NYDFS Part 500
The New York Department of Financial Services cybersecurity regulation (23 NYCRR 500), amended in 2023.
Overview
Part 500 requires covered entities to maintain a cybersecurity programme and policies, a CISO, risk assessments, access controls including multi-factor authentication, incident notification within 72 hours, annual compliance certification and third-party risk management.
As regulation it is binding and specific, and it is the layer most directly mapped to controls. The authorities most closely connected to it are NYDFS.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
It is one of the most prescriptive cybersecurity regulations in financial services.
Who it affects
Banks, insurers and other entities licensed by NYDFS.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to NYDFS Part 500. Select one to open it.
What to do about it
- 1Confirm whether you are in scope: who it covers, which activities and where.
- 2Break it into testable requirements.
- 3Map each requirement to a control and an owner.
- 4Track amendments, implementing rules and guidance.
- 5Keep sealed evidence for every control run.
From requirement to evidence.
Part 500 requirements are crosswalked to NIST CSF and ISO 27001 controls.
Request early access →