Part 500 is the cybersecurity rule of the New York State Department of Financial Services (DFS). Its formal name is 23 NYCRR 500. It applies to firms that operate under a DFS license, registration, charter or similar authorization. The Second Amendment took effect on 1 November 2023, and its last transitional period ended on 1 November 2025. From that date, the multi-factor authentication and asset inventory rules applied in full.
This guide describes what the text says and what evidence firms should be ready to show. It describes the rule and is not legal advice. Last reviewed against the DFS texts on 19 October 2026.
Who must follow Part 500?
Part 500 covers any person that operates, or must operate, under a license, registration, charter, certificate, permit, accreditation or similar authorization. The authorization comes from the Banking Law, the Insurance Law or the Financial Services Law. The regulation calls these firms covered entities.
Class A companies
Some duties apply only to larger firms called Class A companies. A covered entity is Class A when it has at least $20 million in gross annual revenue in each of the last two fiscal years. That figure counts all of its own business operations and the New York operations of its affiliates. It must also meet one of two further tests:
- It has over 2,000 employees, averaged over the last two fiscal years, counting affiliates wherever they are located.
- It has over $1 billion in gross annual revenue in each of the last two fiscal years, counting all affiliates wherever they are located.
For these counts, the rule includes only affiliates that share information systems, cybersecurity resources or any part of a cybersecurity program with the covered entity.
Class A companies have extra duties. They must run independent audits of the cybersecurity program (500.2) and use a privileged access management solution (500.7). They must also use endpoint detection and response and a tool that centralizes logging and alerting (500.14). The CISO can approve reasonably equivalent controls in writing instead of those two tools.
Limited exemptions
Small firms can qualify for a limited exemption under 500.19(a). A firm qualifies when it meets any one of three tests:
- It has fewer than 20 employees and independent contractors, counting its affiliates.
- It has less than $7.5 million in gross annual revenue in each of the last three fiscal years.
- It has less than $15 million in year-end total assets, including the assets of all affiliates.
The exemption removes several duties, including governance (500.4), vulnerability management (500.5), encryption (500.15) and incident response plans (500.16).
What changed with the Second Amendment?
Section 500.22 gave firms time to meet the new requirements. The default is 180 days from 1 November 2023. Longer periods apply to named sections. The table shows when each group came into force. The dates are our own calculation from 500.22, not dates printed in the rule.
| What is new | Sections | In force from |
|---|---|---|
| New notice requirements | 500.17 | 1 December 2023 (30 days) |
| All other new requirements | Sections with no longer period | 29 April 2024 (180 days) |
| Governance, encryption, response plans, exemption criteria | 500.4, 500.15, 500.16, 500.19(a) | 1 November 2024 (one year) |
| Scans, access limits, malicious code controls, Class A tools | 500.5(a)(2), 500.7, 500.14(a)(2), 500.14(b) | 1 May 2025 (18 months) |
| Multi-factor authentication and asset inventory | 500.12, 500.13(a) | 1 November 2025 (two years) |
Multi-factor authentication (500.12) is the rule most firms notice first. It must be used for any individual accessing any information system of a covered entity. Firms with the limited exemption have a narrower duty. They must use it in three cases:
- Remote access to the firm’s information systems.
- Remote access to third-party applications, including cloud ones, that can reach nonpublic information.
- Privileged accounts, other than service accounts that prohibit interactive login.
If the firm has a CISO, the CISO may approve reasonably equivalent or more secure compensating controls in writing.
The asset inventory: where do firms fall short?
An internal list is not what attackers see
Section 500.13(a) asks for written policies designed to produce and maintain a complete, accurate and documented asset inventory. The policies must include a method to track key information for each asset, as applicable:
- Owner
- Location
- Classification or sensitivity
- Support expiration date
- Recovery time objectives
They must also set how often the inventory is updated and validated.
DFS says this is a weak spot. Its industry letter of 10 September 2026 lists “incomplete asset scope and visibility” among the gaps it has found in risk assessments. The letter gives examples: outdated or incomplete asset inventories, and leaving out third-party service providers, cloud environments or other external dependencies. It says the inventory should be the foundational input to the risk assessment. It also says the guidance does not create new obligations.
Using external discovery to check completeness
One way to test the inventory is to look from the outside. Run discovery against your domains and list every internet-facing host and service it finds. Then compare that list with the inventory. Anything found but not listed is a gap. Anything listed but not found may be a stale record.
External attack surface management does this on a schedule. The Brandefense external attack surface management module continuously discovers internet-facing infrastructure, including shadow IT, forgotten subdomains, cloud misconfigurations and exposed services. Dated results help you show that the inventory was checked, and when. For a first look at one domain, the free domain scanner needs no signup.
What does Part 500 ask for in vulnerability management?
Section 500.5 requires written policies and procedures for vulnerability management, based on the risk assessment. At a minimum, the firm must arrange for:
- Penetration testing from inside and outside the system boundaries, by a qualified internal or external party, at least annually.
