To Do: Check List to Comply with DFS Cybersecurity Law
For many years, Digital Edge has been building and operating Information Security Programs. We are certified by ISO (International Standard Organization) for our Informa…
Digital Edge··4 min
NYDFS 500 compliance
Meet NYDFS Part 500 with confidence
New York’s cybersecurity regulation applies to banks, insurers, money transmitters and other entities licensed by the Department of Financial Services. We build and run the program, provide CISO leadership and prepare your annual certification.
Legal & compliance team 24×7 SOC evidence 30–45 day baseline
Part 500 obligations we cover
Program areas
What it is
NYDFS Part 500 in plain English
23 NYCRR Part 500 requires a risk-based cybersecurity program, a CISO, written policies approved by senior governance, MFA, asset inventory, encryption, vulnerability management, incident response and business continuity plans, timely notice of cybersecurity events, and an annual certification or acknowledgment to DFS.
The November 2023 amendment phased in stricter requirements, including expanded MFA, asset inventory and additional obligations for larger “Class A” companies through 2025.
Banks and credit unions
State-chartered and licensed institutions.
Insurance companies and agencies
Insurers, brokers and agents licensed in New York.
Fintech and money transmitters
Virtual currency, lending and payment licensees.
How we deliver
Your path to NYDFS Part 500
Step 1
Free consultation
Two hours on scope, exemptions, timeline and process.
Step 2
Risk assessment & gaps
Program assessment against every section of Part 500.
Step 3
Build & operate
vCISO, policies, MFA, inventory, logging, 24×7 SOC and incident response.
By April 15
Annual certification
Evidence and documentation for your yearly DFS filing.
FAQ
NYDFS Part 500 FAQ
Who must comply with NYDFS 500?
Any person or entity operating under a license, registration, charter or similar authorization under New York banking, insurance or financial services law, unless an exemption applies.
Do we need our own CISO?
You need a qualified CISO, who can be provided by an affiliate or a third-party service provider such as a Digital Edge virtual CISO.
When is the annual filing due?
Covered entities file their certification of compliance or acknowledgment of noncompliance by April 15 each year.
Explore next
Related to NYDFS Part 500
Insights
Latest from Edge Insights
DFS Compliance – Mandatory Cybersecurity Requirements
Please download the full PDF version here. Executive Summary On March 1, 2017, the New York State Department of Financial Services’ (DFS) mandatory cybersecurity require…
Digital Edge··5 min
DFS - Certification of Compliance - Due 2/15/2018!
New York State Department of Financial Services recently updated its web page to indicate that any covered entities (i.e., agencies, insurance agents or insurance broker…
Digital Edge··2 min
Ready to see your security and compliance baseline?
Questions about NYDFS 500 compliance? Book a 30-minute alignment call. We map your gaps against the frameworks you answer to and show what the first 30 days with Digital Edge look like.