New York. Cybersecurity. Regulation
NYDFS Part 500NYDFS Cybersecurity Requirements for Financial Services Companies (23 NYCRR Part 500)
In force
Partly verified
Medium confidence.dpo_required Yes = CISO required. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
§1Summary
- Synopsis
Requires DFS-licensed banks, insurers and other financial services firms to maintain a risk-based cybersecurity programme with a CISO, MFA, encryption, incident response, third-party service provider policies and annual compliance certification.
- Key themes
- Unique features
Prescriptive controls, annual certification signed by CEO and CISO, and 24-hour ransom payment reporting.
- SaaS relevance
SaaS vendors to NY-licensed financial firms face third-party security due diligence and contract terms (MFA, encryption, notice).
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- DFS within 72 hours of determining a cybersecurity incident; extortion payments within 24 hours
- DPO
- Yes
- Cross-border transfers
- None
- Maximum penalty
- Penalties under Banking/Insurance/Financial Services Law (assessed per violation; multi-million settlements common)
§3Dates
- Key dates
- Adopted
- In force
- Second amendment adopted 2023-11-01 with phased obligations through 2025-11-01 (MFA for all access, asset inventory).
§4Text and authority
- Text
- Authoritative text dfs.ny.gov
- Authority
- New York State Department of Financial Services (NYDFS)
§5Where it applies
- Domestic law of
- New York
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.dpo_required Yes = CISO required. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.