NY DFS 23 NYCRR 500

United States

24 domains

24 controls

New York State Department of Financial Services Cybersecurity Regulation, Second Amendment (effective Nov 2023).

Verified

NY DFS 23 NYCRR 500 is a compliance framework from United States with 24 domains and 24 controls that map to 10 other frameworks. The largest domains are §500.1 (1 controls), §500.10 (1 controls), §500.11 (1 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (24)

§500.1

1 controls

§500.10

1 controls

Controls in the §500.10 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.10	Cybersecurity Personnel and Intelligence	Utilize qualified cybersecurity personnel sufficient to manage cybersecurity risks and perform core functions, provide c...

§500.11

1 controls

Controls in the §500.11 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.11	Third Party Service Provider Security Policy	Implement written policies and procedures for security of information systems and Nonpublic Information accessible to or...

§500.12

1 controls

Controls in the §500.12 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.12	Multi-Factor Authentication	MFA required for any individual accessing the Covered Entity's information systems. Specifically required for remote acc...

§500.13

1 controls

Controls in the §500.13 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.13	Asset Management and Data Retention Requirements	Implement written policies and procedures for asset inventory tracking (hardware, software, and data including end-of-li...

§500.14

1 controls

Controls in the §500.14 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.14	Monitoring and Training	Implement risk-based controls including monitoring of authorized user activity and detection of unauthorized access or t...

§500.15

1 controls

Controls in the §500.15 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.15	Encryption of Nonpublic Information	Implement controls including encryption to protect Nonpublic Information held or transmitted by the Covered Entity in tr...

§500.16

1 controls

Controls in the §500.16 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.16	Incident Response and Business Continuity Management	Establish written Incident Response Plan and Business Continuity and Disaster Recovery Plan reasonably designed to respo...

§500.17

1 controls

Controls in the §500.17 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.17	Notices to Superintendent	Notify the Superintendent within 72 hours of a Cybersecurity Incident affecting the Covered Entity. Provide notice of ex...

§500.18

1 controls

Controls in the §500.18 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.18	Confidentiality	Information provided to the Superintendent under Part 500 is subject to exemptions from disclosure under applicable conf...

§500.19

1 controls

Controls in the §500.19 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.19	Exemptions	Limited Exemption for entities with fewer than 20 employees and independent contractors, less than $7.5M gross annual re...

§500.2

1 controls

Controls in the §500.2 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.2	Cybersecurity Program	Maintain a written cybersecurity program based on the Risk Assessment that performs the core functions: identify, protec...

§500.20

1 controls

Controls in the §500.20 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.20	Enforcement	Regulation enforced by the Superintendent under Banking Law, Insurance Law, and Financial Services Law. A single act of...

§500.21

1 controls

Controls in the §500.21 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.21	Effective Date	Part 500 took effect March 1, 2017. The Second Amendment took effect November 1, 2023 with transitional periods for spec...

§500.22

1 controls

Controls in the §500.22 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.22	Transitional Periods	Provides phased transitional compliance periods for new and amended requirements (commonly 180 days, one year, 18 months...

§500.23

1 controls

Controls in the §500.23 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.23	Severability	If any provision of Part 500 is held invalid, the remainder of the regulation remains in effect.

§500.24

1 controls

Controls in the §500.24 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.24 (Second Amendment, Class A Companies)	Class A Company Enhanced Obligations (cross-section)	Class A Companies face enhanced obligations: independent audits of cybersecurity program based on risk, external pen tes...

§500.3

1 controls

Controls in the §500.3 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.3	Cybersecurity Policy	Implement and maintain written policies approved at least annually by a Senior Officer or Senior Governing Body addressi...

§500.4

1 controls

Controls in the §500.4 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.4	Cybersecurity Governance (CISO)	Designate a qualified CISO responsible for overseeing and implementing the program and enforcing policy. CISO reports in...

§500.5

1 controls

Controls in the §500.5 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.5	Vulnerability Management	Conduct penetration testing at least annually by qualified internal or external party, automated scans of information sy...

§500.6

1 controls

Controls in the §500.6 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.6	Audit Trail	Securely maintain systems that, based on Risk Assessment, are designed to reconstruct material financial transactions an...

§500.7

1 controls

Controls in the §500.7 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.7	Access Privileges and Management	Limit user access privileges to Nonpublic Information based on least privilege, limit privileged accounts, periodically...

§500.8

1 controls

Controls in the §500.8 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.8	Application Security	Cybersecurity program shall include written procedures, guidelines, and standards for secure development practices for i...

§500.9

1 controls

Controls in the §500.9 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.9	Risk Assessment	Conduct a written Risk Assessment of the Covered Entity's information systems, reviewed and updated at least annually an...

Your Compliance Coverage

If you comply with NY DFS 23 NYCRR 500, you already cover:

ISO 31000:2018

2 controls mapped

Compare →

ISO 27002:2022

2 controls mapped

Compare →

ISO 27018

1 controls mapped

Compare →

+ 7 more: ISO/IEC 27018:2019 (4%), ISO 19011 (4%)

See all 10 mapped frameworks ↓

Maps to 10 other frameworks

23 total controls

ISO 31000:2018

2 source controls mapped|2 target controls covered

ISO 27002:2022

2 source controls mapped|2 target controls covered

ISO 27018