> NYDFS Cybersecurity

New York Department of Financial Services Cybersecurity Regulation

Q: Does NYDFS require penetration testing?

Yes. [23 NYCRR 500.5(a)(1)](https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.5) requires covered entities to conduct penetration testing of their information systems from both inside and outside the system boundaries, by a qualified internal or external party, at least annually. That means one test is not enough: you need internal and external coverage every year. We run [penetration testing for New York City](/penetration-testing/new-york-city/) financial services firms and insurers with findings mapped back to Part 500, so the report doubles as evidence for your annual certification.

Q: Can a third-party CISO meet the NYDFS cybersecurity requirement?

Yes. [23 NYCRR 500.4](https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.4) lets a covered entity designate a CISO employed by a third-party service provider. The entity retains responsibility for compliance and must assign a senior employee to oversee that provider. For many smaller covered entities, a [virtual CISO](/services/virtual-ciso/) is the practical way to meet the designation requirement with someone who has the seniority and breadth the role calls for.

The nation's first comprehensive cybersecurity regulation for financial services

Governing Body: New York Department of Financial Services (NYDFS)

Established: 2017 (23 NYCRR Part 500) Last Updated: November 2023 (Second Amendment effective) Scope: New York / Financial Services

3,000+

Covered Entities

What does the NYDFS Cybersecurity Regulation require?

The NYDFS Cybersecurity Regulation (23 NYCRR Part 500) requires banks, insurers, and other financial companies licensed in New York to run a risk-based cybersecurity program. Covered entities must designate a CISO, who may be a third-party service provider, and file an annual certification of compliance with the Department of Financial Services. The 2023 amendment added multi-factor authentication, encryption, an incident response and business continuity plan, annual penetration testing, and 72-hour incident reporting. Larger "Class A" companies face independent audits and expanded controls. Non-compliance can bring enforcement actions and penalties from the superintendent.

// What is NYDFS Cybersecurity?

23 NYCRR Part 500 was the first US regulation to impose detailed cybersecurity requirements on financial services companies. The regulation applies to entities licensed or operating under New York banking, insurance, or financial services law, including many national firms due to New York's financial center status.

The November 2023 amendments significantly strengthened requirements, adding new provisions for vulnerability management, access privileges, incident response, and board accountability. Large Class A companies face additional requirements, including independent audits of the cybersecurity program. All phases of the 2023 amendment were in effect by November 2025. In September 2026 DFS issued guidance on how to scope, schedule, and use the risk assessments Part 500 requires, including how AI adoption and shared vendor dependencies should feed into them.

NYDFS has been an aggressive enforcer, with settlements reaching tens of millions for systemic failures. The regulation's influence extends beyond New York, as many covered entities apply its standards enterprise-wide.

// Inside NYDFS Cybersecurity

Part 500 establishes specific technical requirements and governance obligations, distinguishing it from principle-based regulations. The 2023 amendments expanded requirements substantially.

Cybersecurity Program Requirements

§500.2-500.3

Core requirements for cybersecurity programs including risk assessment, policy, and designated personnel.

Cybersecurity Program

Maintain a program designed to protect information systems and nonpublic information based on risk assessment.

Cybersecurity Policy

Written policies approved by senior governing body or officer, covering 15 specified areas including incident response, access controls, and vendor management.

Chief Information Security Officer

Designate a qualified CISO with adequate authority to run the program. The CISO may work for a third-party provider.

Risk Assessment

Conduct periodic risk assessment sufficient to inform cybersecurity program design. Update at least annually.

Technical Requirements

§500.5-500.15

Specific technical controls mandated by the regulation, expanded significantly in 2023.

Penetration Testing and Vulnerability Assessment

Penetration testing from inside and outside system boundaries by a qualified internal or external party at least annually. Automated vulnerability scans, plus manual review of systems the scans miss, at a frequency set by your risk assessment and promptly after any material system change.

Multi-Factor Authentication

Required for any individual accessing any of the covered entity's information systems. Entities with a limited exemption must still use MFA for remote access, cloud and third-party applications holding nonpublic information, and privileged accounts.

Encryption

Encrypt nonpublic information in transit over external networks and at rest. Alternative controls require CISO approval.

Access Privileges

Limit access to what each role needs, review user access at least annually, and promptly terminate access when people leave. Class A companies must also run a privileged access management solution.

Audit Trail

Maintain systems designed to reconstruct material transactions and detect unauthorized access to nonpublic information.

Application Security

Written procedures for secure development of in-house applications and security evaluation of external applications.

Governance and Reporting

§500.4, §500.17

Board-level oversight and certification requirements ensure executive accountability.

Board Oversight

Senior governing body must oversee cybersecurity risk management. It must understand cybersecurity well enough to oversee it, and may use advisors to get there.

Annual Certification

Annually certify compliance to NYDFS by April 15, signed by highest-ranking executive or CISO.

CISO Reporting

CISO must report at least annually to senior governing body on program status, material issues, and remediation.

Incident Notification

Notify NYDFS within 72 hours of cybersecurity events with reasonable likelihood of material harm.

Third-Party and Vendor Management

§500.11

Requirements for managing cybersecurity risks from third-party service providers.

