How often must an NYDFS covered entity assess cyber risk?
The covered entity must conduct a periodic risk assessment sufficient to inform the design of its cybersecurity program and update it as reasonably necessary when business or technology changes cause a material change in cyber risk.
Dela sidan
Source
- Source
- 23 NYCRR § 500.9
- Source
- New York State Senate Open Legislation
- Area
- Financial services
- Source type
- regulation
- Status
- In force at the reading date
- Authority
- New York State Department of Financial Services
- Checked
- 2026-09-22
Questions
Who is a covered entity under NYDFS Part 500?23 NYCRR § 500.1(e)What must an NYDFS cybersecurity program do?23 NYCRR § 500.2Must an NYDFS covered entity designate a CISO?23 NYCRR § 500.4When does NYDFS Part 500 require multifactor authentication?23 NYCRR § 500.12When must an NYDFS covered entity report a cybersecurity incident?23 NYCRR § 500.17(a)Must an NYDFS covered entity report an extortion payment?23 NYCRR § 500.17(c)Does transmitting money in New York require a license?N.Y. Banking Law § 641When is a New York virtual-currency license required?23 NYCRR §§ 200.2 and 200.3
Nästa steg
Vill ni använda registret i eget arbete finns tre vägar in.
Börja med din uppgift
Advokat, tvist
Hitta stöd i avgörande
Sök i vägledande domar, se vad som vunnit laga kraft och följ ändringar i rättsläget.
Bolagsjurist, transaktion
Kartlägg regelverket i affären
Gå från tema till rättsakt och vidare till artikeln som bär kravet.
Compliance
Bedöm risken i en behandling
Riskklassning per rättsområde, med källorna bakom varje poäng.