NYDFS Cybersecurity Regulation (23 NYCRR 500): Complete Guide

The NYDFS cybersecurity regulation, 23 NYCRR Part 500, is the New York Department of Financial Services rule that sets minimum cybersecurity requirements for the banks, insurers, lenders, money transmitters, and virtual currency firms it licenses. It took effect on March 1, 2017. The Second Amendment, effective November 1, 2023, rewrote much of it, and its last requirements phased in on November 1, 2025.

This guide walks through the regulation section by section: who it covers, what each section requires, the extra rules for Class A companies, the amendment timeline, the annual penetration testing mandate, the April 15 certification, and the exemptions. Every citation below is to the amended text published by NYDFS.

Who the regulation covers

Part 500 applies to every covered entity. Section 500.1 defines that as any person operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation, or similar authorization under New York’s Banking Law, Insurance Law, or Financial Services Law. It applies even when the entity is also regulated by another agency.

That sweeps in far more than banks: state-chartered banks and credit unions, insurers, insurance agencies and brokers, mortgage bankers, brokers and servicers, check cashers, money transmitters, and BitLicense holders. Coverage follows the license, not the headquarters, so a firm based in another state that holds a New York license is covered too. Most hedge funds and asset managers answer to the SEC rather than DFS, but a manager or affiliate that holds a DFS license or charter is covered; our page on penetration testing for hedge funds and asset managers covers both cases. SEC-registered advisers and broker-dealers also answer to Regulation S-P, and our page on RIA cybersecurity covers wealth managers and family offices, including those operating under a New York trust charter.

The regulation protects nonpublic information (NPI). Section 500.1 defines it in three parts: business information whose tampering, disclosure, or misuse would materially harm the entity; personal information combined with a Social Security number, driver’s license number, account or card number, access code, or biometric record; and health information. Your NPI decides where most of the obligations below apply.

23 NYCRR 500, section by section

The regulation is short enough to read in an afternoon. The table summarizes each operative section as amended.

Section	What it requires	What it means in practice
500.2 Cybersecurity program	A risk-based program that covers six core functions: identify risks, protect systems, detect events, respond, recover, and meet reporting duties. Class A companies must also run independent audits of the program (500.2(c)).	A documented program you can hand to an examiner.
500.3 Cybersecurity policy	Written policies approved at least annually by a senior officer or the senior governing body, covering 15 areas from information security to vulnerability management, with documented procedures behind them.	An annual sign-off and procedures for each policy.
500.4 Cybersecurity governance	Designate a CISO. The CISO reports in writing at least annually to the senior governing body, and the board must exercise real oversight of cyber risk.	A written CISO report and board minutes that show oversight.
500.5 Vulnerability management	Penetration testing from inside and outside the information systems’ boundaries at least annually, by a qualified party. Automated scans plus manual review at a risk-based frequency and after material changes. A process to learn of new vulnerabilities, and risk-based remediation.	An external and an internal penetration test every year, plus scanning in between.
500.6 Audit trail	Systems that can reconstruct material financial transactions (records kept five years) and audit trails that detect and respond to cybersecurity events (kept three years).	Log retention that matches those periods.
500.7 Access privileges and management	Least privilege, few privileged accounts, access reviews at least annually, remote-control protocols disabled or secured, prompt removal of leavers, and a written password policy. Class A companies add privileged access management and automated blocking of common passwords.	Access reviews and a password policy on file.
500.8 Application security	Secure development practices for in-house applications and procedures for testing externally developed ones, reviewed at least annually by the CISO.	Development standards, plus application testing of the software that handles NPI.
500.9 Risk assessment	A documented risk assessment, reviewed at least annually and whenever a business or technology change materially changes cyber risk.	The document that sets scope for everything else, including testing.
500.10 Personnel and intelligence	Qualified cybersecurity staff, whether employed, at an affiliate, or at a service provider, with ongoing training.	Named people and training records.
500.11 Third-party service providers	Written policies to identify, assess, and periodically reassess vendors that can access systems or NPI, including their MFA, encryption, and breach notice terms.	Vendor due diligence and contract clauses.
500.12 Multi-factor authentication	MFA for any individual accessing any information system, unless the CISO approves equivalent compensating controls in writing.	MFA everywhere, not just on remote access.
500.13 Asset management and data retention	A complete, documented asset inventory that tracks owner, location, classification, support end date, and recovery time objective, plus secure disposal of NPI that is no longer needed.	An inventory that is kept current.
500.14 Monitoring and training	Monitoring of authorized users, controls against malicious code, and cybersecurity awareness training at least annually that includes social engineering. Class A companies add endpoint detection and response and centralized logging with alerting.	Annual training, which a phishing simulation makes measurable.
500.15 Encryption	A written policy requiring encryption of NPI in transit over external networks and at rest. Compensating controls are allowed only for data at rest, with written CISO approval reviewed annually.	Encryption over external networks with no exceptions.
500.16 Incident response and business continuity	Written incident response and business continuity plans, tested at least annually, plus a tested ability to restore critical systems from backups.	A tabletop exercise and a restore test every year.
500.17 Notices to the superintendent	Report cybersecurity incidents within 72 hours, submit the compliance certification or acknowledgment by April 15, and report any extortion payment within 24 hours.	Notification playbooks and an annual filing.
500.19 Exemptions	A limited exemption for small entities and full exemptions for a few narrow categories, each claimed by filing a Notice of Exemption.	Check your status before you rely on it.
500.20 Enforcement	A single prohibited act or failure to meet an obligation is a violation, including a material failure to comply for any 24-hour period.	Gaps are counted, not averaged.

