Meet NYDFS Part 500 duties with evidence ready for certification

NYDFS Part 500, formally 23 NYCRR 500, is the New York Department of Financial Services cybersecurity regulation for financial services companies. It took effect on 1 March 2017 and requires a risk-based cybersecurity program, written policies, a CISO, access controls, encryption, incident response planning, 72-hour incident notification and an annual compliance filing. The Second Amendment, effective 1 November 2023, added stronger governance, MFA and asset inventory requirements.

Any individual or organisation operating, or required to operate, under a licence, registration, charter, certificate or similar authorisation under New York's Banking Law, Insurance Law or Financial Services Law must comply. This includes banks, insurers, insurance agents and brokers, mortgage companies and virtual currency businesses. Firms below the section 500.19(a) thresholds receive a limited exemption but must file a Notice of Exemption within 30 days.

The Second Amendment, effective 1 November 2023, introduced Class A companies with extra duties, stronger CISO reporting and board oversight, annual penetration testing, universal MFA, written asset inventory procedures, enhanced incident response and BCDR plans, notice of extortion payments, and a choice between certifying material compliance or acknowledging noncompliance each year. It also listed factors NYDFS considers when assessing penalties.

The Second Amendment phased in over two years. Incident and extortion payment notices applied from 1 December 2023. Most new requirements applied from 29 April 2024. Governance, encryption and incident response and BCDR changes applied from 1 November 2024. Automated scanning, access privileges, malicious code controls and Class A EDR and logging applied from 1 May 2025. MFA for all individuals and asset inventory applied from 1 November 2025.

A Class A company is a covered entity with at least $20 million in gross annual revenue in each of the last two fiscal years from its own business and its affiliates' New York operations, plus either over 2,000 employees or over $1 billion in gross annual revenue across all affiliates. Class A companies must also conduct independent audits, use privileged access management, block commonly used passwords and deploy endpoint detection and response with centralised logging.

NYDFS enforces Part 500 under the Banking Law, Insurance Law and Financial Services Law, and the regulation sets no fixed fine. Under section 500.20, a single prohibited act, a failure to secure nonpublic information, or a material failure to comply with any section for any 24-hour period counts as a violation. Penalties weigh factors such as cooperation, intent, prior violations, harm to consumers and the firm's resources.

ISO 27001 certification or a SOC 2 report does not by itself satisfy Part 500, but much of the work overlaps. Risk assessment, access control, encryption, logging, vendor management and incident response controls map closely. Part 500 adds specific duties such as a named CISO, 72-hour notice to NYDFS, extortion payment notice and the annual 15 April filing signed by the highest-ranking executive and CISO.

NYDFS Part 500 is mapped in OneClickComply's control library and is available on request. It uses the same controls as frameworks such as ISO 27001 and SOC 2, so evidence collected once counts towards Part 500 too. OneClickComply does not file your certification or guarantee compliance, but it helps you gather the documentation your executive and CISO need to sign it.