NYDFS Part 500 Compliance Services for New York Financial Firms
Last updated:
About our expert
25+ years in technology and security · Active CISSP certification · 17 years at Payomatic, rising to CISO
Rashid Ahmed has led information security programs, risk assessments, technical safeguards, and audit preparation in financial-services environments. His experience includes implementing NYDFS Part 500 requirements, implementing PCI DSS controls to support Level 1 validation requirements, incident response, vendor risk management, and executive reporting.
Key Takeaways
NYDFS Part 500 (23 NYCRR 500) applies to firms that operate, or must operate, under a license, registration or charter issued under New York Banking, Insurance or Financial Services Law.
The final phase of the 2023 amendment took effect November 1, 2025, expanding MFA to individuals accessing a covered entity's information systems (§500.12) and adding a written asset inventory requirement (§500.13(a)). CISO-approved compensating controls are permitted, and firms using the §500.19(a) limited exemption have narrower MFA obligations.
Unless fully exempt, covered entities must submit an annual compliance notification by April 15: either a certification of material compliance or an acknowledgment of noncompliance. The highest-ranking executive and CISO sign; if there is no CISO, the executive signs with the senior officer responsible for the cybersecurity program (§500.17(b)).
BastionX carries out the risk assessment, implements and runs the technical controls, and can serve as your CISO. Penetration testing and the Class A independent audit are referred to PKF O'Connor Davies (PKFOD).
Your firm keeps responsibility for compliance, whoever runs the controls.
What Is NYDFS Part 500 (23 NYCRR 500)?
NYDFS Part 500, also called the NYDFS cybersecurity regulation or NYDFS 23 NYCRR 500, is the New York Department of Financial Services cybersecurity regulation for covered entities operating under specified New York regulatory authorizations. Subject to applicable exemptions, it requires a risk-based cybersecurity program, approved written policies, CISO oversight, technical safeguards, incident reporting and an annual compliance notification.
DFS first issued the regulation, formally 23 NYCRR Part 500, in March 2017. The Second Amendment, adopted in November 2023, rewrote much of it. It added governance duties for boards, a tier of larger "Class A" companies with extra obligations, ransomware and extortion payment reporting, and new technical controls. The changes phased in over two years, and the final phase took effect on November 1, 2025. Every requirement in the amended rule is now in force.
23 NYCRR Part 500: The New York cybersecurity regulation, titled "Cybersecurity Requirements for Financial Services Companies," issued by DFS and published in Title 23 of the New York Codes, Rules and Regulations.
The core requirements are a cybersecurity program (§500.2), written policies (§500.3), a CISO and board oversight (§500.4), vulnerability management (§500.5), access controls (§500.7), a risk assessment (§500.9), vendor policies (§500.11), MFA (§500.12), an asset inventory (§500.13), monitoring and training (§500.14), encryption (§500.15), incident response and recovery plans (§500.16), and notices and certification (§500.17). The DFS Cybersecurity Resource Center publishes the full text, FAQs and guidance.
Who Must Comply with NYDFS Part 500?
Part 500 applies to every "covered entity": any person operating, or required to operate, under a license, registration, charter, certificate or similar authorization under New York Banking Law, Insurance Law or Financial Services Law. Because DFS is a New York State department, you will also see the rule written as NYSDFS Part 500. In practice it covers state-chartered banks, insurers, insurance producers, mortgage bankers and brokers, mortgage servicers, money transmitters, and check cashers.
Coverage depends on the legal entity's DFS authorization. A firm based outside New York can still be a covered entity, and its cybersecurity program must address the covered entity's information systems and nonpublic information, subject to applicable exemptions. Your financial services firm may also have federal obligations, such as GLBA, that apply alongside Part 500.
Class A Companies
Class A companies are the largest covered entities, and Part 500 gives them extra duties. Under §500.1(d), a Class A company has at least $20 million in gross annual revenue in each of the last two fiscal years, counting its own operations and its affiliates' New York operations. It must also have either more than 2,000 employees on average over the last two fiscal years, or more than $1 billion in gross annual revenue in each of those years, counting affiliates wherever located. Only affiliates that share information systems, cybersecurity resources or part of a cybersecurity program with the firm are counted.
