NY DFS 23 NYCRR 500

United States

23 domains

23 controls

New York State Department of Financial Services Cybersecurity Regulation, Second Amendment (effective Nov 2023).

Verified

NY DFS 23 NYCRR 500 is a compliance framework from United States with 23 domains and 23 controls that map to 5 other frameworks. The largest domains are §500.10 (1 controls), §500.11 (1 controls), §500.12 (1 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (23)

§500.10

1 controls

Controls in the §500.10 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.10	Cybersecurity Personnel and Intelligence	Utilize qualified cybersecurity personnel sufficient to manage cybersecurity risks and perform core functions, provide c...

§500.11

1 controls

Controls in the §500.11 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.11	Third Party Service Provider Security Policy	Implement written policies and procedures for security of information systems and Nonpublic Information accessible to or...

§500.12

1 controls

Controls in the §500.12 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.12	Multi-Factor Authentication	MFA required for any individual accessing the Covered Entity's information systems. Specifically required for remote acc...

§500.13

1 controls

Controls in the §500.13 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.13	Asset Management and Data Retention Requirements	Implement written policies and procedures for asset inventory tracking (hardware, software, and data including end-of-li...

§500.14

1 controls

Controls in the §500.14 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.14	Monitoring and Training	Implement risk-based controls including monitoring of authorized user activity and detection of unauthorized access or t...

§500.15

1 controls

Controls in the §500.15 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.15	Encryption of Nonpublic Information	Implement controls including encryption to protect Nonpublic Information held or transmitted by the Covered Entity in tr...

§500.16

1 controls

Controls in the §500.16 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.16	Incident Response and Business Continuity Management	Establish written Incident Response Plan and Business Continuity and Disaster Recovery Plan reasonably designed to respo...

§500.17

1 controls

Controls in the §500.17 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.17	Notices to Superintendent	Notify the Superintendent within 72 hours of a Cybersecurity Incident affecting the Covered Entity. Provide notice of ex...

§500.18

1 controls

Controls in the §500.18 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.18	Confidentiality	Information provided to the Superintendent under Part 500 is subject to exemptions from disclosure under applicable conf...

§500.19

1 controls

Controls in the §500.19 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.19	Exemptions	Limited Exemption for entities with fewer than 20 employees and independent contractors, less than $7.5M gross annual re...

§500.2

1 controls

Controls in the §500.2 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.2	Cybersecurity Program	Maintain a written cybersecurity program based on the Risk Assessment that performs the core functions: identify, protec...

§500.20

1 controls

Controls in the §500.20 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.20	Enforcement	Regulation enforced by the Superintendent under Banking Law, Insurance Law, and Financial Services Law. A single act of...

§500.21

1 controls

Controls in the §500.21 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.21	Effective Date	Part 500 took effect March 1, 2017. The Second Amendment took effect November 1, 2023 with transitional periods for spec...

§500.22

1 controls

Controls in the §500.22 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.22	Transitional Periods	Provides phased transitional compliance periods for new and amended requirements (commonly 180 days, one year, 18 months...

§500.23

1 controls

Controls in the §500.23 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.23	Severability	If any provision of Part 500 is held invalid, the remainder of the regulation remains in effect.

§500.24

1 controls

Controls in the §500.24 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.24 (Second Amendment, Class A Companies)	Class A Company Enhanced Obligations (cross-section)	Class A Companies face enhanced obligations: independent audits of cybersecurity program based on risk, external pen tes...

§500.3

1 controls

Controls in the §500.3 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.3	Cybersecurity Policy	Implement and maintain written policies approved at least annually by a Senior Officer or Senior Governing Body addressi...

§500.4

1 controls

Controls in the §500.4 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.4	Cybersecurity Governance (CISO)	Designate a qualified CISO responsible for overseeing and implementing the program and enforcing policy. CISO reports in...

§500.5

1 controls

Controls in the §500.5 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.5	Vulnerability Management	Conduct penetration testing at least annually by qualified internal or external party, automated scans of information sy...

§500.6

1 controls

Controls in the §500.6 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.6	Audit Trail	Securely maintain systems that, based on Risk Assessment, are designed to reconstruct material financial transactions an...

§500.7

1 controls

Controls in the §500.7 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.7	Access Privileges and Management	Limit user access privileges to Nonpublic Information based on least privilege, limit privileged accounts, periodically...

§500.8

1 controls

Controls in the §500.8 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.8	Application Security	Cybersecurity program shall include written procedures, guidelines, and standards for secure development practices for i...

§500.9

1 controls

Controls in the §500.9 domain of NY DFS 23 NYCRR 500 — 1 controls
Code	Title	Description
§500.9	Risk Assessment	Conduct a written Risk Assessment of the Covered Entity's information systems, reviewed and updated at least annually an...

Your Compliance Coverage

If you comply with NY DFS 23 NYCRR 500, you already cover:

ISO 27002:2022

70%

16 controls mapped

Compare →

ISO 27018:2019

1 controls mapped

Compare →

ISO 27001:2022

1 controls mapped

Compare →

+ 2 more: ISO 22301:2019 (4%), ISO/IEC 23894:2023 (4%)

See all 5 mapped frameworks ↓

Maps to 5 other frameworks

23 total controls

ISO 27002:2022

16 source controls mapped|21 target controls covered

70%

ISO 27018:2019

1 source controls mapped|1 target controls covered

ISO 27001:2022

1 source controls mapped|1 target controls covered

ISO 22301:2019

1 source controls mapped|2 target controls covered

ISO/IEC 23894:2023

1 source controls mapped|1 target controls covered

Compare NY DFS 23 NYCRR 500 with ISO 27002:2022

Coverage is not the same as your position

This page shows what NY DFS 23 NYCRR 500 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is NY DFS 23 NYCRR 500 and who does it apply to?

NY DFS 23 NYCRR 500 is a compliance framework from United States with 23 domains and 23 controls. New York State Department of Financial Services Cybersecurity Regulation, Second Amendment (effective Nov 2023). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does NY DFS 23 NYCRR 500 actually require?

NY DFS 23 NYCRR 500 has 23 controls organised across 23 domains. The largest domains are §500.10 (1 controls), §500.11 (1 controls), §500.12 (1 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of NY DFS 23 NYCRR 500 do I already cover?

NY DFS 23 NYCRR 500 maps to 5 other compliance frameworks. The top mapping partners are ISO 27002:2022 (70% coverage), ISO 27018:2019 (4% coverage), ISO 27001:2022 (4% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement NY DFS 23 NYCRR 500?

Start your NY DFS 23 NYCRR 500 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NY DFS 23 NYCRR 500 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 23 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 868 frameworks.

Get Started Free →

Free forever — no credit card required