NYDFS Part 500

No changes recorded yet — we are watching, and nothing has been published.

1. 2025-11-01 Multi-factor authentication required for any individual accessing any information system of a covered entity, regardless of location or type of user
2. 2023-11-01 Second Amendment to Part 500 takes effect
3. 2018-02-15 First annual certification of compliance due under Part 500
4. 2017-03-01 23 NYCRR Part 500 takes effect

1. 2023-11-01
   Second Amendment (November 2023) AmendmentCurrent text

   The Second Amendment to Part 500 took effect on 1 November 2023, with new requirements phased in through November 2025. source

   More

   • Class A companies (larger entities defined by revenue and headcount) must conduct independent audits of their cybersecurity program.
   • From 1 November 2025, multi-factor authentication is required for any individual accessing any of the entity's information systems, with limited exceptions.
   • Cybersecurity incidents must be reported to DFS within 72 hours of determining that one occurred.
2. 2017-03-01
   23 NYCRR Part 500 (March 2017) Major version

   DFS promulgated its first cybersecurity regulation for financial services companies. source

Part 500 covers financial services companies licensed or authorized by DFS, with lighter duties for small entities.

Covered entity

Anyone operating under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law, even if also regulated by other agencies. source

Class A company

A covered entity with at least $20 million in gross annual revenue in each of the last two fiscal years that also meets headcount or global revenue thresholds; it carries extra duties. source

Limited exemption

Entities with fewer than 20 employees and contractors, less than $7.5 million in gross annual revenue in each of the last three fiscal years, or less than $15 million in year-end total assets are exempt from parts of the regulation. source

Losing an exemption

An entity that ceases to qualify for an exemption has 180 days to comply with all applicable requirements. source

Exemption lookup

DFS publishes which requirements apply to each category of company. source

Each covered entity certifies to DFS every year, by 15 April, whether it materially complied during the prior calendar year.

Annual notice

By 15 April each year, a covered entity submits either a certification of material compliance for the prior calendar year or an acknowledgment of non-compliance that names the sections and gives a remediation timeline; the highest-ranking executive and the CISO sign. source

Independent audit

Class A companies must design and conduct independent audits of their cybersecurity program based on their risk assessment. source

Incident notice

A covered entity notifies DFS no later than 72 hours after determining that a cybersecurity incident occurred at it, its affiliates or a third-party service provider. source

Testing

Incident response and business continuity plans, and the ability to restore from backups, must be tested at least annually. source

Submissions

DFS takes compliance filings through its cybersecurity submissions portal. source

The Superintendent enforces Part 500 under the Banking, Insurance and Financial Services Laws.

Single act is a violation

A single prohibited act or failure to satisfy an obligation is a violation, including the material failure to comply with any section for any 24-hour period. source

Penalty factors

In assessing penalties DFS considers factors such as cooperation, good faith, intent, prior violations, whether violations were isolated or systemic, and the entity's resources. source

Recent fines

1. 2026-08-05 $250,000

   Order Express, Inc., a licensed money transmitter – inadequate policies for system updates and inadequate risk assessments source

2. 2026-04-30 $2,250,000

   Delta Dental Insurance Company and Delta Dental of New York – cybersecurity program deficiencies and late reporting of cybersecurity events source

1. Law text 23 NYCRR Part 500 (as amended by the Second Amendment)
2. Guidance DFS Cybersecurity Resource Center
3. Guidance What is required (requirements by company category)
4. FAQ Cybersecurity FAQs
5. Guidance NY DFS Multi-Factor Authentication Requirements (July 2025)

1. NY SHIELD Act

   The SHIELD Act requires reasonable safeguards from anyone holding New York residents' private information; Part 500 sets detailed program duties for DFS-licensed financial firms.

2. FTC Safeguards Rule

   The FTC Safeguards Rule covers non-bank financial institutions under federal law; Part 500 covers firms licensed by New York's financial regulator.

3. NAIC MDL-668

   The NAIC model law binds insurers only where a state enacts it; Part 500 already binds DFS-licensed insurers in New York.

4. SEC Cybersecurity

   The SEC rules require public companies to disclose incidents to investors; Part 500 requires notice to the regulator and a full cybersecurity program.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 10 September 2026. Subscribe to NYDFS Part 500 (RSS)