Class A companies must:
have independent audits of their cybersecurity program, based on their risk assessment (§500.2(c))
monitor privileged access, implement privileged access management, and automatically block commonly used passwords on systems they own or control and, where feasible, other accounts. If password blocking is infeasible, the CISO must approve that determination and reasonably equivalent or more secure compensating controls in writing at least annually (§500.7(c))
implement endpoint detection and response plus centralized logging and security event alerting, unless the CISO approves reasonably equivalent or more secure compensating controls in writing (§500.14(b))
Small Business Exemption (§500.19)
The limited exemption in §500.19(a) applies if your firm meets any one of three tests:
fewer than 20 employees and independent contractors, counting affiliates
less than $7.5 million in gross annual revenue in each of the last three fiscal years from all of the firm's business operations plus its affiliates' New York operations
less than $15 million in year-end total assets, counting affiliates
Firms qualifying for the limited exemption under §500.19(a) are excused from §§500.4, 500.5, 500.6, 500.8, 500.10, 500.14(a)(1), (a)(2) and (b), 500.15 and 500.16. Remaining obligations include a cybersecurity program, written policies, access controls, a risk assessment, vendor policies, an asset inventory, applicable secure-disposal procedures, and cybersecurity awareness training at least annually, including social engineering. These firms must also submit the annual compliance notification and applicable incident and extortion-payment notices.
Their MFA obligations cover remote access to their information systems, remote access to third-party applications from which nonpublic information is accessible, and privileged accounts, except service accounts that prohibit interactive login (§500.12(a)).
File a notice of exemption within 30 days of determining that you qualify under §500.19(a). If your eligibility changes, amend or terminate the notice. You have 180 days from the date you stop qualifying for an exemption to meet the requirements that then apply to your firm.
23 NYCRR 500 Requirements and Who Handles Each
The 23 NYCRR Part 500 requirements below each have an owner. BastionX implements and runs the technical controls and performs the risk assessment. PKFOD handles penetration testing and the Class A independent audit. Your leadership approves policies, oversees the program and signs the certification.
Section | What it requires | Who handles it |
|---|---|---|
§500.2 Program | Risk-based cybersecurity program; Class A independent audit | BastionX helps build and maintain it; your firm owns it; PKFOD performs the Class A audit |
§500.3 Policies | Written policies, approved at least annually by senior leadership | BastionX drafts; your leadership approves |
§500.4 CISO and governance | A qualified CISO who reports to the board at least annually | Rashid Ahmed through our vCISO service, or your own CISO |
§500.5 Vulnerability management | Automated scans, manual review, annual penetration test | BastionX scans and remediates; PKFOD performs the penetration test |
§500.6 Audit trails | Records to reconstruct material financial transactions kept at least five years; audit trails for cybersecurity events kept at least three years | Your firm assigns owners for business records; BastionX retains security logs within the engagement |
§500.7 Access privileges | Least privilege, privileged account limits, annual access reviews | BastionX implements and reviews |
§500.8 Application security | Written practices for secure in-house development and for assessing external applications, reviewed at least annually | Your application owners and developers, with review by the CISO or a qualified designee |
§500.9 Risk assessment | Documented assessment, updated at least annually | BastionX performs |
§500.10 Cybersecurity personnel | Qualified cybersecurity personnel with training and current knowledge of threats and countermeasures | Your firm and its contracted providers; BastionX staffs the work in its engagement |
§500.11 Third-party providers | Vendor due diligence, contracts, monitoring | BastionX drafts the policy and reviews technical safeguards; your team owns vendor decisions |
§500.12 MFA | MFA for individuals accessing the firm's information systems, subject to applicable exemptions and permitted CISO-approved compensating controls; narrower MFA obligations apply under §500.19(a) | BastionX deploys and manages |
§500.13 Asset inventory and data retention | Written inventory procedures, a complete and accurate inventory, and applicable secure-disposal procedures | BastionX builds and maintains |
§500.14 Monitoring and training | Monitoring, malicious code protection, annual training; Class A EDR and logging | BastionX operates monitoring and delivers training |
§500.15 Encryption | Encryption of nonpublic information over external networks and at rest, with a permitted alternative where at-rest encryption is infeasible | BastionX configures and manages |
§500.16 Incident response and BCDR | Written plans, protected backups, annual testing | BastionX builds plans and runs tests with your team |
§500.17 Notices and certification | Prompt incident notice within 72 hours; extortion-payment notices; annual compliance notification by April 15 | Your firm submits the required notices. The annual compliance notification is signed by the highest-ranking executive and CISO, or the executive and responsible senior officer if there is no CISO. |
Your firm remains responsible for every requirement that applies to it, including work performed by BastionX or another provider. Apply the §500.19 exemptions and any permitted control-specific alternatives when deciding which requirements apply.
