NYDFS 23 NYCRR 500 Compliance: A Guide for Small Firms

23 NYCRR 500, usually called NYDFS Part 500, is the New York Department of Financial Services cybersecurity regulation for every business licensed, registered or chartered by DFS. It requires a risk-based cybersecurity program, written policies, multi-factor authentication, an asset inventory, incident notices within 72 hours and an annual compliance filing by April 15. As of October 2026 all of it is in force: the last set of requirements took effect November 1, 2025, so either the controls are in place or you're out of compliance.

This catches a lot of small firms off guard, because "financial services regulation" sounds like a big-bank problem. It isn't. Part 500 covers anyone operating under a DFS license, registration or charter: insurance agencies, mortgage brokers, licensed lenders and money transmitters, however small. Our NYDFS cybersecurity regulation compliance service builds and documents these programs for licensed firms.

Who has to comply with NYDFS Part 500?

Any Covered Entity. That means any person or business operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation or similar authorization under New York's Banking Law, Insurance Law or Financial Services Law, per DFS. That sweeps in a lot of small operations: independent insurance agencies and brokers, mortgage originators, check cashers, money transmitters and licensed lenders. If you needed a DFS license to open your doors, Part 500 applies to you.

Being small doesn't get you out. It changes which parts you have to do.

What's the small-business exemption?

A limited one, under Section 500.19(a). "Limited" is the word that matters. You qualify if any one of these is true, per DFS's exemption guidance: fewer than 20 employees and independent contractors, counting your affiliates; less than $7.5 million in gross annual revenue in each of the last three fiscal years from all of your business operations, wherever located, plus your affiliates' New York operations; or less than $15 million in year-end total assets, including affiliates. If you qualify, file a Notice of Exemption with DFS within 30 days.

Qualify, and you're excused from the CISO and governance section, vulnerability management (including penetration testing), the audit trail, application security, cybersecurity personnel, user-activity monitoring, the malicious-code controls in 500.14(a)(2), encryption, and the written incident response and business continuity plans. You are not excused from the core: a risk-based cybersecurity program, written policies, access privilege management, a risk assessment, a vendor security policy, multi-factor authentication, an asset inventory, annual awareness training, and the notices to DFS, including the annual compliance filing. The exemption trims the rulebook. It doesn't make encryption or an incident response plan a bad idea, and we recommend both for every firm.

23 NYCRR 500 compliance checklist

Here is the regulation section by section, with the evidence to keep and whether a firm with the 500.19(a) limited exemption still has to comply. We checked each row against the text of Part 500 and DFS's exemption table on October 7, 2026. Requirements that apply only to Class A companies are noted.

