{
  "attribution": {
    "product": "NovaCopilot",
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/us/agent/nydfs-500/program",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/us/agent/nydfs-500/program)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-08-25",
    "fingerprint": "ewai:eu:f7b899",
    "proof": "sha256:7c6a47aef57768a125d4f09c6df4692787d1c706167b4f3a9e2a2802953da471",
    "jurisdiction": "eu"
  },
  "layer": "us-agent-section",
  "agent": "nydfs-500",
  "slug": "program",
  "title": "Cybersecurity program and policy",
  "reference": "23 NYCRR 500.2 and 500.3",
  "scope": "A documented programme and a policy approved by the board or a senior officer.",
  "rule": "nydfs-cybersecurity",
  "identifier": "23 NYCRR Part 500",
  "jurisdiction_scope": [
    "state:NY"
  ],
  "risk_dimensions": [
    "security",
    "operational",
    "financial"
  ],
  "tier": 1,
  "deterministic": true,
  "llm_used": false,
  "verdict_kind": "machine-classification",
  "official_source": null,
  "register_source": null,
  "cited_by": [
    {
      "ruleId": "nydfs-exempt",
      "code": "nydfs-exempt",
      "title": "Ett begränsat undantag gäller, men kärnkraven kvarstår",
      "titleEn": "A limited exemption applies, the core requirements remain",
      "verdict": "risk",
      "audit": "KRAV_VILLKORAT",
      "obligation": "23 NYCRR 500.19 undantar vissa mindre verksamheter från delar av regeln. Undantaget omfattar inte programmet och policyn i 500.2 och 500.3, riskbedömningen i 500.9 eller anmälan i 500.17.",
      "obligationEn": "23 NYCRR 500.19 exempts certain smaller entities from parts of the regulation. The exemption does not cover the program and policy in 500.2 and 500.3, the risk assessment in 500.9 or the notice in 500.17."
    },
    {
      "ruleId": "nydfs-program",
      "code": "nydfs-program",
      "title": "Dokumenterat program och godkänd policy saknas",
      "titleEn": "A documented program and an approved policy are absent",
      "verdict": "förbjudet",
      "audit": "KRAV_GÄLLER",
      "obligation": "23 NYCRR 500.2 kräver ett dokumenterat cybersäkerhetsprogram grundat på riskbedömningen, och 23 NYCRR 500.3 kräver en skriftlig policy godkänd av styrelsen eller en ledande befattningshavare.",
      "obligationEn": "23 NYCRR 500.2 requires a documented cybersecurity program based on the risk assessment, and 23 NYCRR 500.3 requires a written policy approved by the board or a senior officer."
    },
    {
      "ruleId": "nydfs-risk",
      "code": "nydfs-risk",
      "title": "Riskbedömning eller leverantörspolicy saknas",
      "titleEn": "The risk assessment or the supplier policy is absent",
      "verdict": "risk",
      "audit": "KRAV_VILLKORAT",
      "obligation": "23 NYCRR 500.9 kräver en aktuell och dokumenterad riskbedömning, och 23 NYCRR 500.11 kräver en policy för tredjepartsleverantörer med krav i avtal.",
      "obligationEn": "23 NYCRR 500.9 requires a current and documented risk assessment, and 23 NYCRR 500.11 requires a third party service provider policy with contractual requirements."
    },
    {
      "ruleId": "nydfs-base",
      "code": "nydfs-base",
      "title": "Regeln gäller för verksamheten",
      "titleEn": "The regulation applies to the business",
      "verdict": "risk",
      "audit": "KRAV_GÄLLER",
      "obligation": "23 NYCRR Part 500 gäller varje verksamhet med tillstånd enligt New Yorks bank-, försäkrings- eller finanslagstiftning. Kraven omfattar program, ansvarig funktion, autentisering och anmälan.",
      "obligationEn": "23 NYCRR Part 500 applies to every entity licensed under New York banking, insurance or financial services law. The requirements cover the program, the responsible function, authentication and notice."
    }
  ],
  "checked_at": "2026-08-15",
  "canonical": "https://legal.exploreworldai.com/us/agent/nydfs-500/program",
  "agent_canonical": "https://legal.exploreworldai.com/us/agent/nydfs-500",
  "hash": "sha256:7c6a47aef57768a125d4f09c6df4692787d1c706167b4f3a9e2a2802953da471",
  "citation": "23 NYCRR Part 500, NYDFS Part 500, Cybersäkerhet för finansiella bolag i New York. NovaCopilot, https://legal.exploreworldai.com/us/agent/nydfs-500 (hämtad 2026-08-15, bevis sha256:a3923bb591f93b2c, bygge legal-2026-08-25).",
  "disclaimer": "Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.",
  "version": "legal-2026-08-25",
  "expires": "2026-09-24T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-08-25+legal-2026-08-25+2026-08-25T10:00:00",
    "content_hash": "sha256:7c6a47aef57768a125d4f09c6df4692787d1c706167b4f3a9e2a2802953da471",
    "revalidate_after": "2026-09-23T01:40:21.539Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "usageInfo": "https://legal.exploreworldai.com/citering"
}