Risk Assessment (§500.9)
The NYDFS risk assessment is a documented evaluation of the risks to your information systems and nonpublic information. Part 500 requires you to review and update it at least annually, and whenever a business or technology change materially affects your cyber risk. BastionX carries out the risk assessment, and its findings set the program, policies and controls.
Changes that trigger an update include major system migrations, mergers and significant new outsourcing. On September 10, 2026, DFS issued guidance on how to conduct and use risk assessments. The letter says it does not create new obligations. DFS does not require a specific method, but it expects:
consistent likelihood and impact ratings, so results compare year to year
a distinction between inherent and residual risk, with an evaluation of how well existing controls work
documented risk acceptance decisions, with the justification
a current asset inventory as the starting input
The letter also lists deficiencies DFS has seen: outdated inventories and unmapped nonpublic information, missing third-party and cloud environments, inconsistent methods, unassigned ownership, no update after material changes, and assessments that do not shape policies or budgets.
Multi-Factor Authentication and Access Privileges (§§500.12, 500.7)
Since November 1, 2025, NYDFS MFA requirements generally cover any individual accessing a covered entity's information systems, subject to applicable exemptions, including the narrower MFA obligations under §500.19(a) (§500.12). A CISO may approve reasonably equivalent or more secure compensating controls in writing, reviewed at least annually. Access privileges under §500.7 must follow least privilege and be reviewed at least once a year.
The DFS FAQs say push-based approvals without added safeguards give weakened assurance, and that single sign-on alone does not meet §500.12 unless MFA is enforced at the SSO login. Under §500.7, firms must limit privileged accounts, review access at least annually, and remove access promptly when someone leaves. Class A companies must implement privileged access management and meet the password-blocking requirements of §500.7(c), including its permitted compensating-control alternative where password blocking is infeasible.
BastionX implements these controls through Microsoft Entra ID, Microsoft 365 and Intune: conditional access, phishing-resistant MFA where supported, privileged role limits and scheduled access reviews. We also run CipherNet, BastionX's own fork of an open source WireGuard mesh platform, which we maintain, host and operate, for encrypted connections between users and sites. Zero Trust access and CipherNet are implementation choices. Part 500 does not require either.
Asset Inventory (§500.13(a))
Since November 1, 2025, §500.13(a) requires written policies and procedures for a complete, documented NYDFS asset inventory of your information systems. The inventory tracks each system's owner, location, classification or sensitivity, support expiration date and recovery time objectives where applicable. Written policies and procedures specify how often the inventory is updated and validated.
The inventory feeds the risk assessment, and the September 2026 letter names incomplete inventories as a common deficiency. BastionX maintains inventory records for systems within our engagement and coordinates with your team and other providers to account for the covered entity's remaining information systems. The inventory is updated and validated according to your written procedures.
Vulnerability Scanning and Penetration Testing (§500.5)
Section 500.5 requires automated vulnerability scans at a frequency set by your risk assessment and promptly after material system changes, manual review of systems the scans do not cover, and timely remediation prioritized by risk. It also requires a penetration test at least annually, from inside and outside your system boundaries, by a qualified internal or external party.
BastionX runs automated internal vulnerability scanning, including through the Bastion Core security device, and remediates findings by risk. We refer the annual penetration test to PKFOD, so the test is run by a team separate from the one managing your systems.