The remaining sections are administrative: confidentiality of filings (500.18), effective dates (500.21), transitional periods (500.22), severability (500.23), and exemptions from electronic filing (500.24).

Class A companies

The Second Amendment created Class A companies, the largest covered entities, with extra obligations. Under 500.1, a Class A company has at least $20 million in gross annual revenue in each of the last two fiscal years from its own business and the New York business of its affiliates, and either:

• over 2,000 employees averaged over the last two fiscal years, counting all affiliates wherever located, or
• over $1 billion in gross annual revenue in each of the last two fiscal years, counting all affiliates wherever located.

Only affiliates that share information systems, cybersecurity resources, or part of the cybersecurity program count toward those numbers.

Class A requirement	Section	In force since
Design and conduct independent audits of the cybersecurity program	500.2(c)	April 29, 2024
Monitor privileged access, run a privileged access management solution, and automatically block commonly used passwords	500.7(c)	May 1, 2025
Deploy endpoint detection and response and a solution that centralizes logging and security event alerting	500.14(b)	May 1, 2025

For a Class A company, the annual penetration test should also show whether the EDR and logging actually saw the activity. That is where a red team assessment often sits alongside the annual test, and where a purple team assessment checks the EDR and logging technique by technique.

The Second Amendment timeline

The Second Amendment took effect on November 1, 2023 and phased in over two years. The dates below come from the transitional periods in 500.22 and the NYDFS implementation timelines.

Date	What took effect
March 1, 2017	The original Part 500 takes effect.
November 1, 2023	The Second Amendment takes effect.
December 1, 2023	New notice requirements in 500.17, including reporting of ransomware deployment and extortion payments.
April 15, 2024	First certification or acknowledgment of noncompliance in the new format, for calendar year 2023, signed by the highest-ranking executive and the CISO.
April 29, 2024	Annual risk assessment review (500.9), policy updates (500.3), annual penetration testing and risk-based remediation (500.5(a)(1), (b) and (c)), training that includes social engineering (500.14(a)(3)), and Class A independent audits (500.2(c)).
November 1, 2024	Governance and board oversight (500.4), encryption (500.15), incident response and business continuity (500.16), and the revised limited exemption (500.19(a)).
May 1, 2025	Automated scans and manual review (500.5(a)(2)), access privileges and the password policy (500.7), and malicious code controls (500.14(a)(2)). Class A companies add privileged access management, password blocking, EDR, and centralized logging.
November 1, 2025	MFA for every individual accessing information systems (500.12) and the asset inventory (500.13(a)).

Every transitional period has now ended. Examiners expect the amended regulation to be fully operating.

The 500.5 penetration testing mandate, in brief

Section 500.5(a)(1) requires penetration testing of information systems from both inside and outside the information systems’ boundaries, by a qualified internal or external party, at least annually. Three words in that sentence set the scope:

• Annual means a real cadence with dated reports, not a test from two years ago.
• Inside and outside means an external network test of the perimeter and an internal network test from a foothold inside. Testing only the perimeter does not satisfy the text.
• Qualified means you should be able to show the examiner who performed the test and why they were qualified to do it.

Section 500.5(a)(2) separately requires automated scans of information systems, and a manual review of systems the scans do not cover, at a frequency set by the risk assessment and promptly after any material system change. Ongoing vulnerability scanning is the practical way most entities meet it, and a vulnerability management program adds the tracking and rescans that show examiners the risk-based remediation 500.5(c) asks for.

Scope follows the NPI: the external perimeter, the internal network, customer-facing web applications and APIs, and cloud infrastructure where NPI lives. Our NYDFS penetration testing page covers how we scope the 500.5 test, the evidence examiners ask for, and the price, with the external test from $4,200 and the internal test from $6,000.

The April 15 certification

Under 500.17(b), every covered entity must file one of two documents with NYDFS by April 15 each year, covering the prior calendar year:

• a certification of material compliance, based on data and documentation sufficient to demonstrate it, or
• a written acknowledgment of noncompliance that names every section not met, describes the gap, and gives a remediation timeline or confirms remediation is complete.

