NYDFS Part 500

Who it applies to

Entities operating under a license, registration or similar authorisation from the New York Department of Financial Services, with lighter duties for some small entities and extra duties for larger 'Class A' companies.

Key requirements

• A risk-based cybersecurity program and board-approved policies.
• A qualified Chief Information Security Officer who reports to the board.
• Multi-factor authentication, access privilege reviews and asset inventory.
• Penetration testing and vulnerability management.
• Incident response and business continuity plans.
• An annual certification of compliance (or acknowledgement of non-compliance) to DFS.

Breach and incident notification

Notify DFS within 72 hours of determining that a reportable cybersecurity incident occurred. Extortion payments are reported within 24 hours, with a written explanation within 30 days.

Penalties

Civil penalties enforced by DFS under New York law; amounts are set case by case in consent orders.

Go deeper