Monitoring, Logging and Endpoint Protection (§500.14)
Subject to applicable exemptions, §500.14 requires monitoring of authorized-user activity, controls against malicious code, and cybersecurity awareness training for all personnel at least annually, including social engineering. Firms using the §500.19(a) limited exemption are excused from the monitoring and malicious-code provisions but remain subject to the training requirement. Class A companies must implement endpoint detection and response and centralized logging and security event alerting, unless their CISO approves reasonably equivalent or more secure compensating controls in writing.
BastionX runs managed EDR built on SentinelOne and its own 24/7 U.S.-based SOC backed by a self-hosted SIEM. When configured, the Bastion Core device can relay logs from supported devices to the SIEM over an encrypted connection. A SOC and SIEM are implementation choices. The regulation sets the outcomes, and we keep the alert, training and log records that show them.
Encryption, Incident Response and Business Continuity (§§500.15, 500.16)
Section 500.15 requires encryption of nonpublic information in transit over external networks and at rest. Where encryption at rest is infeasible, the CISO may approve effective compensating controls in writing, reviewed at least annually.
Section 500.16 requires a written incident response plan and a business continuity and disaster recovery plan. Backups must be adequate to restore material operations and protected from unauthorized alteration or destruction. At least annually, you must test both plans with the staff and management critical to the response, and test your ability to restore critical data and systems from backup.
BastionX writes the plans with your team, runs and protects the backups, and runs the annual tests and restore checks, with written results.
Third-Party Service Providers (§500.11)
Section 500.11 requires written policies for vendors that hold or can access your nonpublic information. The policies cover identifying and assessing vendor risk, minimum security practices vendors must meet, due diligence, and periodic assessment based on risk, plus guidelines for contract terms such as MFA, encryption and incident notice.
DFS's October 21, 2025 guidance on third-party service providers does not add requirements. It states that covered entities may not delegate responsibility for compliance to an affiliate or a third-party service provider. BastionX is a third-party service provider to its clients, so your §500.11 policy should cover us too.
Your CISO and the Annual Certification
Section 500.4 lets a covered entity use a CISO employed by a third-party service provider. Rashid Ahmed, CISSP, can serve as your NYDFS CISO through BastionX's virtual CISO service and sign the annual certification as CISO, alongside your highest-ranking executive. Your firm keeps responsibility for compliance.
When the CISO is employed by a third party, §500.4(a) requires your firm to keep responsibility for compliance, assign a senior member of staff to direct and oversee the CISO, and require the provider to maintain a cybersecurity program that protects your firm under Part 500. Under §500.4(b), the CISO reports in writing to your board or senior governing body at least annually.
The DFS FAQs confirm that a CISO employed by an affiliate or third-party service provider may sign the annual compliance notification.
Unless your firm qualifies for a full exemption under §500.19(b), (e) or (g), §500.17(b) requires an annual compliance notification, often called the NYDFS annual certification, to DFS by April 15 covering the previous calendar year. Firms with limited exemptions report on the requirements applicable to them. The electronic filing must be one of the following:
Certification of material compliance, if your firm materially complied with Part 500 during the year
Acknowledgment of noncompliance, which identifies the applicable sections with which your firm did not materially comply, describes the nature and extent of that noncompliance, and provides a remediation timeline or confirms that remediation is complete
Your highest-ranking executive and your CISO sign. A firm without a CISO uses the senior officer responsible for the cybersecurity program. Keep the records that support the filing for five years.
Reporting Incidents and Extortion Payments
Section 500.17(a) requires electronic notice to DFS as promptly as possible, and no later than 72 hours after determining that a reportable cybersecurity incident occurred. This includes qualifying incidents at your firm, an affiliate or a third-party service provider. Your firm must also provide requested information and update DFS about material changes or newly available information.
An incident is reportable if any one of these conditions applies: it affects your firm and requires notification to a government body, self-regulatory agency or other supervisory body; there is a reasonable likelihood that it will materially harm a material part of your firm's normal operations; or ransomware is deployed within a material part of your firm's information systems.
An extortion payment connected to a cybersecurity event involving your firm triggers separate deadlines: notify DFS within 24 hours after payment and submit a written explanation within 30 days after payment. The explanation covers why payment was necessary, the alternatives considered, the diligence undertaken to find alternatives, and the diligence undertaken to comply with applicable rules and regulations, including those of the Office of Foreign Assets Control.
