NYDFS Part 500, what it asks of licensed firms

Maintain a cybersecurity programme, based on your risk assessment, that protects the confidentiality, integrity and availability of systems and nonpublic information, and covers identify, protect, detect, respond, recover and regulatory reporting.

Class A companies design and run independent audits of the programme, based on the risk assessment.

You may rely on an affiliate's programme if it meets this Part, and you must give the superintendent all programme documents on request.

Keep a written policy or policies, approved at least annually by a senior officer or the senior governing body, with procedures that follow them and are based on your risk assessment.

Cover the listed areas where they apply: information security, data governance and retention, assets and end of life, access, continuity, systems operations, network security, awareness training, secure development, physical security, customer data privacy, vendor management, risk assessment, incident response and vulnerability management.

Designate a CISO. The CISO may be employed by you, an affiliate or a third-party provider, but you stay responsible for compliance and must oversee any outside provider.

The CISO reports in writing at least annually to the senior governing body on the programme, policies, material risks, effectiveness, material events and remediation plans, and reports material issues promptly.

The senior governing body oversees cyber risk: it understands the topic, requires management to run the programme, reviews management reports and confirms enough resources.

Use qualified cybersecurity personnel, whether your own, an affiliate's or a provider's, sufficient to manage your risks and perform or oversee the core cyber functions.

Give personnel updates and training that match your risks, and verify that key staff keep up with changing threats.

Carry out a periodic risk assessment of your information systems, review and update it at least annually and whenever a business or technology change materially alters your cyber risk.

Run the assessment under written policies that set criteria for rating risks, criteria for judging confidentiality, integrity and availability, and rules for how risks are mitigated or accepted.

Penetration test your systems from inside and outside by a qualified internal or external party at least annually.

Run automated scans and manually review systems the scans miss, at a frequency set by your risk assessment and promptly after material system changes.

Keep a process that tells you promptly about new vulnerabilities and fix them in a timely way, prioritised by the risk they pose.

Keep written procedures and standards for secure development of in-house applications and for assessing the security of externally developed applications you use.

The CISO, or a qualified designee, reviews and updates these procedures and standards at least annually.

Limit user access to systems holding nonpublic information to what each job needs, limit the number and functions of privileged accounts, and use them only when a task needs them.

Review all access at least annually and remove what is not needed, disable or securely configure remote-control protocols, and end access promptly when people leave.

Where passwords are used, keep a written password policy that meets industry standards.

Class A companies monitor privileged access activity and use a privileged access management solution and an automated way to block commonly used passwords.

Use multi-factor authentication for any individual accessing any of your information systems. Firms with the 500.19(a) limited exemption must at least cover remote access, remote access to third-party applications that can reach nonpublic information, and privileged accounts.

Where you have a CISO, they may approve in writing reasonably equivalent or more secure compensating controls, reviewed at least annually.

Keep systems that can reconstruct material financial transactions and audit trails designed to detect and respond to events that could materially harm normal operations, based on your risk assessment.

Keep transaction reconstruction records for at least five years and cybersecurity event audit trail records for at least three years.

Keep written policies for a complete, accurate and documented asset inventory of your information systems, tracking owner, location, classification or sensitivity, support expiry date and recovery time objectives, and say how often it is updated and validated.

Have policies for the periodic secure disposal of the nonpublic information described in 500.1(k)(2)-(3) that is no longer needed, unless the law requires you to keep it or targeted disposal is not feasible.

Monitor the activity of authorised users to detect unauthorised access or tampering with nonpublic information, and use risk-based controls against malicious code, including web and email filtering.

Give all personnel cybersecurity awareness training at least annually, including social engineering, updated for the risks in your risk assessment.

Class A companies use an endpoint detection and response solution and a solution that centralises logging and security event alerting, unless the CISO approves in writing equivalent or more secure controls.

Have a written policy requiring encryption that meets industry standards for nonpublic information held or sent, in transit over external networks and at rest.

If encrypting at rest is infeasible, use effective compensating controls approved in writing by the CISO, who reviews the feasibility and the controls at least annually.

Write an incident response plan that covers goals, internal processes, roles and decision authority, communications, remediation of weaknesses, documentation, recovery from backups, root cause analysis and plan updates, including for ransomware.

Write a business continuity and disaster recovery plan that identifies essential assets and people, who is responsible, how to communicate, how to recover critical data and systems, offsite backups and critical third parties.

Make current copies of the plans available to everyone who needs them, including during an event, and train the people responsible.

Test the incident response and continuity plans, and the ability to restore critical data from backups, at least annually, and keep backups protected from alteration or destruction.

Have written policies covering how you identify and risk-assess providers, the minimum cyber practices they must meet, due diligence, and periodic reassessment based on risk.

Include in those policies guidance for contract protections covering the provider's access controls and MFA, encryption in transit and at rest, notice of events affecting you, and representations and warranties on its cyber practices.

Notify the superintendent electronically as promptly as possible and no later than 72 hours after determining that a cybersecurity incident has occurred at you, an affiliate or a third-party provider, answer follow-up requests and keep updating.

Each year by 15 April, file either a certification of material compliance for the prior calendar year or an acknowledgment of non-compliance with a remediation timeline, signed by the highest-ranking executive and the CISO, and keep supporting records for five years.

If you make an extortion payment linked to a cyber event, give DFS notice within 24 hours and a written explanation within 30 days of why it was necessary, the alternatives considered and the diligence done.

Work out whether you are a Class A company: at least $20 million gross annual revenue in each of the last two fiscal years, plus over 2,000 employees or over $1 billion in revenue, counting affiliates that share systems or programme.

Check the limited exemption: fewer than 20 employees and contractors, or under $7.5 million revenue in each of the last three fiscal years, or under $15 million year-end assets, which exempts you from sections 500.4, 500.5, 500.6, 500.8, 500.10, 500.14(a)(1), (a)(2) and (b), 500.15 and 500.16.

File a Notice of Exemption within 30 days of determining you are exempt, and if you stop qualifying, comply with all applicable requirements within 180 days.

Treat a single failure to act as a violation, including a material failure to comply for any 24-hour period, knowing DFS considers factors such as cooperation, good faith, harm to consumers and alignment with recognised frameworks such as NIST.

Use the transition periods from the Second Amendment: 30 days for 500.17, one year for 500.4, 500.15, 500.16 and 500.19(a), 18 months for 500.5(a)(2), 500.7, 500.14(a)(2) and 500.14(b), and two years for 500.12 and 500.13(a).