NYDFS Cybersecurity Regulation control library

Every control CMDash tracks for NYDFS Cybersecurity Regulation, in the order the standard itself uses. Each one is a row in the product with an owner, a status, evidence and its own history — this page is the public index of what those rows are.

61 controls16 families0 mapped to other frameworksNo published text extract yet

Families

Cybersecurity Program · 7 Cybersecurity Policy · 5 CISO / Governance · 4 Penetration Testing & Vulnerability Assessment · 3 Audit Trail · 3 Access Privileges & Management · 4 Application Security · 3 Risk Assessment · 3 Cybersecurity Personnel & Intelligence · 3 Third-Party Service Provider Policy · 4 Multi-Factor Authentication · 4 Limitations on Data Retention · 2 Training & Monitoring · 4 Encryption of Nonpublic Information · 3 Incident Response & Business Continuity · 6 Notices to Superintendent · 3

Cybersecurity Program · 7

500.02-01	A cybersecurity program is maintained, based on the entity’s risk assessment, to protect the confidentiality, integrity, and availability of information systems
500.02-02	The program identifies and assesses internal and external cybersecurity risks to nonpublic information and information systems
500.02-03	The program uses defensive infrastructure and policies/procedures to protect information systems and nonpublic information from unauthorized access, use, or other malicious acts
500.02-04	The program detects cybersecurity events
500.02-05	The program responds to identified cybersecurity events to mitigate any negative effects
500.02-06	The program recovers from cybersecurity events and restores normal operations
500.02-07	The program fulfills applicable regulatory reporting obligations arising from cybersecurity events

Cybersecurity Policy · 5

500.03-01	A written cybersecurity policy is approved at least annually by the Senior Governing Body (board or senior officer)
500.03-02	The policy addresses information security, data governance and classification, and asset inventory/device management
500.03-03	The policy addresses access controls and identity management, business continuity and disaster recovery planning, and systems operations/availability
500.03-04	The policy addresses systems and network security, systems and network monitoring, and systems/application development and quality assurance
500.03-05	The policy addresses physical security and environmental controls, customer data privacy, vendor and third-party service provider management, risk assessment, and incident response

CISO / Governance · 4

500.04-01	A qualified Chief Information Security Officer (CISO) is designated to oversee and implement the cybersecurity program and enforce policy
500.04-02	The CISO reports in writing at least annually to the board (or equivalent senior governing body)
500.04-03	The CISO annual report addresses the confidentiality of nonpublic information, the integrity/security of information systems, material cybersecurity risks, program effectiveness, and remediation plans for identified deficiencies
500.04-04	The Senior Governing Body exercises oversight of the cybersecurity program, including by requiring reporting on material matters

Penetration Testing & Vulnerability Assessment · 3

500.05-01	Annual penetration testing of information systems is performed based on relevant identified risks
500.05-02	Vulnerability assessments, including systematic scans or reviews reasonably designed to identify publicly known vulnerabilities, are performed at least every six months
500.05-03	Vulnerability-assessment and penetration-test findings are risk-ranked and tracked to remediation

Audit Trail · 3

500.06-01	Audit trail systems are maintained that are designed to reconstruct material financial transactions sufficient to support normal operations and obligations
500.06-02	Audit trail systems are maintained that are designed to detect and respond to cybersecurity events with a reasonable likelihood of materially harming a material part of normal operations
500.06-03	Audit trail records are retained for the period required by the regulation and protected from unauthorized modification or destruction

Access Privileges & Management · 4

500.07-01	Access privileges to information systems that provide access to nonpublic information are limited to what is necessary for a user’s role
500.07-02	Access privileges and lists of accounts with access to nonpublic information are reviewed on a periodic basis
500.07-03	Accounts and access privileges that are no longer necessary are promptly removed, disabled, or restricted
500.07-04	Privileged access is limited to the minimum number of accounts needed and is separately reviewed

Application Security · 3

500.08-01	Written procedures, guidelines, and standards are maintained for the secure development of in-house-developed applications
500.08-02	Procedures are in place for evaluating, assessing, or testing the security of externally developed applications used by the Covered Entity
500.08-03	Application-security procedures, guidelines, and standards are periodically reviewed, assessed, and updated by qualified personnel

Risk Assessment · 3

500.09-01	A periodic risk assessment of information systems is conducted, sufficient to inform the design of the cybersecurity program
500.09-02	The risk assessment is updated as reasonably necessary to address changes to information systems, nonpublic information, or business operations
500.09-03	The risk assessment considers criteria for evaluation and categorization of identified risks and vulnerabilities, and criteria for their mitigation or acceptance

