Fines under New York's cybersecurity rule have passed real money this year. Regulators secured over $144 million in fines from 27 entities for cybersecurity violations as of October 2025. That number keeps climbing. It shows that the New York State Department of Financial Services (NYDFS) treats 23 NYCRR Part 500 as an enforceable rulebook, not a suggestion.
Part 500, often called NYDFS Part 500 or NYDFS 500, sets cybersecurity requirements for banks, insurers, and other financial services firms licensed in New York. The rule got a major overhaul in 2023 known as the Second Amendment. That overhaul finished phasing in during November 2025. Every covered firm now faces the full set of updated rules at once.
This article covers what the NYDFS cybersecurity regulation requires. It covers who counts as a covered entity, what changed under the Second Amendment, and where enforcement risk sits today. A partial compliance program built for the 2017 version of the rule no longer meets the bar. Firms need a program matched to the current regulation, not the old one.
What Is the NYDFS Cybersecurity Regulation?
The NYDFS Cybersecurity Regulation is a binding rule, not guidance. DFS adopted it on March 1, 2017. DFS describes it as the first-in-the-nation cybersecurity regulation, setting cybersecurity requirements for financial services companies.
The rule applies to any firm operating under a license, registration, charter, or similar authorization from DFS. That includes banks, insurance companies, mortgage servicers, and money transmitters. It also reaches virtual currency businesses and other DFS-licensed entities.
A "covered entity" is any organization that meets that licensing test, regardless of size. Smaller firms get limited relief through an exemption filing, covered further below. The baseline test for coverage is broad.
What Changed Under the Second Amendment?
DFS finalized the Second Amendment to Part 500 on November 1, 2023. Legal analysts called it the most significant set of changes to Part 500 since regulators first enacted the rule.
The amendment did not replace the original rule. It added new governance, technical, and reporting duties on top of the existing framework. Key additions include:
- A new tier called "Class A company" with added controls
- Expanded multi-factor authentication duties covering more account types
- A documented asset inventory requirement
- A 24-hour notice for extortion or ransom payments
- Dual sign-off on the annual compliance certification
DFS staggered these changes rather than demanding instant compliance. The rollout stretched from late 2023 through November 2025. Different sections took effect on different dates.
What Are the Key Compliance Deadlines?
The first deadline landed fast. Expanded incident notice duties under section 500.17 took effect 30 days after the amendment's effective date.
The next milestone involved paperwork rather than technology. Covered entities filed a Certification of Material Compliance or Acknowledgment of Noncompliance for the year 2023 by April 15, 2024.
A full year later, governance and planning duties kicked in. Section 500.4 (CISO reporting and board oversight), section 500.15 (encryption), and section 500.16 (incident response and business continuity planning) became enforceable on November 1, 2024. Multiple compliance guides track this rollout against the DFS implementation timeline.
The final and largest wave hit in 2025. Universal multi-factor authentication under section 500.12 and the full asset inventory mandate under section 500.13(a) became mandatory on November 1, 2025. DFS set this schedule in section 500.22 of the regulation. Every covered entity now operates under the complete rule, with no further phase-in periods ahead.
What Does Part 500 Actually Require?
Part 500 builds a cybersecurity program around a documented risk assessment, not a generic checklist. Several core sections carry most of the operational weight.
A written cybersecurity program and policy. Every covered entity keeps a formal program built around confidentiality, integrity, and availability of its systems. A senior officer or the board approves written policy at least once a year.
A designated Chief Information Security Officer (CISO). Every covered entity names a CISO responsible for the program. Under the amendment, the CISO reports to the senior governing body on material cybersecurity issues. This includes major incidents and significant program changes.
Board-level accountability. The amendment raised the bar for oversight. Regulators now expect the board of directors to have enough knowledge and expertise in cybersecurity matters, or to get advice from qualified staff, so it can exercise real oversight.
Multi-factor authentication (MFA). MFA now applies broadly. Section 500.12 requires MFA for any individual who accesses a covered entity's information systems. This scope reaches well past privileged accounts alone.