Either filing is signed by the highest-ranking executive and the CISO. An entity without a CISO has the senior officer responsible for the cybersecurity program sign instead. The records behind the filing must be kept for five years.

Signing a compliance certification while your last penetration test is 18 months old, or while critical findings sit unremediated, is a risk those signers carry personally. NYDFS has brought enforcement actions where certifications did not match the underlying reality, so the executives who sign tend to become the internal champions for keeping the testing program current. A current test report, remediation tracking, and retest evidence are the documents that let them sign with confidence.

Incident and extortion notices

Section 500.17(a) requires notice to NYDFS as promptly as possible, and no later than 72 hours after the entity determines that a cybersecurity incident has occurred at the entity, an affiliate, or a third-party service provider. A cybersecurity incident is an event that requires notice to another government or supervisory body, is reasonably likely to materially harm normal operations, or results in ransomware deployed within a material part of the entity’s systems.

If an extortion payment is made, 500.17(c) requires notice within 24 hours of the payment. Within 30 days, the entity must explain in writing why the payment was necessary, which alternatives it considered, and the diligence it performed, including on sanctions compliance.

Exemptions

Section 500.19(a) grants a limited exemption to a covered entity that meets any one of three tests:

• fewer than 20 employees and independent contractors, counting affiliates;
• less than $7.5 million in gross annual revenue in each of the last three fiscal years, from its own business and the New York business of its affiliates; or
• less than $15 million in year-end total assets, including the assets of all affiliates.

A limited exemption removes sections 500.4, 500.5, 500.6, 500.8, 500.10, 500.14(a)(1), (a)(2) and (b), 500.15, and 500.16. That means no mandatory annual penetration test. The rest still applies: the cybersecurity program and policies, access management, the risk assessment, third-party oversight, MFA for remote access and privileged accounts, the asset inventory, annual awareness training, and the 500.17 notices and certification.

Two broader exemptions cover entities with no information systems and no NPI (500.19(c)) and captive insurers that hold no NPI beyond their parent’s (500.19(d)). They drop most of Part 500, including 500.5, but still owe the risk assessment, third-party oversight, the asset inventory, and the 500.17 notices and filings. Any exempt entity must file a Notice of Exemption within 30 days of determining that it qualifies. An entity that stops qualifying has 180 days to comply with everything that applies. Confirm your status against the regulation text or with counsel before you rely on it, because claiming an exemption you do not qualify for is itself a compliance problem.

Preparing for the next examination

NYDFS examinations are document-driven. The pattern that works:

1. Map the systems that store, process, or transmit NPI, and keep the asset inventory current.
2. Update the risk assessment, and let it set the scanning cadence and the test scope.
3. Schedule the internal and external penetration test at the same time each year.
4. Track every finding to closure, and retest so the fixes are proven rather than claimed.
5. File the report, remediation records, and scan history where the compliance team can hand them to an examiner and the signers can rely on them in April.

Part 500 sits alongside SOC 2, PCI DSS, and other regimes with testing expectations. Our guide to compliance frameworks that require penetration testing shows how they overlap, so one well-scoped annual test can serve several of them. Non-bank financial companies that NYDFS does not license may fall under the FTC’s rule instead; see FTC Safeguards Rule penetration testing.

Frequently asked questions

Does the NYDFS cybersecurity regulation require penetration testing? Yes, for every covered entity without a limited exemption. Section 500.5(a)(1) requires penetration testing from inside and outside the information systems’ boundaries at least annually, by a qualified internal or external party.

Does 23 NYCRR 500 apply to companies based outside New York? It applies to anyone operating under a license, registration, or similar authorization from NYDFS. Coverage follows the New York license, not where the company is based.

When is the annual certification due? By April 15 each year, for the prior calendar year. It is either a certification of material compliance or an acknowledgment of noncompliance with a remediation timeline, signed by the highest-ranking executive and the CISO.

What changed in the Second Amendment? It created Class A companies and added explicit board oversight duties. It removed the continuous-monitoring alternative in 500.5, so annual penetration testing from inside and outside the boundaries is required outright. It also required MFA for all access, added the asset inventory and extortion payment notices, moved the annual filing to April 15, and let entities file an acknowledgment of noncompliance instead of a certification.

How fast do we have to report an incident? Within 72 hours of determining that a cybersecurity incident occurred, and within 24 hours of any extortion payment.

Where Invadel fits

Invadel performs NYDFS-aligned internal and external penetration testing for financial services companies from our office in Manhattan. Every engagement is fixed scope and fixed price, and the retest is included, so the report your examiner sees shows the findings closed. If you are comparing local firms, see our overview of penetration testing in NYC and our list of NYC penetration testing companies.

When your annual test is due, scope it with us. We will return a fixed-price proposal covering the internal, external, and application scope your examiner will expect, and onboarding starts within 24 hours of signing.