Cybersecurity Personnel & Intelligence · 3

500.10-01	The Covered Entity utilizes qualified cybersecurity personnel (in-house or via a third-party service provider/affiliate) sufficient to manage cybersecurity risks and perform program functions
500.10-02	Cybersecurity personnel receive sufficient updates and training to address relevant cybersecurity risks
500.10-03	The Covered Entity verifies that key personnel take steps to maintain current knowledge of changing cybersecurity threats and countermeasures

Third-Party Service Provider Policy · 4

500.11-01	Written policies and procedures govern risk-based due diligence over third-party service providers with access to information systems or nonpublic information
500.11-02	Minimum cybersecurity practices required of third-party service providers as a condition of doing business are identified
500.11-03	Due diligence processes are used to evaluate the adequacy of third-party service providers’ cybersecurity practices on a periodic basis
500.11-04	Contracts with third-party service providers include representations and warranties regarding cybersecurity, notice obligations, and right-to-audit provisions where applicable

Multi-Factor Authentication · 4

500.12-01	Multi-factor authentication is required for any individual accessing the Covered Entity’s internal network from an external network
500.12-02	Multi-factor authentication is required for privileged access to information systems
500.12-03	Multi-factor authentication is required for remote access to third-party applications, including cloud-based services, from which nonpublic information is accessible
500.12-04	Where multi-factor authentication is not utilized, the CISO has approved in writing the use of reasonably equivalent or more secure compensating controls

Limitations on Data Retention · 2

500.13-01	Policies and procedures require the timely destruction of nonpublic information that is no longer necessary for business operations or other legitimate business purposes, except where retention is required by law or regulation
500.13-02	The data-retention policy identifies the systems and data stores in scope and defines retention periods by data category

Training & Monitoring · 4

500.14-01	Risk-based policies, procedures, and controls are implemented to monitor the activity of authorized users and detect unauthorized access, use of, or tampering with nonpublic information
500.14-02	Controls (such as endpoint detection and response and centralized logging) are implemented to monitor and log privileged-user activity and detect anomalous behavior
500.14-03	Regular cybersecurity awareness training is provided to all personnel, updated to reflect risks identified in the risk assessment
500.14-04	Personnel with access to nonpublic information receive training on the organization’s cybersecurity policies and procedures relevant to their role

Encryption of Nonpublic Information · 3

500.15-01	Nonpublic information held or transmitted by the Covered Entity is encrypted while in transit over external networks
500.15-02	Nonpublic information held or transmitted by the Covered Entity is encrypted while at rest
500.15-03	Where encryption of nonpublic information is infeasible, the CISO has approved in writing the use of effective compensating controls, reviewed at least annually

Incident Response & Business Continuity · 6

500.16-01	A written incident response plan is maintained to promptly respond to and recover from cybersecurity events materially affecting confidentiality, integrity, or availability of information systems or business operations
500.16-02	A written business continuity and disaster recovery (BCDR) plan is maintained, designed to ensure the availability and functionality of the Covered Entity’s information systems and services
500.16-03	The BCDR plan identifies documents, data, facilities, infrastructure, personnel, and competencies essential to the continued operation of the business
500.16-04	Data necessary to restore material operations is backed up, and backups are sufficiently isolated from network connections that could allow the spread of a cybersecurity event
500.16-05	The incident response and BCDR plans are tested at least annually, including tests of the Covered Entity’s ability to restore critical data and systems from backups
500.16-06	Relevant personnel are trained on their roles under the incident response and BCDR plans, and the plans are updated as necessary

Notices to Superintendent · 3

500.17-01	The Superintendent is notified as promptly as possible, and in no event later than 72 hours, after determining that a covered cybersecurity event has occurred
500.17-02	The Superintendent is notified within 24 hours of any extortion payment made in connection with a cybersecurity event, with a written explanation of the payment within 30 days
500.17-03	An annual written certification of material compliance (or acknowledgment of noncompliance with a remediation timeline) is submitted by the Covered Entity’s highest-ranking executive and CISO

Where this comes from

Control identifiers, families and titles are the rows CMDash’s own seed data writes for NYDFS Cybersecurity Regulation 23 NYCRR 500 (2023 Second Amendment), published from a build-time export rather than read from any customer’s workspace. Cross-framework mappings are CMDash’s own, and each one is shown on both frameworks it connects.

Track these controls in CMDash

Every control on this page becomes a row with an owner, a status, evidence and an audit trail — with the crosswalks already wired, so evidence mapped once counts in more than one framework.

Start free trial About NYDFS Cybersecurity Regulation