartered under New York Banking, Insurance or Financial Services Law.
- Entities relying on a limited exemption under §500.19, who still owe a subset of the requirements and still have to file.
- Third-party service providers to Covered Entities, through the §500.11 policy requirements their customers must impose.
- Class A companies — the largest Covered Entities — who carry supplemental obligations beyond the base regulation.
How it is structured in CMDash
CMDash seeds the regulation section by section as amended in 2023 — §500.02 through §500.17 — so a control row corresponds to a citable section rather than to an internally invented identifier. Sections are expanded into multiple rows where a section carries distinct assessable obligations.
| Cybersecurity Program | 7 |
| Cybersecurity Policy | 5 |
| CISO / Governance | 4 |
| Penetration Testing & Vulnerability Assessment | 3 |
| Audit Trail | 3 |
| Access Privileges & Management | 4 |
| Application Security | 3 |
| Risk Assessment | 3 |
| Cybersecurity Personnel & Intelligence | 3 |
| Third-Party Service Provider Policy | 4 |
| Multi-Factor Authentication | 4 |
| Limitations on Data Retention | 2 |
| Training & Monitoring | 4 |
| Encryption of Nonpublic Information | 3 |
| Incident Response & Business Continuity | 6 |
| Notices to Superintendent | 3 |
These counts are the control rows CMDash actually seeds, checked against the seed files by a test on every build.
The control text
Controls carry their identifier, title, and CMDash’s own evidence-requirement guidance. No verbatim source text is bundled for this framework. If you hold the official document, you can load its text through the framework CSV import.
What CMDash does for NYDFS Cybersecurity Regulation
- Section-level tracking with owners, statuses, evidence requirements and dated evidence, keyed to the citations the regulation and DFS correspondence use.
- The regulatory radar tracks 23 NYCRR 500 as a dated entry with the Second Amendment phase-in milestones, mapped onto specific seeded controls, so the readiness percentage is computed from your own control state.
- Dated evidence with reviewer notes and timestamps — which is what the annual certification of material compliance ultimately rests on, given who signs it.
- Policies authored in CMDash link to the sections they satisfy, which is directly useful for §500.03, where the regulation enumerates the areas the cybersecurity policy must address.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
No crosswalk mappings ship for NYDFS Cybersecurity Regulation. Evidence you collect against it does not automatically surface on your other frameworks, and that is worth knowing before you plan the work.
Where the evidence comes from
CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to NYDFS Cybersecurity Regulation’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.
Where CMDash stops
Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.
- §500.01 definitions are not modelled as controls, and §§500.18 through 500.24 — confidentiality, exemptions, enforcement, effective dates and transitional periods — are not assessable obligations and are not seeded.
- Class A supplemental requirements under §500.09(b) and §500.12(b) — independent audit, endpoint detection and response with centralised logging, privileged access management and password vaulting — are not seeded as a separate control set. If you are a Class A company, this control set is your base obligation and not your full one.
- No crosswalk mappings to other frameworks are seeded for NYDFS, so evidence collected here does not automatically surface against your other frameworks.
- The annual certification and any notice to the Superintendent are filed by you through the DFS portal. CMDash holds the evidence behind them.
Common questions
We qualify for a limited exemption. Does anything apply?
Yes. A §500.19 limited exemption removes some requirements but not the programme, the policy, access management, risk assessment, third-party policy, MFA, data retention limits, training or notification. You also still file the exemption. Assuming an exemption means nothing applies is the most common mistake here.
Are the Class A requirements covered?
No. The supplemental Class A obligations — independent audit, EDR with centralised logging, privileged access management and password vaulting — are not seeded. If you are a Class A company you have obligations beyond this control set, and it is better to know that now.
Who signs the annual certification?
Under the Second Amendment, the highest-ranking executive and the CISO. That is why evidence provenance matters more here than in most frameworks — two named individuals are certifying material compliance, and "we believe so" is not a defensible basis for either signature.
Also in Privacy & Sector Regulation
Paid plans cap how many frameworks you run at once, never which ones — NYDFS Cybersecurity Regulation is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.