Section	What it requires	Evidence to keep	500.19(a) firms
500.2 Cybersecurity program	A program based on your risk assessment that identifies risks, protects your systems, detects, responds to and recovers from cybersecurity events, and meets your reporting obligations. Class A companies also need independent audits.	The program document, mapped to those functions	Must comply (Class A audits do not apply)
500.3 Cybersecurity policy	Written policies, approved at least annually by a senior officer or the senior governing body, covering the areas the rule lists, from asset inventory and access control to vendor management, incident response and vulnerability management	The signed policy set and its approval date	Must comply
500.4 Governance and CISO	A designated CISO, who may work for an affiliate or a third-party service provider, reporting in writing at least annually to the senior governing body, which oversees cyber risk	The CISO designation, the annual report, board minutes	Exempt
500.5 Vulnerability management	Penetration testing from inside and outside your systems at least annually by a qualified party, automated scans at a frequency set by your risk assessment and after material changes, monitoring for new vulnerabilities, and risk-based remediation	Test and scan reports, remediation records	Exempt
500.7 Access privileges	Access limited to what each job needs, few privileged accounts used only when needed, a review of all user access at least annually, remote-control protocols disabled or secured, prompt removal of leavers, and a written password policy. Class A companies also need privileged access management and blocking of commonly used passwords.	Access review records, offboarding records, the password policy	Must comply (Class A items do not apply)
500.9 Risk assessment	A documented risk assessment carried out under written policies, reviewed at least annually and whenever a business or technology change materially changes your cyber risk	The dated assessment and your decisions on each risk	Must comply
500.11 Third-party service providers	Written policies to identify, assess and periodically reassess vendors that can reach your systems or nonpublic information, covering their access controls and MFA, encryption, incident notice to you, and contract warranties	The vendor inventory, due diligence files, contract clauses	Must comply
500.12 Multi-factor authentication	MFA for any individual accessing any of your information systems, in force since November 1, 2025. Firms with the 500.19(a) exemption need MFA for remote access to their systems, remote access to third-party applications that hold nonpublic information, and all privileged accounts.	An MFA coverage report, and any compensating controls the CISO approved in writing, reviewed at least annually	Must comply (narrower scope)
500.13 Asset inventory and disposal	A documented inventory that records each asset's owner, location, classification, support expiration date and recovery time objective, with a set update frequency, plus periodic secure disposal of nonpublic information you no longer need	The inventory export, disposal records	Must comply
500.14 Monitoring and training	At least annual cybersecurity awareness training, including social engineering, for all personnel; monitoring of user activity; and controls against malicious code, including web and email filtering. Class A companies also need endpoint detection and response and centralized logging.	Training completion records, filtering and monitoring settings	Training required; monitoring and malicious-code controls exempt
500.15 Encryption	A written policy requiring industry-standard encryption of nonpublic information in transit over external networks and at rest, or compensating controls approved in writing by the CISO where encryption at rest is infeasible	The policy, device encryption reports	Exempt
500.16 Incident response and BCDR	Written incident response, business continuity and disaster recovery plans, tested at least annually, an annual test of restoring critical data and systems from backups, and backups protected from alteration or destruction	The plans, exercise records and restore-test results	Exempt
500.17 Notices to DFS	Notice within 72 hours of determining that a cybersecurity incident occurred; notice of an extortion payment within 24 hours and a written explanation within 30 days; and by April 15, a Certification of Material Compliance or an Acknowledgment of Noncompliance for the prior calendar year	Filing confirmations, the incident log, and the records behind the certification, kept for five years	Must comply
500.19 Exemptions	The limited exemption tests described above. File a Notice of Exemption within 30 days of determining that you qualify; if you stop qualifying, you have 180 days to comply with every applicable section.	The Notice of Exemption confirmation and the numbers behind it	Applies to you

What changed on November 1, 2025?

Two things bite hardest for small firms: multi-factor authentication and asset inventory.

MFA is now required for any user accessing any information system, not just remote logins or admins. Smaller firms under the 500.19 thresholds get a narrower version: MFA on remote access, remote access to third-party apps, and privileged accounts. But nobody gets to skip it entirely anymore.

You also need a written asset inventory. Section 500.13 requires you to track your information systems with the owner, location, classification, support-expiration date, and recovery time objective for each. If you can't say what you own, you can't defend it, and now you have to prove you know.

Start with identity. MFA and access control are the fastest of these to stand up, which is why we point every regulated client there first. Zero trust for small business covers the groundwork Part 500 now demands.

How do you run the risk assessment DFS expects?

The risk assessment drives the rest of Part 500, and it's where examiners keep finding gaps. DFS's September 10, 2026 guidance on risk assessments adds no new obligations, but it spells out what a defensible one looks like. For a small firm, that comes down to six steps:

1. Write the method down first: how you rate likelihood and impact, how you judge whether a control works, and who decides what happens to each risk.
2. Start from your asset inventory, including where nonpublic information flows and which vendors can reach it.
3. Rate each risk before and after your current controls, so the gap you're accepting is visible.
4. Record a decision for every risk (fix it, add a compensating control, transfer it or accept it) with an owner, a date and the reason, ideally in a risk register.
5. Tie the results to the program: policies, budget and next year's projects should trace back to the assessment.
6. Repeat it at least annually and after material changes, such as a system migration or a new outsourcing arrangement.

The deficiencies DFS lists in that letter are the mirror image: an outdated inventory, a method that never tests whether controls work, risks with no owner, and an assessment that never shapes the program.

What are the reporting deadlines?

Three clocks matter, and they're tight.

You have 72 hours from determining that a cybersecurity incident has occurred, at your firm, an affiliate or a third-party service provider, to notify the superintendent. You have 24 hours to report a ransom or extortion payment, plus 30 days to explain the decision in writing. And by April 15 each year, your highest-ranking executive and your CISO must sign and file either a Certification of Material Compliance or an Acknowledgment of Noncompliance for the prior calendar year; without a CISO, the senior officer responsible for the cybersecurity program signs instead. The filing for calendar year 2026 is due April 15, 2027, per DFS.

That signature carries weight. Your highest-ranking executive is personally attesting that the firm materially complied, and the records behind the filing have to be kept for five years. Signing a certification you can't back up is its own exposure.

What happens if you don't comply?