Asset inventory. Section 500.13 requires a documented inventory of information systems. It must track ownership, location, and classification for each asset. This gives examiners a concrete artifact to check during a review.
Incident response and reporting. Covered entities file a report within 72 hours of a cybersecurity event that triggers notice duties. This includes ransomware deployment within a material part of its systems, per DFS's expanded notice requirements. A separate 24-hour window applies specifically to extortion payments made in connection with a cybersecurity event.
Annual certification. Every covered entity files one of two things each year: a certification of material compliance, or a notice of noncompliance explaining the gap. The amendment added a notable change here.
The annual Certification of Material Compliance now needs two signatures: a Senior Officer and the CISO. This puts named individuals on the hook for the accuracy of the filing.
What Is a Class A Company Under NYDFS?
A Class A company is a defined category created by the Second Amendment, and it carries extra obligations. The threshold combines a revenue test with either a headcount test or a global revenue test.
DFS defines a Class A company as a covered entity with at least $20,000,000 in gross annual revenue in each of the last two fiscal years. This revenue must come from all business operations of the covered entity and the New York business operations of its affiliates. That revenue threshold then pairs with one of two additional tests. A firm qualifies if it also has over 2,000 employees averaged over the last two fiscal years, including employees of both the covered entity and all of its affiliates regardless of location. A firm also qualifies if it has over $1,000,000,000 in gross annual revenue in each of the last two fiscal years from all business operations of the covered entity and all of its affiliates regardless of location.
Class A status adds real technical weight. These firms need:
- Independent cybersecurity program audits based on risk assessment
- A privileged access management solution
- An automated method of blocking commonly used passwords
- An endpoint detection and response solution to monitor unusual activity, including lateral movement
- A solution that centralizes logging and security event alerting
A mid-sized fintech with a small New York office might assume it falls outside this tier. That assumption deserves a second look. The revenue test counts affiliate operations in New York specifically. The employee and billion-dollar tests count affiliates worldwide. A global parent company can pull a modest New York subsidiary into Class A status without much warning.
Is Compliance Enforcement Actually Happening?
Yes, and the penalty figures back that up with specific dollar amounts. A recent settlement fined two insurance companies after a breach tied to the compromise of more than 120,000 New Yorkers' personal information, according to the DFS settlement announcement.
A separate action targeted a money transmitter following a 2022 ransomware event. Regulators imposed a $250,000 penalty tied to weak risk assessment practices that left the company's security program with critical gaps.
Late or missing breach notice shows up again and again in these cases. A separate regulatory alert noted that delayed notification turns a cybersecurity incident into a severe compliance failure. It treats the reporting clock as a top priority after any incident.
How Should Financial Firms Approach Compliance Now?
The transitional periods are over, so compliance gets judged against the full current rule. Firms that built a program around the 2017 version of Part 500 face gaps in several areas at once: MFA scope, asset inventory, board reporting, and the dual-signature certification.
A practical approach starts with a gap assessment against the current text of section 500.1 through 500.24, not a summary written before 2023. That assessment should flag Class A status early. The threshold calculation surprises some firms with international affiliates. From there, a remediation plan with realistic internal deadlines, mapped against audit cycles, keeps a covered entity ahead of an examination rather than reacting to one.
Getting Part 500 Right
The NYDFS cybersecurity regulation no longer gives covered entities a grace period to lean on. Every section of Part 500, from CISO reporting to the dual-signature certification, applies in full today. Firms still working from an outdated compliance map face real exposure, both from DFS examiners and from the next cybersecurity event that triggers a 72-hour clock.
Planet 9 is a Bay Area cybersecurity consulting firm specializing in financial services compliance, including NYDFS 23 NYCRR Part 500 readiness, for banks, insurers, and other regulated financial firms. Our vCISOs and compliance managers help organizations close control gaps, configure GRC tools if needed, and get audit-ready without wasted time.
