23 NYCRR Part 500

What is 23 NYCRR Part 500?

23 NYCRR Part 500 is the New York State cybersecurity regulation for financial services companies, published and enforced by the New York State Department of Financial Services (DFS). It applies to covered entities: anyone licensed or required to be licensed under the New York Banking Law, Insurance Law or Financial Services Law.

The full title is Cybersecurity Requirements for Financial Services Companies. The current version is the Second Amendment, effective 1 November 2023. The original Part took effect on 1 March 2017. People also search for it as NYDFS NYCRR 500 or the NYDFS cybersecurity regulation, and DFS publishes it on its 23 NYCRR Part 500 page.

The regulation sets minimum standards that are risk-based rather than overly prescriptive. Each company assesses its own risk profile and designs a programme that addresses its risks.

Why it matters

A New York licence, or a customer that holds one, puts 23 NYCRR Part 500 on your desk, and the question stops being whether you have security controls. It becomes whether you can tell a regulator, every year, that you do.

Three features give the regulation its weight:

• An annual filing. Each covered entity submits a certification of material compliance, or an acknowledgement of non-compliance, to the Superintendent by 15 April.
• A short incident clock. Cybersecurity incidents are notified within 72 hours of determination.
• Penalties tied to recognised practice. When the Superintendent sets a penalty, one factor is how far the company's policies and procedures are consistent with nationally recognised frameworks such as NIST.

A certification is only as good as the evidence behind it.

Who it applies to

Part 500 applies to covered entities. A covered entity is any person operating under, or required to operate under, a licence, registration, charter, certificate, permit, accreditation or similar authorisation under the New York Banking Law, Insurance Law or Financial Services Law. That holds whether or not other government agencies also regulate it.

It is mandatory for those entities. Smaller ones can claim a limited exemption from several sections if they have fewer than 20 employees and contractors, under $7.5m revenue in each of the last three years, or under $15m in year-end assets. They must file a Notice of Exemption electronically within 30 days.

For a firm that holds ISO 27001, the starting point is familiar: Part 500 is risk-based and begins with the company's own risk assessment, as an ISMS does. But it adds duties set by DFS, such as the annual filing and the incident notice, which sit outside an ISMS. See the ISO 27001 vault for the management-system side.

The UK position

A UK firm meets 23 NYCRR Part 500 when it has New York licensed operations. The New York licensed branch, agency or subsidiary of a UK bank or insurer is a covered entity, because it holds a licence under New York law. The regulation expects this: its definitions refer to a branch or agency of a foreign banking organisation subject to the Part.

A UK firm with no New York licence is not covered directly. It may still meet Part 500 commercially, as a third-party service provider to a covered entity under section 500.11. In that case the customer's questionnaire or contract is the usual first encounter.

Key requirements

The regulation is organised around a risk-based programme and a short list of named duties:

1. A risk-based programme. The cybersecurity programme is based on the covered entity's risk assessment and performs six core functions: identify, protect, detect, respond, recover and fulfil regulatory reporting obligations.
2. A named CISO. Each covered entity names a Chief Information Security Officer, who reports in writing at least annually to the senior governing body.
3. Incident notification. The entity notifies the Superintendent no later than 72 hours after determining that a cybersecurity incident has occurred at the entity, its affiliates or a third-party service provider.
4. Extortion payments. A payment made in response to extortion is reported within 24 hours, with a written explanation to follow within 30 days.
5. Annual certification. By 15 April each year, the entity submits a certification of material compliance or an acknowledgement of non-compliance. The highest-ranking executive and the CISO sign it, and the records behind it are kept for five years.

Class A companies

Class A companies are the largest covered entities. A covered entity is Class A if it has at least $20m in gross annual revenue in each of the last two years and either over 2,000 employees or over $1bn in group revenue. Their extra duties include independent audits of the cybersecurity programme, privileged access management and endpoint detection and response.

Frequently asked questions