NY DFS 23 NYCRR 500 — New York Cybersecurity Regulation

Why does it matter?

Part 500 is enforced by the superintendent, and 500.20(b) makes a single prohibited act or failure, including the material failure to comply with any section for any 24-hour period, a violation. Penalties under the Banking, Insurance and Financial Services Laws weigh sixteen factors, among them cooperation, good faith, harm to consumers, the extent to which the senior governing body participated, and whether the entity's policies are consistent with nationally recognized cybersecurity frameworks such as NIST (500.20(c)). The Second Amendment widened the rule from access controls and reporting to governance, asset management, Class A duties and ransomware.

Key benefits include:

• A clear in-scope test

Covered entity status follows from holding, or being required to hold, a DFS authorization under the Banking, Insurance or Financial Services Law, regardless of other regulators (500.1(e)); Class A status follows from $20 million in gross annual revenue plus either 2,000 employees or $1 billion in revenue, counting affiliates that share systems or a program (500.1(d)).

• Governance with named accountability

The CISO reports in writing at least annually on six items, including plans for remediating material inadequacies, and the senior governing body must understand cybersecurity matters, require management to maintain the program, review reports and confirm resources (500.4).

• Deadlines that can be scheduled

Annual policy approval (500.3), annual penetration testing (500.5), annual access review (500.7), annual risk assessment review (500.9), annual awareness training (500.14), annual plan and backup-restoration testing (500.16) and the April 15 submission (500.17(b)).

• Incident notices with fixed clocks

72 hours after determining that a cybersecurity incident occurred at the entity, an affiliate or a third-party service provider; 24 hours after an extortion payment and a written explanation within 30 days (500.17(a) and (c)).

• A limited exemption for the smallest entities

Fewer than 20 employees and independent contractors, less than $7.5 million in gross annual revenue in each of the last three fiscal years, or less than $15 million in year-end total assets exempts an entity from 500.4, 500.5, 500.6, 500.8, 500.10, 500.14(a)(1), (a)(2) and (b), 500.15 and 500.16 (500.19(a)).

How does it work?

The program starts with the risk assessment. Section 500.2(b) requires the program to perform six core functions: identify and assess risks, protect systems and nonpublic information with defensive infrastructure and policies, detect cybersecurity events, respond, recover, and fulfill regulatory reporting obligations; Class A companies must also design and conduct independent audits based on the risk assessment (500.2(c)). Section 500.3 requires written policies, approved at least annually by a senior officer or the senior governing body, covering fifteen areas (a) to (o) from information security to vulnerability management. A covered entity may adopt an affiliate's program, and all program documentation must be available to the superintendent on request (500.2(d) and (e)).

Technical controls follow. Penetration testing from inside and outside the information systems' boundaries at least annually, automated scans with manual review at a frequency set by the risk assessment, and risk-prioritized remediation (500.5). Least privilege, limits on privileged accounts, annual access reviews, prompt termination of access and a written password policy, with privileged access management and automatic blocking of commonly used passwords for Class A companies (500.7). Multi-factor authentication for any individual accessing any information system, with limited-exemption entities covering remote access, third-party applications holding nonpublic information and all privileged accounts (500.12). An asset inventory tracking owner, location, classification or sensitivity, support expiration date and recovery time objectives, with a set update frequency (500.13).

Resilience and reporting close the loop. Section 500.16 requires written incident response plans covering nine areas and business continuity and disaster recovery plans with six minimum elements; plans are distributed, staff are trained, and the plans and the ability to restore critical data from backups are tested at least annually. Section 500.17 then sets the notices: cybersecurity incidents within 72 hours with continuing updates, the April 15 certification or acknowledgment with a remediation timeline, five-year records, and extortion payment notices. Section 500.22 phased the Second Amendment in: 30 days for 500.17, 180 days in general, one year for 500.4, 500.15, 500.16 and 500.19(a), 18 months for 500.5(a)(2), 500.7, 500.14(a)(2) and (b), and two years for 500.12 and 500.13(a).

