NYDFS Part 500 Explained: Rules, Deadlines, Penalties

Most people meet Part 500 the same way: an examiner's request list arrives, and somewhere on it is a line asking for the annual certification, the risk assessment and the last penetration test report. There is no negotiating position available at that point, because the obligation did not come from a contract. It came attached to the license that lets the business operate at all, and it has been in force since 2017.

What Is NYDFS Part 500?

Part 500 is a cybersecurity rule written by a financial regulator and enforced like any other banking or insurance rule. It was adopted effective March 1, 2017 and substantially rewritten by a second amendment effective November 1, 2023. That rewrite moved the filing deadline, raised the exemption thresholds and created a new tier for the largest institutions, so any internal memo or policy document dated before it is describing a rule that no longer exists.

What makes it different from SOC 2 or the NIST framework is the source of the obligation. Nobody sells you a Part 500 report and no customer asks for one. The superintendent examines you for it, and the consequences run through the same enforcement machinery as a capital or a consumer protection violation.

Two words in that definition decide most eligibility arguments. "Required to operate under" catches firms doing licensable business without the license. "Regardless of whether the covered entity is also regulated by other government agencies" closes the door on the argument that a federal examination already covers this ground.

Who Has to Comply With 23 NYCRR Part 500?

The test is the license, not the headquarters. A mortgage servicer registered in New York and staffed entirely in Texas is covered. A non-US bank licensed by the superintendent to maintain a New York branch is covered. A software company selling to New York banks is not covered at all, though its customers will push Part 500 obligations onto it through contract under section 500.11.

State-chartered banks, licensed lenders, mortgage bankers and brokers, mortgage loan servicers, check cashers, money transmitters, budget planners, sales finance companies, premium finance agencies, insurance companies, insurance agents and brokers, and the New York branches and agencies of non-US banks all sit inside the definition. Anyone running a financial services security program in New York is working to this rule whether or not they call it by name.

The affiliate arithmetic in section 500.1(d) is narrower than it first reads. When counting employees and revenue for the Class A test, affiliates count only if they share information systems, cybersecurity resources or any part of a cybersecurity program with the covered entity. A holding company with genuinely separate technology in each subsidiary can fall below the threshold that a consolidated revenue line would suggest.

What Are the NYDFS Part 500 Requirements?

Part 500 runs to twenty-four sections. Sections 500.2 through 500.17 impose the substantive obligations, and the table below is the practical map from a section number to the thing an examiner will ask to see. The three it leaves out are narrower: audit trail under 500.6, application security under 500.8, and cybersecurity personnel and intelligence under 500.10.

Four of those cost more than the rest. Section 500.12 requires multi-factor authentication for any individual accessing any information system of a covered entity. Every individual, every system, not only remote sessions. Where a CISO judges MFA impractical somewhere, the section allows reasonably equivalent or more secure compensating controls, but only with written CISO approval reviewed at least annually.

Section 500.15 requires a written policy mandating encryption in transit and at rest that meets industry standards. The at-rest half has an escape valve: where encryption is infeasible, alternative compensating controls approved in writing by the CISO are permitted, with the feasibility judgment revisited annually. There is no equivalent escape valve for data in transit over external networks.

Section 500.5 sets the testing rhythm. Penetration testing is required at least annually, from both inside and outside the information systems' boundaries, by a qualified internal or external party. Automated vulnerability scans run at a frequency the risk assessment sets and promptly after any material system change, with a manual review of whatever the scans do not cover.

Section 500.16 turns the incident response plan from a document into an exercise. Plans have to cover nine named areas, including root cause analysis and recovery from backups, and both the incident response and the business continuity plans must be tested at least annually with all critical staff and management. The ability to restore critical data from backup is a separate annual test, and the backups themselves must be protected from unauthorized alteration or destruction.

The third-party section deserves its own note, because the exposure it addresses is now the majority case. The 2026 Verizon Data Breach Investigations Report found that breaches involving a third party account for 48 percent of all breaches, with third-party supply chain breaches up 60 percent. Section 500.11 responds by requiring written policies covering identification and risk assessment of providers, the minimum practices they must meet, due diligence, and periodic reassessment, plus contractual guidelines addressing their MFA, their encryption and the notice they owe you after an event. Section 500.14(a)(3) covers the human side with security awareness training at least annually, explicitly including social engineering.

What Do Class A Companies Have to Do Differently?

The Class A tier is the second amendment's most consequential addition, and it lands on a small number of large institutions. Three sections carry duties that attach to a Class A company and to nobody else.

Section 500.2(c) requires a Class A company to design and conduct independent audits of its cybersecurity program based on its risk assessment. The regulation's own definition in section 500.1(h) allows internal or external auditors, provided they are free to make decisions not influenced by the entity being audited or by its owners, managers or employees. Section 500.7(c) adds monitoring of privileged access activity, a privileged access management solution, and an automated method of blocking commonly used passwords.