BastionX's SOC and incident response team help you establish what happened and document it quickly. The filing itself is made by your firm.
How NYDFS Enforces Part 500
DFS enforces NY DFS Part 500 through examinations, investigations and consent orders. According to a DFS press release of October 14, 2025, the Department had entered into consent orders with 27 entities for violations of its cybersecurity regulation under Superintendent Harris, resulting in more than $144 million in fines.
Consent order: A settlement between DFS and a regulated firm that resolves an investigation. It can include a penalty and required remediation steps.
The annual certification is a signed statement about the prior year. Keeping the records behind each certified control, such as access reviews, scan results, training completions and backup tests, lets you show DFS how each control operated.
How a BastionX Part 500 Engagement Works
A BastionX Part 500 engagement has five stages. Each engagement sets the systems covered, the deliverables and named owners.
Scope. Confirm covered entity status, Class A or exemption status, affiliates, and the systems that hold or can reach nonpublic information.
Risk assessment. BastionX performs the §500.9 risk assessment and ranks the findings.
Program and policies. We draft the cybersecurity program and §500.3 policies from the findings for your leadership to approve.
Implementation. We put the controls in place: MFA, access controls, asset inventory, scanning, EDR, logging, encryption and protected backups. PKFOD performs the penetration test and, for Class A companies, the independent audit.
Operation and records. Our SOC monitors your environment, we run the annual tests, and we keep the records your CISO and executive rely on for the April 15 filing.
If you are moving from another provider, onboarding includes coordination with the outgoing provider for access and documentation.
From the Field
Rashid Ahmed, CISSP, CISO & CTO
I spent 17 years at Payomatic, progressing through technology and security leadership roles to become CISO, and I led NYDFS Part 500 implementation there. Payomatic had 175 locations at the time, and every one of them needed a firewall. At an estimated $7,000 per location for hardware and licensing, the name-brand firewall option represented approximately $1.225 million across 175 locations. We deployed off-the-shelf hardware running an open source firewall operating system instead.
Part 500 sets security requirements but does not name a firewall brand. The technology you choose has to support the applicable requirements and be properly configured, documented and maintained. Our Payomatic case study has the details.
One Team for IT and Security
BastionX runs managed IT and cybersecurity with one New York City team. The people who configure your Microsoft 365 tenant, endpoints and network also monitor them, so a change to a control and the alert that should catch a problem with it sit in the same workflow and the same records.
That matters for NYDFS cybersecurity compliance because the certification covers a full year. When an access review finds a stale account or a scan finds a missing patch, the team that sees it can fix it and record the fix. Our 24/7 SOC is U.S.-based, and support is available around the clock.
We serve regulated firms across the New York City area. Part 500 often sits alongside federal rules, and our GLBA compliance services cover that work. Our cybersecurity compliance services and NIST compliance services cover the controls that frameworks share.
Frequently Asked Questions
Does the small business exemption apply to us?
It applies if your firm has fewer than 20 employees and independent contractors, including those of affiliates, less than $7.5 million in gross annual revenue in each of the last three fiscal years (your own operations plus affiliates' New York operations), or less than $15 million in year-end assets including affiliates. Exempt firms still owe a risk assessment, access controls, limited MFA, an asset inventory, annual training and the annual compliance notification: a certification of material compliance or an acknowledgment of noncompliance.
What is a Class A company?
A Class A company must meet two tests (§500.1(d)). First, it has at least $20 million in gross annual revenue in each of the last two fiscal years, counting all its own operations and its affiliates' New York operations. Second, it has either more than 2,000 employees averaged over those two fiscal years or more than $1 billion in gross annual revenue in each of those years, counting its own operations and affiliates worldwide. Only affiliates that share information systems, cybersecurity resources or any part of a cybersecurity program with the firm are counted. Class A companies have additional obligations: independent audits, privileged access management, password blocking, endpoint detection and response, and centralized logging, with permitted compensating-control alternatives for password blocking, endpoint detection and logging.
Who signs the NYDFS certification of compliance, and when is it due?