Key Elements

• Covered entity and Class A company (500.1)

Covered entity means any person operating under or required to operate under a Banking, Insurance or Financial Services Law authorization; Class A company means a covered entity with at least $20 million in gross annual revenue in each of the last two fiscal years and either over 2,000 employees or over $1 billion in revenue, counting affiliates that share information systems, cybersecurity resources or part of a program.

• Cybersecurity incident (500.1(g))

A cybersecurity event at the covered entity, its affiliates or a third-party service provider that requires notice to any government or supervisory body, has a reasonable likelihood of materially harming any material part of normal operations, or results in the deployment of ransomware within a material part of the entity's information systems.

• Cybersecurity program and policies (500.2, 500.3)

A program based on the risk assessment with six core functions and independent audits for Class A companies; written policies approved at least annually covering fifteen listed areas.

• Cybersecurity governance (500.4)

A designated CISO, who may come from an affiliate or a third-party service provider while the entity retains responsibility; a written report to the senior governing body at least annually on six items; oversight duties of the senior governing body.

• Multi-factor authentication (500.12)

MFA for any individual accessing any information system of the covered entity, with CISO-approved compensating controls reviewed at least annually and a narrower set of systems for limited-exemption entities.

• Asset inventory (500.13)

Written policies producing a complete, accurate and documented inventory that tracks owner, location, classification or sensitivity, support expiration date and recovery time objectives, with an update and validation frequency, plus secure disposal of unneeded nonpublic information.

• Incident response and business continuity (500.16)

Incident response plans with nine required areas, business continuity and disaster recovery plans with six minimum elements, distribution, training, annual testing including restoration from backups, and protected backups.

• Notices to the superintendent (500.17)

72-hour cybersecurity incident notice with continuing updates; by April 15 each year, a certification of material compliance for the prior calendar year or an acknowledgment identifying noncompliant sections with a remediation timeline, signed by the highest-ranking executive and the CISO; records kept five years; extortion payment notice within 24 hours and explanation within 30 days.

What does it cover?

Part 500 applies to every covered entity under DFS authorization: banks and trust companies, insurers, producers and other licensees under the Banking Law, Insurance Law and Financial Services Law (500.1(e)). Information systems are defined to include industrial and process control systems, telephone switching and environmental control systems, and nonpublic information covers business information, personal identifiers combined with account, card, license or Social Security numbers, biometrics and health information (500.1). Section 500.19 provides the limited exemption for small entities and exemptions for entities covered by an affiliate's program, entities with no information systems or nonpublic information and other listed persons; a Notice of Exemption is filed within 30 days and an entity that ceases to qualify has 180 days to comply.

What are its objectives?

Section 500.2(b) states the functions every covered entity's program must perform:

Identify and assess internal and external cybersecurity risks that may threaten the security or integrity of nonpublic information (500.2(b)(1)).

Use defensive infrastructure and policies and procedures to protect information systems and nonpublic information from unauthorized access, use or other malicious acts (500.2(b)(2)).

Detect cybersecurity events and respond to them to mitigate any negative effects (500.2(b)(3) and (4)).

Recover from cybersecurity events and restore normal operations and services (500.2(b)(5)).

Fulfill applicable regulatory reporting obligations, including the notices in 500.17 (500.2(b)(6)).

Framework in Context

Part 500 was promulgated under the Financial Services Law, the Banking Law and the Insurance Law, and penalties are assessed under those laws (500.20). The Second Amendment was authorized by the superintendent on October 16, 2023 after proposed rules published in the State Register on November 9, 2022 and June 28, 2023, and it repealed Appendices A and B in favor of forms on the department's website. The regulation names no other framework as a compliance route, but 500.20(c)(15) treats consistency with nationally recognized cybersecurity frameworks such as NIST as a penalty factor, which is why covered entities commonly map their Part 500 program to the frameworks listed below.

Common Framework Mappings

Covered entities usually report against federal and industry regimes as well as Part 500, so the regulation is commonly mapped to the following frameworks.

Mapped frameworks include:

CIS Controls v8.1

FFIEC CAT

GLBA Safeguards Rule (16 CFR Part 314)

ISO 27001:2022

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2