Section 500.14(b) requires an endpoint detection and response solution that monitors anomalous activity including lateral movement, and a solution that provides centralized logging and security event alerting. Both can be replaced by compensating controls, but only where the CISO has approved the substitution in writing.

Who Is Exempt From NYDFS Part 500?

The limited exemption in section 500.19(a) is the one most firms ask about, and it is routinely misread. Meeting any one of the three thresholds qualifies an entity, and the thresholds count the covered entity together with its affiliates.

Three narrower exemptions sit alongside it. An entity covered by an affiliate's or parent's program under 500.19(b) need not build its own. An entity that operates no information systems and holds no nonpublic information is exempt from twelve sections under 500.19(c). Certain insurance-law persons, accredited and certified reinsurers, and licensees in inactive status are exempt from the Part entirely under 500.19(g), provided they do not otherwise qualify as a covered entity.

Two mechanics catch people out. A qualifying entity must file a Notice of Exemption electronically within 30 days of determining that it is exempt, so the exemption is claimed rather than assumed. And under 500.19(h), an entity that grows past a threshold has 180 days from the date it stops qualifying to comply with everything that now applies.

What Are the NYDFS Part 500 Reporting Deadlines?

Four clocks run under section 500.17, and only one of them is annual.

The 72-hour notice covers a cybersecurity incident at the covered entity, at an affiliate, or at a third-party service provider. Section 500.1(g) defines an incident as an event that requires notice to any government body, self-regulatory agency or other supervisory body, or that has a reasonable likelihood of materially harming any material part of normal operations, or that results in the deployment of ransomware within a material part of the entity's information systems. That third limb means a ransomware deployment is reportable on its own terms, without any argument about whether data left the building.

The annual filing is where the second amendment changed the shape of the obligation. A covered entity submits either a written certification of material compliance for the prior calendar year, based on data and documentation sufficient to demonstrate it, or a written acknowledgment that it did not materially comply, identifying every section involved, describing the nature and extent of the noncompliance, and providing a remediation timeline or confirmation that remediation is complete. Both are signed by the highest-ranking executive and the CISO, and the supporting records are kept for five years.

When Did the NYDFS Part 500 Second Amendment Take Effect?

November 1, 2023, with new requirements phased in over the following two years under section 500.22. Every date has now passed, so an entity reading this in 2026 is subject to the whole amended text with no transition left to rely on.

What Are the Penalties for Violating NYDFS Part 500?

Section 500.20 is the enforcement section, and it contains no dollar figures at all. What it does is define what counts as a violation and how the superintendent weighs one.

The dollar amounts come from elsewhere. Section 500.20(c) points at the Banking Law, the Insurance Law and the Financial Services Law, and the tier that applies depends on what kind of institution you are. Banking Law section 44 runs two separate ladders, one for licensees and registrants and a higher one for banking organizations, while Financial Services Law section 408 covers the entities that fall under neither.

In practice, the per-day arithmetic is a ceiling rather than a forecast. Enforcement resolves through consent orders that name a single sum, and section 500.20(c) is the list a firm's counsel argues from when the sum is being set.

How to Prepare for an NYDFS Part 500 Examination

An examination tests records, not intentions. The sections that most often produce findings are the ones whose evidence has to accumulate on a schedule, because a control switched on the week before the request list arrives leaves a visible eleven-month hole.

Where an in-house CISO does not exist, section 500.4(a) permits one employed by an affiliate or a third-party service provider, which is why a fractional CISO is a common arrangement at smaller covered entities. The regulation attaches three conditions: the covered entity keeps responsibility for compliance, names a senior member of its own staff to direct and oversee the provider, and requires that provider to maintain a program meeting the Part.

How NYDFS Part 500 Compares to SOC 2 and the NIST Framework

The three get grouped together and behave nothing alike. Part 500 is law, applied by a regulator who examines you and can fine you. SOC 2 is an accountant's attestation that your customers ask for and no regulator issues. The NIST Cybersecurity Framework is a voluntary structure that nobody enforces at all.

The overlap is real at the control level and useless at the obligation level. A clean SOC 2 Type 2 covering the same systems will have already produced much of the evidence an examiner wants, particularly access reviews, change management and monitoring. It does not satisfy a single section of Part 500 on its own, because Part 500 names specific controls with specific frequencies and a specific signatory, and an attestation report is not a filing with the superintendent.

Alignment does carry weight in one narrow place. Section 500.20(c)(15) directs the superintendent to consider the extent to which an entity's policies and procedures are consistent with nationally recognized cybersecurity frameworks, naming NIST, when assessing a penalty. That is a mitigating factor in enforcement, not a safe harbor from the requirements.