Your highest-ranking executive and your CISO sign the annual compliance notification, whether it is a certification of material compliance or an acknowledgment of noncompliance. It is due to DFS by April 15 for the prior calendar year. A firm without a CISO uses the senior officer responsible for the cybersecurity program. Supporting records are kept for five years.
Can a third party serve as our CISO and sign the certification?
Yes. Section 500.4 allows a CISO employed by a third-party service provider, and the DFS FAQs confirm that CISO may sign. Rashid Ahmed, CISSP, fills this role through BastionX's vCISO service. Your firm keeps responsibility for compliance and must assign senior staff to oversee the CISO.
What changed on November 1, 2025?
The final phase of the 2023 amendment to the NYDFS cyber regulation took effect. MFA expanded to individuals accessing a covered entity's information systems (§500.12), subject to CISO-approved compensating controls and narrower obligations for firms using the §500.19(a) exemption. Firms also needed written policies and procedures for a complete asset inventory (§500.13(a)).
How fast must we report a cybersecurity incident or an extortion payment?
Notify DFS of a reportable cybersecurity incident as promptly as possible, and no later than 72 hours after determining it occurred. Notify DFS of an extortion payment within 24 hours after payment, and submit the required written explanation within 30 days after payment.
Does Part 500 require a penetration test?
Yes. Section 500.5 requires a penetration test at least annually, from inside and outside your system boundaries, by a qualified internal or external party. Firms exempt under §500.19(a) are excused from §500.5. BastionX refers penetration testing to PKF O'Connor Davies.
Can we hand Part 500 compliance to a vendor?
No. A vendor can implement and run controls, and can provide your CISO, but DFS states that covered entities may not delegate responsibility for compliance to an affiliate or a third-party service provider.
How often does the risk assessment need updating?
At least annually, and whenever a business or technology change materially affects your cyber risk, such as a system migration, merger or significant new outsourcing arrangement.
Talk to BastionX About Part 500
BastionX offers a consultation that reviews your current controls against the Part 500 requirements that apply to your firm. Bring your latest annual compliance notification, a recent risk assessment or an examination letter. We will identify gaps and develop a prioritized remediation plan with defined owners, actions and timelines.
If you move forward with managed IT and cybersecurity together, a security device is included at no extra cost.
How We Researched This Guide
This guide draws on the text of 23 NYCRR Part 500 as published by DFS and the Legal Information Institute, the DFS Cybersecurity FAQs, the DFS industry letters on third-party service providers (October 21, 2025) and risk assessments (September 10, 2026), and the DFS press release of October 14, 2025.
The implementation sections draw on Rashid Ahmed's experience leading NYDFS Part 500 implementation in financial services. The guide separates regulatory requirements from implementation choices, including security operations centers, SIEM platforms, Zero Trust access and CipherNet.
BastionX's service descriptions explain how the company implements, monitors and maintains security controls. Each engagement defines the services provided and the responsibilities retained by the client.
About the Author
Rashid Ahmed, CISSP
Chief Information Security Officer & Chief Technology Officer, BastionX
Rashid Ahmed is a cybersecurity and technology executive with more than 25 years of experience across financial services, information security, and enterprise infrastructure. At BastionX, he leads cybersecurity strategy and technical delivery, helping organizations assess risk, implement safeguards, and maintain security across cloud, on-premises, and hybrid environments.
Previously, Rashid served as Chief Information Security Officer at Velocity Group USA and LutherSales and as Vice President of Information Security at CXO Nexus. He spent 17 years at Payomatic, a consumer financial services business, progressing through technology and security leadership roles to become CISO.
His financial-services experience informs his writing on NYDFS Part 500, particularly the practical work of developing security programs, assessing risk, controlling access, overseeing vendors, and maintaining evidence for certification. He has led NYDFS Part 500 implementation, implemented PCI DSS controls to support Level 1 validation requirements, and worked with auditors and executive leadership on security controls supporting SOC 2 examinations.
Rashid holds an active Certified Information Systems Security Professional (CISSP) certification from ISC2 and a Bachelor of Science in Computer Science from Queens College. He has spoken on cybersecurity at Financial Service Centers of America (FISCA) conferences.
His articles help business leaders and technical teams connect security requirements with the controls, documentation, and ongoing operations needed to support them.