Written Policies

Implement written policies for third-party security based on risk assessment.

Due Diligence

Conduct due diligence to evaluate third-party cybersecurity practices.

Contractual Requirements

Include cybersecurity requirements in contracts with third-party service providers.

Periodic Assessment

Periodically assess third-party practices based on risk and continued adequacy of access and controls.

Note: Class A companies (those with $20M+ gross annual revenue from NY business AND either 2,000+ employees or $1B+ gross annual revenue) face extra requirements: independent audits of the cybersecurity program, endpoint detection and response, centralized logging and security alerting, and stronger privileged access and password controls.

// Who Must Comply

1 Banks and trust companies chartered in New York
2 Insurance companies licensed in New York
3 Licensed lenders and mortgage companies
4 Money transmitters licensed by NYDFS
5 Investment companies and check cashers
6 Any entity operating under NY Banking, Insurance, or Financial Services Law

// Key Requirements

CISO Designation

Designate a qualified CISO responsible for cybersecurity program implementation and reporting

Penetration Testing

Annual internal and external penetration testing, with vulnerability scanning on a risk-based schedule

Multi-Factor Authentication

Use MFA for every individual accessing your information systems

Encryption

Encrypt nonpublic information in transit and at rest using appropriate standards

Annual Certification

Certify compliance annually to NYDFS signed by senior executive or CISO

72-Hour Notification

Notify NYDFS within 72 hours of cybersecurity events likely to cause material harm

// Enforcement & Penalties

NYDFS has enforcement authority under New York Banking and Financial Services Law. Penalties for non-compliance can include significant monetary fines, consent orders, and restrictions on business activities. Enforcement has increased substantially since 2020.

Maximum Penalty

Banking Law §44 caps run per day a violation continues: up to $2,500, rising to $15,000 for reckless and $75,000 for knowing violations, with higher caps in some cases

Examples:

First American Title: $1 million for cybersecurity regulation violations tied to a 2019 breach (2023)
Residential Mortgage Services - $1.5 million for cybersecurity violations (2021)
Robinhood Crypto - $30 million for BSA/AML and cybersecurity failures (2022)
OneMain Financial - $4.25 million for access control and MFA violations (2023)
Delta Dental: $2.25 million for Part 500 violations after the MOVEit breach (2026)

// Cyber Insurance Impact

Cyber insurers serving financial services carefully evaluate NYDFS compliance. The regulation's specific technical requirements make compliance assessment straightforward. Non-compliance can result in coverage limitations, particularly given the annual certification requirement and NYDFS enforcement activity.

// How Breach Craft Helps

We help organizations achieve NYDFS Cybersecurity compliance through genuine security improvements, not checkbox exercises. Our services address the specific requirements and challenges of NYDFS Cybersecurity.

Gap Assessment

Measure your security against industry standards.

Learn more

Penetration Testing

Find the gaps before attackers do.

Learn more

Virtual CISO

Executive security leadership on demand.

Learn more

Vulnerability Assessment

Thorough security scanning and risk prioritization.

Learn more

// Common Questions

Who must comply with the NYDFS Cybersecurity Regulation?

Covered entities are individuals and nongovernmental businesses operating under a license, registration, charter, or similar authorization under New York Banking, Insurance, or Financial Services Law: banks, mortgage lenders, insurance companies, money transmitters, and more. Limited exemptions exist for the smallest entities (fewer than 20 employees, under $7.5 million in New York revenue, or under $15 million in assets), but even exempt entities must still meet a subset of the requirements.

What did the 2023 NYDFS amendment change?

The November 2023 amendment, phased in through 2025, strengthened governance and controls. It created a "Class A" tier for the largest companies, required board or senior-officer approval of cybersecurity policies, mandated multi-factor authentication, added annual penetration testing and risk assessments, required an incident response and business continuity plan, and expanded reporting to cover ransomware payments. CISO reporting to the board became more formal.

Does NYDFS require penetration testing?

Yes. 23 NYCRR 500.5(a)(1) requires covered entities to conduct penetration testing of their information systems from both inside and outside the system boundaries, by a qualified internal or external party, at least annually. That means one test is not enough: you need internal and external coverage every year. We run penetration testing for New York City financial services firms and insurers with findings mapped back to Part 500, so the report doubles as evidence for your annual certification.

Can a third-party CISO meet the NYDFS cybersecurity requirement?

Yes. 23 NYCRR 500.4 lets a covered entity designate a CISO employed by a third-party service provider. The entity retains responsibility for compliance and must assign a senior employee to oversee that provider. For many smaller covered entities, a virtual CISO is the practical way to meet the designation requirement with someone who has the seniority and breadth the role calls for.

// Related Frameworks

GLBA SOC 2 NIST CSF

// Industries That Need NYDFS Cybersecurity

These industries commonly require NYDFS Cybersecurity compliance as part of their regulatory obligations.

Financial Services Insurance

Guide last reviewed: November 9, 2026

Ready to Strengthen Your Defenses?

Schedule a free consultation with our security experts to discuss your organization's needs.

Schedule Consultation Call Us

Or call us directly at (445) 273-2873