NYDFS Cybersecurity Regulation
23 NYCRR Part 500 · Read 2026-08-15
In force since 2017. The second amendment took effect on 1 November 2023, with transitional dates running to November 2025.
Identifier
- Identifier
- 23 NYCRR Part 500
- Level
- State NY
- Status
- Phased
- Adopted
- 2017-03-01
- Applies from
- 2023-11-01
- Supervisory bodies
- NYDFS
Named requirements
Cybersecurity program and policy
23 NYCRR 500.2 and 500.3
A documented programme and a policy approved by the board or a senior officer.
Chief Information Security Officer
23 NYCRR 500.4
A named officer and an annual written report to the governing body.
Multi-factor authentication
23 NYCRR 500.12
Multi-factor authentication for remote and privileged access.
Notice of a cybersecurity event
23 NYCRR 500.17
Notice to the supervisor within 72 hours, and an annual certification.
Official source
EU acts on the same ground
- CELEX 32022L2555
Both texts name a responsible function, require reporting to the governing body and set an early notice for significant incidents. The EU text covers essential entities, the state rule covers licensed financial firms.
United States case law
10 decisions · Read from CourtListener, Free Law Project on 2026-08-22.
- Plump v. Government Employees Insurance Company
10th Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Tenth Circuit when you click. No permanent storage on our side.
- B & L Productions, Inc. v. Newsom
9th Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Ninth Circuit when you click. No permanent storage on our side.
- National Rifle Association of America v. Vullo
602 U.S. 175SCOTUSFinal, the decision cannot be appealed
Ask NovaCopilotGet the opinionRetrieved directly from Supreme Court of the United States when you click. No permanent storage on our side.
- Cantero v. Bank of Am., N.A.
2d Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Second Circuit when you click. No permanent storage on our side.
- United States v. Skelos
988 F.3d 6452d Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Second Circuit when you click. No permanent storage on our side.
- University of Puerto Rico Retirement System v. Ocwen Financial Corporation
934 F.3d 130711th Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Eleventh Circuit when you click. No permanent storage on our side.
- Lula Williams v. Big Picture Loans, LLC
929 F.3d 1704th Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Fourth Circuit when you click. No permanent storage on our side.
- City of Cambridge Retirement v. Altisource Asset Management Co
908 F.3d 8723rd Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Third Circuit when you click. No permanent storage on our side.
- City of Cambridge Retirement v. Altisource Asset Management Co
3rd Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Third Circuit when you click. No permanent storage on our side.
- Wadsworth v. Allied Professionals Insurance
748 F.3d 1002d Cir.Open to review by a higher court, the source does not state the outcome
Ask NovaCopilotGet the opinionRetrieved directly from Court of Appeals for the Second Circuit when you click. No permanent storage on our side.
Change monitoring
The row is re-read against the publisher's own publication on a fixed interval. The dates below can be checked on the spot and travel with the API response.
| Field | Value |
|---|---|
| Register | NYDFS, 23 NYCRR Part 500 |
| Publisher | New York State Department of Financial Services |
| Last read | 2026-08-15 |
| Interval | Every 30 days |
| Next re-read | 2026-09-14 |
| Status | Re-read overdue |
Row history
Dated events concerning this exact row, newest first. No event appears here without a date in a primary source.
| Date | Event | Source |
|---|---|---|
| 2026-08-15 | Row read against the official publication | New York State Department of Financial Services |
| 2023-11-01 | Date of application according to the publisher | New York State Department of Financial Services |
| 2017-03-01 | Adopted under 23 NYCRR Part 500 | New York State Department of Financial Services |
Monitoring states when the row was checked, not how the legal position should be assessed.
Cite this row
The string below travels with a memo, a case file or an agent chain. The same string sits in the citation field of the API response.
23 NYCRR Part 500, NYDFS Cybersecurity Regulation. NovaCopilot, https://legal.exploreworldai.com/us/regler/nydfs-cybersecurity (hämtad 2026-10-21, bevis sha256:1228735b23105bde, bygge legal-2026-10-21).
- sha256:
- 1228735b23105bdeb592f8fafb8539c4bfe120a80217e4d2deba5be5d834c7d3
- hämtad:
- 2026-10-21
- source_confidence:
- derived
- bygge:
- legal-2026-10-21
- officiell källa:
- https://www.dfs.ny.gov/
Derived path to the publisher. The address is built from the identifier and lands in the publisher's own register. dfs.ny.gov.
The row is a source reference with an official identifier. No legal advice and no compliance decision.
Verifiable trust signals
- Source-linked answers and explicit evidence gaps
- Obligations, controls, risks and consequences
- Stable objects and verifiable checksums
- Rule-based objects, optional source-linked reasoning
- Model card, source status and audit