- Automated scans, plus a manual review of systems the scans do not cover, at a frequency set by the risk assessment.
- A new scan promptly after material system changes.
- A monitoring process that keeps the firm promptly informed of new vulnerabilities.
- Timely remediation, with priority based on the risk each vulnerability poses to the firm.
The text sets no scan frequency. The risk assessment does.
Monitoring and prioritizing are where vulnerability intelligence helps. Brandefense shows which vulnerabilities attackers are discussing, selling and using, so teams can rank patches by real-world use and not only by CVSS score. A written reason for each priority call is easy to keep and easy to show.
How do third-party service providers fit in?
Section 500.11 covers systems and nonpublic information that third-party service providers can access or hold. The covered entity must have written policies, based on its risk assessment, that address where applicable:
- Identification and risk assessment of providers.
- Minimum cybersecurity practices a provider must meet to do business with the firm.
- Due diligence to judge whether a provider’s practices are adequate.
- Periodic assessment of each provider, based on the risk it presents.
The policies also include guidelines for due diligence or contract terms. These cover access controls and multi-factor authentication, and encryption. They also cover notice to the firm of a cybersecurity event that affects it, and warranties about the provider’s security policies.
A vendor that is not itself a covered entity is not directly bound by Part 500. Its covered customers apply the rule to it through the minimum practices and contract terms they set. The DFS FAQ adds one point: an entity that is both a covered entity and a service provider must meet Part 500 as a covered entity.
Outside-in monitoring supports the periodic assessment step. The third-party risk management module, part of the external attack surface management pillar, maps vendor attack surfaces and scores vendor risk continuously from the outside.
Incident notice: 72 hours, and 24 hours for extortion payments
Section 500.17(a) says a covered entity must notify the superintendent electronically, in the form on the DFS website. The notice is due as promptly as possible but “in no event later than 72 hours after determining” that a cybersecurity incident has occurred. The incident can be at the covered entity, its affiliates or a third-party service provider.
A cybersecurity incident is a defined term. It is a cybersecurity event at the firm, an affiliate or a provider that meets one of three tests:
- It impacts the firm and requires it to notify a government body, self-regulatory agency or other supervisory body.
- It has a reasonable likelihood of materially harming a material part of normal operations.
- It results in ransomware being deployed within a material part of the firm’s information systems.
What “determining” means in practice
The rule does not define “determining”. It does not say the clock starts at the first alert. This guide describes the text and does not interpret it, so ask counsel how your firm should apply it. A written record of who decided that an event met the incident definition, and when, makes the timeline easy to show.
The duty continues after the first notice. The firm must promptly provide any information the superintendent requests. It must also keep updating DFS with material changes or new information. The DFS FAQ says a firm must notify DFS of an incident at a provider even when the provider notifies DFS too.
Extortion payments have their own clock (500.17(c)). The firm gives notice within 24 hours of the payment. Within 30 days it gives a written description of why payment was necessary, the alternatives it considered and the diligence it did to find alternatives. It also describes the diligence done to ensure compliance with applicable rules, including those of the Office of Foreign Assets Control.
- Cybersecurity incident
- Notice no later than 72 hours after determining it occurred (500.17(a))
- Extortion payment
- Notice within 24 hours, written description within 30 days (500.17(c))
- Annual notice
- Certification or acknowledgment by April 15 (500.17(b))
- Signed by
- Highest-ranking executive and the CISO (500.17(b))
- Supporting records
- Kept for five years (500.17(b))
Firms that are public companies may also have duties under SEC rules. Our overview of the SEC cybersecurity regulations covers those.
The April 15 notice: what evidence to keep ready
Every year, by April 15, a covered entity submits one of two documents electronically. The first is a written certification that it materially complied with Part 500 in the prior calendar year. The certification rests on data and documents that can demonstrate this.
The second is a written acknowledgment that the firm did not materially comply with all requirements. It names each section not met, describes the nature and extent of the gap, and gives a remediation timeline or confirms remediation is done.
The highest-ranking executive and the CISO sign it. If the firm has no CISO, the senior officer responsible for the cybersecurity program signs with the highest-ranking executive. Firms do not need to send supporting documents with a certification. They keep them for five years and give them to DFS on request.
- Risk assessmentThe base for the program and for most other controls.
- Asset inventoryThe tracked fields and the update and validation schedule.
- Tests and scansPenetration test reports, scan results and remediation records.
- Multi-factor authenticationWhere it is used, plus any written approvals of compensating controls.
- Provider filesProvider list, due diligence, contract terms and periodic reviews.
- Incident logDates of determination, notices sent and updates to DFS.
- Gaps and fixesAreas needing improvement, remedial work, plans and timelines.
CISOs who sign the notice can see how outside visibility fits the role on the CISO role page. The financial services page lists the external threats Brandefense watches for banks and insurers.
Brandefense does not file anything for you. Its external discovery and vulnerability data can sit in these files as dated evidence. To see how that works on your own domains, request a demo. Part 500 duties depend on your firm, so confirm them with your counsel. This guide is not legal advice.