DFS enforces this against firms of every size, and the penalties aren't theoretical. In October 2025 it fined eight auto insurers more than $19 million combined after attackers pulled consumer data, including driver's license numbers, through online quoting tools and agent portals; two of them had also reported their cybersecurity events late. In August 2026 it fined Order Express, a licensed money transmitter, $250,000 for inadequate risk assessments and weak policies for system updates, even though its limited revenue exempts it from many Part 500 requirements. In 2023, OneMain Financial paid $4.25 million over weak vendor oversight and access controls. Under Section 500.20, a material failure to comply with any section for any 24-hour period counts as a violation, so the exposure compounds.

The bigger risk for a small firm is a breach without a program in place: regulatory penalties on top of the breach cost, plus clients and carriers asking why you weren't compliant. Your cyber insurance carrier will ask the same questions Part 500 does.

Frequently asked questions

Are 23 NYCRR 500, NYDFS Part 500 and DFS Part 500 the same rule?

Yes. "23 NYCRR" is Title 23 of the New York Codes, Rules and Regulations, the financial services title, and Part 500 is the cybersecurity regulation inside it. Examiners, lawyers and vendors use all three names, plus "the DFS cybersecurity regulation," for the same requirements.

Does Part 500 apply if I'm licensed in New York but based elsewhere?

Yes. Part 500 follows the DFS license, not your office address. If you hold a New York DFS license or registration, you're a Covered Entity regardless of where you're headquartered. Out-of-state firms serving New York clients get caught by this regularly.

What's a Class A company?

The largest tier: at least $20 million in gross annual revenue in each of the last two fiscal years from your business and your affiliates' New York business, plus either more than 2,000 employees averaged over those two years or more than $1 billion in gross annual revenue in each of them, counting affiliates as the rule defines them. Class A firms face extra requirements like independent audits, privileged access management, and endpoint detection and response. Most small firms aren't Class A, but it's worth confirming where you land.

Do I need a CISO?

If you qualify for the 500.19(a) exemption, no, but someone still has to own the program: without a CISO, the senior officer responsible for cybersecurity co-signs the annual filing with your highest-ranking executive. Everyone else must designate a CISO who reports in writing at least annually to the board or other senior governing body. The rule allows the CISO to be employed by a third-party service provider, so a small firm can use a vCISO instead of a full-time hire, as long as it keeps responsibility for compliance and names a senior person to oversee the provider.

Does Part 500 cover our outsourced IT provider?

Your provider is a third-party service provider under Section 500.11, and the compliance responsibility stays with you. Your vendor policy has to cover how you vet it, its access controls and MFA, encryption, and how fast it must tell you about an incident, because the 72-hour clock includes incidents at your providers. DFS made this concrete in an August 11, 2026 alert about attackers exploiting N-central, a remote management tool some managed service providers use, to reach client networks. It told regulated firms to work through the issue with their providers and to keep reporting incidents that start at a vendor.

What affects the cost of Part 500 compliance?

Mostly your starting point and your exemption status. A firm under the 500.19(a) thresholds is excused from the CISO, penetration testing and encryption sections, so its program is smaller. After that, the drivers are the number of users and devices to bring under MFA and the inventory, how many vendors you have to review, whether the written policies and risk assessment exist yet, and whether you need a vCISO and an annual penetration test. Budget for the evidence as well as the tools, because the April 15 filing needs records behind it.

How is this different from SEC Reg S-P?

Different regulator, overlapping controls. Reg S-P is the SEC's federal rule for broker-dealers and RIAs; Part 500 is New York's. A firm that is registered with the SEC and also holds a DFS license, such as an insurance agency license, is subject to both. We break down the federal side in SEC Reg S-P for RIAs.

How long does it take to get compliant?

For a small firm starting from basic IT hygiene, a few months. MFA and asset inventory go fast, while the written program, risk assessment, and incident response plan take longer to document properly. The clock's already run, so the honest answer is: start now and file an Acknowledgment of Noncompliance if you're not there yet.

The NetSys Group builds Part 500 programs for financial and insurance firms across New York: the MFA, the asset inventory, the written policies, and the certification you can actually sign. Book a complimentary cybersecurity assessment and we'll show you exactly where you stand.

---

About the author: Joel Baum leads cybersecurity and compliance strategy at The NetSys Group, which has delivered managed IT, cybersecurity and cloud services from Brooklyn since 1998. NetSys engineers hold degrees in electrical and computer engineering. We work on-site across New York City, Long Island, Westchester, the Hudson Valley, North Jersey and Fairfield County, CT, with remote managed IT nationwide.