NYDFS Cybersecurity Regulation
23 NYCRR Part 500 · Read 2026-08-15
In force since 2017. The second amendment took effect on 1 November 2023, with transitional dates running to November 2025.
Identifier
- Identifier
- 23 NYCRR Part 500
- Level
- State NY
- Status
- Phased
- Adopted
- 2017-03-01
- Applies from
- 2023-11-01
- Supervisory bodies
- NYDFS
Named requirements
Cybersecurity program and policy
23 NYCRR 500.2 and 500.3
A documented programme and a policy approved by the board or a senior officer.
Chief Information Security Officer
23 NYCRR 500.4
A named officer and an annual written report to the governing body.
Multi-factor authentication
23 NYCRR 500.12
Multi-factor authentication for remote and privileged access.
Notice of a cybersecurity event
23 NYCRR 500.17
Notice to the supervisor within 72 hours, and an annual certification.
Official source
EU acts on the same ground
- CELEX 32022L2555
Both texts name a responsible function, require reporting to the governing body and set an early notice for significant incidents. The EU text covers essential entities, the state rule covers licensed financial firms.
United States case law
10 decisions · Read from CourtListener, Free Law Project on 2026-08-22.
- Plump v. Government Employees Insurance Company
10th Cir.Open to review by a higher court, the source does not state the outcome
- B & L Productions, Inc. v. Newsom
9th Cir.Open to review by a higher court, the source does not state the outcome
- National Rifle Association of America v. Vullo
602 U.S. 175SCOTUSFinal, the decision cannot be appealed
- Cantero v. Bank of Am., N.A.
2d Cir.Open to review by a higher court, the source does not state the outcome
- United States v. Skelos
988 F.3d 6452d Cir.Open to review by a higher court, the source does not state the outcome
- University of Puerto Rico Retirement System v. Ocwen Financial Corporation
934 F.3d 130711th Cir.Open to review by a higher court, the source does not state the outcome
- Lula Williams v. Big Picture Loans, LLC
929 F.3d 1704th Cir.Open to review by a higher court, the source does not state the outcome
- City of Cambridge Retirement v. Altisource Asset Management Co
908 F.3d 8723rd Cir.Open to review by a higher court, the source does not state the outcome
- City of Cambridge Retirement v. Altisource Asset Management Co
3rd Cir.Open to review by a higher court, the source does not state the outcome
- Wadsworth v. Allied Professionals Insurance
748 F.3d 1002d Cir.Open to review by a higher court, the source does not state the outcome
Change monitoring
The row is re-read against the publisher's own publication on a fixed interval. The dates below can be checked on the spot and travel with the API response.
| Field | Value |
|---|---|
| Register | NYDFS — 23 NYCRR Part 500 |
| Publisher | New York State Department of Financial Services |
| Last read | 2026-08-15 |
| Interval | Every 30 days |
| Next re-read | 2026-09-14 |
| Status | Checked against the publisher |
Row history
Dated events concerning this exact row, newest first. No event appears here without a date in a primary source.
| Date | Event | Source |
|---|---|---|
| 2026-08-15 | Row read against the official publication | New York State Department of Financial Services |
| 2023-11-01 | Date of application according to the publisher | New York State Department of Financial Services |
| 2017-03-01 | Adopted under 23 NYCRR Part 500 | New York State Department of Financial Services |
Monitoring states when the row was checked, not how the legal position should be assessed.
Cite this row
The string below travels with a memo, a case file or an agent chain. The same string sits in the citation field of the API response.
23 NYCRR Part 500, NYDFS Cybersecurity Regulation. ExploreWorld Legal, https://legal.exploreworldai.com/us/regler/nydfs-cybersecurity (hämtad 2026-08-25, bevis sha256:8b861579db165d25, bygge legal-2026-08-25).
- sha256:
- 8b861579db165d25e1a1ad8cd5bbd30696ed23e5ee633885737fb735d945341e
- hämtad:
- 2026-08-25
- source_confidence:
- derived
- bygge:
- legal-2026-08-25
- officiell källa:
- https://www.dfs.ny.gov/
Derived path to the publisher. The address is built from the identifier and lands in the publisher's own register. dfs.ny.gov.
The row is a source reference with an official identifier. No legal advice and no compliance decision.
Verifiable trust signals
- Six fixed blocks, one source per line
- No sentence written by a language model
- Engine version and read date on every answer
- No customer data, no documents, no advice
- Model card and audit published under the EU AI Act