NYDFS Part 500, New York financial cybersecurity

23 NYCRR Part 500

What this page is: NYDFS Part 500, New York financial cybersecurity
Checked against the official source: 2026-08-15Changed
Responsible publisher: ExploreWorld Legal, editorial deskLiability position

Short answer

Does NYDFS Part 500 apply to your operation, and which paragraph decides?

NYDFS Part 500 rests on 23 NYCRR Part 500 and is tested here by a deterministic rule tree of 7 rules with a coverage score of 100 percent. The tree reads your facts, names the paragraph that decides the question and returns an outcome carrying citation, content hash and read date 2026-08-15. The outcome is a machine classification, not a compliance decision.

23 NYCRR Part 500Checked against the publisher 2026-08-15

A source reference, not legal advice.

Jurisdiction: State NY
Risk dimensions: security, operations, financial reporting
Tier: Tier 1
Coverage: 100 %
Impact: 5/5
Read: 2026-08-15

Source chain

Every block in the register row has its own address, so an outcome can be cited down to the paragraph. The node carries the reference, the scope, the link to the official text and the outcomes in the tree that rest on the block.

Cybersecurity program and policy
23 NYCRR 500.2 and 500.3
A documented programme and a policy approved by the board or a senior officer.
Chief Information Security Officer
23 NYCRR 500.4
A named officer and an annual written report to the governing body.
Multi-factor authentication
23 NYCRR 500.12
Multi-factor authentication for remote and privileged access.
Notice of a cybersecurity event
23 NYCRR 500.17
Notice to the supervisor within 72 hours, and an annual certification.

Rule tree

Rules are tested top down. Conditions are statutory elements and each outcome points to the register blocks it rests on.

nydfs-incident
Notice of the cybersecurity event is late
prohibited · Requirement applies · incident
23 NYCRR 500.17(a) requires notice to the supervisor as promptly as possible and no later than 72 hours after determining that the event is notifiable. 23 NYCRR 500.17(b) requires an annual certification.
nydfs-exempt
A limited exemption applies, the core requirements remain
risk · Requirement applies conditionally · program, incident
23 NYCRR 500.19 exempts certain smaller entities from parts of the regulation. The exemption does not cover the program and policy in 500.2 and 500.3, the risk assessment in 500.9 or the notice in 500.17.
nydfs-program
A documented program and an approved policy are absent
prohibited · Requirement applies · program
23 NYCRR 500.2 requires a documented cybersecurity program based on the risk assessment, and 23 NYCRR 500.3 requires a written policy approved by the board or a senior officer.
nydfs-mfa
Multi-factor authentication is absent
prohibited · Requirement applies · mfa
23 NYCRR 500.12 requires multi-factor authentication for all remote access to the network, for access to third party applications holding nonpublic information and for privileged accounts.
nydfs-ciso
No chief information security officer is appointed
risk · Requirement applies · ciso
23 NYCRR 500.4 requires a designated chief information security officer and an annual written report to the board or an equivalent body.
nydfs-risk
The risk assessment or the supplier policy is absent
risk · Requirement applies conditionally · program
23 NYCRR 500.9 requires a current and documented risk assessment, and 23 NYCRR 500.11 requires a third party service provider policy with contractual requirements.
nydfs-base
The regulation applies to the business
risk · Requirement applies · program, ciso, mfa, incident
23 NYCRR Part 500 applies to every entity licensed under New York banking, insurance or financial services law. The requirements cover the program, the responsible function, authentication and notice.

Outcome

allowed · Outside the scope

The rule yields no requirement for the facts supplied

The business is not stated to be a covered entity under 23 NYCRR 500.1.

fallback · sha256:sha256:b616f85f68c6951bd1f878c9c

Monitoring

The journal shows what moved in the register row, with the hash before and after. The impact score follows a rule stated in plain words.

How impact is scored: Grund: tillagd eller borttagen uppgift ger 3, ändrad uppgift 2, omläsning utan ändring 0. Tillägg: +1 när ändringen rör status eller tillämpningsdatum. Tillägg: +1 när agenten ligger i klass 1. Siffran begränsas till 0 till 5.

2026-08-15 · 0/5 · lasning
Raden läst mot den officiella publiceringen utan ändring
2023-11-01 · 4/5 · tillampningsdatum, status
Regeln började tillämpas enligt utgivaren
2017-03-01 · 5/5 · antagande, identifierare, status
Regeln antogs enligt 23 NYCRR Part 500

Supervision

New York State Department of Financial Services

European counterparts

nis2-2022-2555 · Båda texterna pekar ut en ansvarig funktion, kräver rapport till ledningsorganet och sätter en tidig anmälan av allvarliga incidenter. EU-texten gäller väsentliga verksamheter, delstatsregeln finansiella bolag med tillstånd.

Artifacts and integrity

https://legal.exploreworldai.com/api/public/v1/us-agents/nydfs-500/manifest.json
https://legal.exploreworldai.com/api/public/v1/us-agents/nydfs-500/run
https://legal.exploreworldai.com/api/public/v1/us-agents/nydfs-500/monitor.json
sha256:e6ce103c3d94d5258773894261a910f200a806437deda10668cdc2b2c113c065
sha256:34e076130ec194f1ce71e0ec14d88a6ed7e096cecfed73c2bd151a8ad78bb205

The verdict is a machine classification of the outcome, not legal advice and not a compliance decision. Responsibility position · 23 NYCRR Part 500

Verifiable trust signals

Six fixed blocks, one source per line
No sentence written by a language model
Engine version and read date on every answer
No customer data, no documents, no advice
Model card and audit published under the EU AI Act

Model card Audit