Is Your Cybersecurity Infrastructure in Compliance?
In March of 2017, the New York State Department of Financial Services’ (DFS) issued its “Part 500” - Mandatory Cybersecurity Requirements for financial services entities. Thus, requiring banks, insurers, and other…
In March of 2017, the New York State Department of Financial Services’ (DFS) issued its “Part 500” - Mandatory Cybersecurity Requirements for financial services entities. Thus, requiring banks, insurers, and other financial institutions to establish and maintain a “risk-based, holistic, and robust security program” that is ultimately designed to protect consumers’ private data. Partial exemptions are provided for covered entities based on their staffing level, annual revenue, or total assets.
The initial deadline for submitting an annual Certification of Compliance on February 15, 2018 is rapidly approaching, and all organizations are required to comply with DFS Part 500 Section 9, Risk Assessment by March 1, 2018.
Digital Edge is an expert in ISO standards, is certified by International Standard Organization on Information Security and Quality (ISO 27001). There is a clear crosswalk between DFS law and ISO standards. Digital Edge will help to implement policies, standards and practices to cover all DFS requirements based on International Standards Organization framework.
Contact us today to further explore how our team can provide your business with an unparalleled cybersecurity solution, with our continued focus on Stability, Security, Efficiency and Compliance.
For more information on this regulation and to ensure that your organization is following the critical compliance requirements, please read our most recent articles:
- DFS Compliance – Mandatory Cybersecurity Requirements
- To Do: Check List to Comply with DFS Cybersecurity Law
- Discover the NEW online DFS Cybersecurity Reporting Portal
- Exempt from DFS Cybersecurity Regulations – Now What?
Updated November 2026: the original post is kept above; the sections below add context for readers today.
Part 500 after the 2023 amendment
The deadlines above have passed, but Part 500 has grown. The Second Amendment, adopted in November 2023 and phased in through 2025, added stricter rules for larger "Class A" companies, annual independent audits for them, multifactor authentication for remote access, an asset inventory, notice of any ransomware extortion payment within 24 hours and stronger governance duties for the board and the CISO.
Covered entities still certify compliance to DFS by April 15 each year. See our NYDFS Part 500 compliance page for the current checklist.
