NYDFS Part 500, New York financial cybersecurity
23 NYCRR Part 500
- Hva siden er
- NYDFS Part 500, New York financial cybersecurity
- Lest mot offisiell kilde
- 2026-08-15Endret
- Ansvarlig utgiver
- ExploreWorld Legal, redaksjonenAnsvarsposisjon
Kort svar
Does NYDFS Part 500 apply to your operation, and which paragraph decides?
NYDFS Part 500 rests on 23 NYCRR Part 500 and is tested here by a deterministic rule tree of 7 rules with a coverage score of 100 percent. The tree reads your facts, names the paragraph that decides the question and returns an outcome carrying citation, content hash and read date 2026-08-15. The outcome is a machine classification, not a compliance decision.
23 NYCRR Part 500Lest mot utgiveren 2026-08-15
En kildehenvisning, ikke juridisk rådgivning.
- Jurisdiksjon
- Delstat NY
- Risikodimensjoner
- sikkerhet, virksomhet, finansiell rapportering
- Klasse
- Klasse 1
- Dekning
- 100 %
- Påvirkning
- 5/5
- Lest
- 2026-08-15
Kildekjede
Hver blokk i registerlinjen har egen adresse, så et utfall kan siteres ned til paragrafnivå. Noden bærer henvisningen, omfanget, lenken til den offisielle teksten og de utfallene i treet som hviler på blokken.
- Cybersecurity program and policy
23 NYCRR 500.2 and 500.3
A documented programme and a policy approved by the board or a senior officer.
- Chief Information Security Officer
23 NYCRR 500.4
A named officer and an annual written report to the governing body.
- Multi-factor authentication
23 NYCRR 500.12
Multi-factor authentication for remote and privileged access.
- Notice of a cybersecurity event
23 NYCRR 500.17
Notice to the supervisor within 72 hours, and an annual certification.
Regeltreet
Reglene prøves ovenfra og ned. Vilkårene er hentet fra regelteksten, og utfallet viser til de blokkene i registerlinjen det hviler på.
nydfs-incident
Notice of the cybersecurity event is late
forbudt · Kravet gjelder · incident
23 NYCRR 500.17(a) requires notice to the supervisor as promptly as possible and no later than 72 hours after determining that the event is notifiable. 23 NYCRR 500.17(b) requires an annual certification.
nydfs-exempt
A limited exemption applies, the core requirements remain
risiko · Kravet gjelder betinget · program, incident
23 NYCRR 500.19 exempts certain smaller entities from parts of the regulation. The exemption does not cover the program and policy in 500.2 and 500.3, the risk assessment in 500.9 or the notice in 500.17.
nydfs-program
A documented program and an approved policy are absent
forbudt · Kravet gjelder · program
23 NYCRR 500.2 requires a documented cybersecurity program based on the risk assessment, and 23 NYCRR 500.3 requires a written policy approved by the board or a senior officer.
nydfs-mfa
Multi-factor authentication is absent
forbudt · Kravet gjelder · mfa
23 NYCRR 500.12 requires multi-factor authentication for all remote access to the network, for access to third party applications holding nonpublic information and for privileged accounts.
nydfs-ciso
No chief information security officer is appointed
risiko · Kravet gjelder · ciso
23 NYCRR 500.4 requires a designated chief information security officer and an annual written report to the board or an equivalent body.
nydfs-risk
The risk assessment or the supplier policy is absent
risiko · Kravet gjelder betinget · program
23 NYCRR 500.9 requires a current and documented risk assessment, and 23 NYCRR 500.11 requires a third party service provider policy with contractual requirements.
nydfs-base
The regulation applies to the business
risiko · Kravet gjelder · program, ciso, mfa, incident
23 NYCRR Part 500 applies to every entity licensed under New York banking, insurance or financial services law. The requirements cover the program, the responsible function, authentication and notice.
Utfall
tillatt · Utenfor virkeområdet
The rule yields no requirement for the facts supplied
The business is not stated to be a covered entity under 23 NYCRR 500.1.
fallback · sha256:sha256:b616f85f68c6951bd1f878c9c
Overvåking
Journalen viser hva som har rørt seg i registerlinjen, med hash før og etter. Påvirkningstallet regnes ut etter en regel som står skrevet i klartekst.
Slik regnes påvirkning: Grund: tillagd eller borttagen uppgift ger 3, ändrad uppgift 2, omläsning utan ändring 0. Tillägg: +1 när ändringen rör status eller tillämpningsdatum. Tillägg: +1 när agenten ligger i klass 1. Siffran begränsas till 0 till 5.
2026-08-15 · 0/5 · lasning
Raden läst mot den officiella publiceringen utan ändring
2023-11-01 · 4/5 · tillampningsdatum, status
Regeln började tillämpas enligt utgivaren
2017-03-01 · 5/5 · antagande, identifierare, status
Regeln antogs enligt 23 NYCRR Part 500
Tilsyn
Motsvarigheter i EU
- nis2-2022-2555 · Båda texterna pekar ut en ansvarig funktion, kräver rapport till ledningsorganet och sätter en tidig anmälan av allvarliga incidenter. EU-texten gäller väsentliga verksamheter, delstatsregeln finansiella bolag med tillstånd.
Artefakter og integritet
- https://legal.exploreworldai.com/api/public/v1/us-agents/nydfs-500/manifest.json
- https://legal.exploreworldai.com/api/public/v1/us-agents/nydfs-500/run
- https://legal.exploreworldai.com/api/public/v1/us-agents/nydfs-500/monitor.json
- sha256:e6ce103c3d94d5258773894261a910f200a806437deda10668cdc2b2c113c065
- sha256:34e076130ec194f1ce71e0ec14d88a6ed7e096cecfed73c2bd151a8ad78bb205
Verdiktet er en maskinell klassifisering av utfallet, ikke juridisk rådgivning og ikke en etterlevelsesbeslutning. Ansvarsposisjon · 23 NYCRR Part 500
Kontrollerbare tillitssignaler
- Seks faste blokker, én kilde per linje
- Ingen setning skrevet av en språkmodell
- Motorversjon og lesedato på hvert svar
- Ingen kundedata, ingen dokumenter, ingen rådgivning
- Modellkort og revisjon publisert etter AI-forordningen