23 NYCRR 500: the NYDFS cybersecurity regulation in plain English

Published October 22, 2026

23 NYCRR Part 500 is New York's cybersecurity regulation for financial services companies licensed by the Department of Financial Services (NYDFS). It requires a written cybersecurity program, a CISO, multi-factor authentication for everyone, an asset inventory, a 72-hour incident notice and a signed compliance filing every April 15. The amended version became fully enforceable on November 1, 2025.

This is a plain-English summary for owners and managers, not legal advice. Each requirement links back to the text so you can check it.

Who it covers

Anyone operating, or required to operate, under a license, registration, charter, certificate, permit or similar authorization under New York's Banking Law, Insurance Law or Financial Services Law. That's DFS's definition of a covered entity, and it applies even if another regulator also supervises you. In practice: banks and trust companies, insurers, insurance agencies and brokers licensed in New York, mortgage bankers and brokers, money transmitters and check cashers. An agency in Florida with a New York producer license is covered.

The three tiers

Tier	Who	What changes
Limited exemption (500.19(a))	Fewer than 20 employees and contractors, or under $7.5M revenue in each of the last 3 years, or under $15M year-end assets (all including affiliates)	Exempt from 500.4, 500.5, 500.6, 500.8, 500.10, parts of 500.14, 500.15 and 500.16
Standard	Everyone else	The whole regulation
Class A	At least $20M New York revenue, plus over 2,000 employees or over $1B total revenue	Independent audits, endpoint detection, privileged access management, password controls

The limited exemption isn't a full pass. You must still file a Notice of Exemption, and keep the core: risk assessment, cybersecurity policy, access privileges, MFA, asset inventory, training, third-party policy, incident notices and the annual filing. If you stop qualifying, you get 180 days to comply with everything (500.19(h)).

What everyone must have

A cybersecurity program and written policy approved by a senior officer or the board, based on a risk assessment you update at least yearly.
A CISO, who can be an employee or a third party, reporting at least annually to the board (exempt from this under the limited exemption).
Multi-factor authentication for any individual accessing any information system, the final-phase rule since November 1, 2025. Exceptions need written CISO approval of equivalent controls.
An asset inventory with written procedures: owner, location, classification, support end date and recovery time of each asset. Also final-phase.
Access privileges limited to what each role needs, reviewed at least annually, removed promptly when people leave.
Training for all staff at least annually, including social engineering.
Third-party service provider policy: due diligence, contract terms and periodic assessment of vendors that touch your systems or data.
Encryption of nonpublic information in transit and at rest (or CISO-approved compensating controls), plus an incident response and business continuity plan, for non-exempt entities.

Deadlines that don't move

Event	Deadline
Reportable cybersecurity incident (yours, an affiliate's or a vendor's)	72 hours
Ransom or extortion payment: notice	24 hours
Extortion payment: written reasons and alternatives considered	30 days
Annual certification or acknowledgment of noncompliance	April 15
Keep the records behind the filing	5 years

The annual filing is signed by the highest-ranking executive and the CISO. If you weren't fully compliant, you file an acknowledgment that names the sections, describes the gaps and gives a remediation timeline. Filing a certification you can't support is worse than acknowledging the gap.

What enforcement looks like

DFS publishes its enforcement actions. Recent examples on its cybersecurity page include a $2.25 million settlement with Delta Dental (April 2026) and a consent order with Order Express (August 2026). Typical findings: MFA gaps, risk assessments that weren't updated, and certifications filed while controls were missing.

Where small covered entities start

Check whether you qualify for the limited exemption, and file the notice if you do.
Turn on MFA for every account, starting with email and remote access. It's the requirement DFS checks first.
Write the asset inventory: a spreadsheet with the required fields beats no inventory.
Do or update the risk assessment, then write the policy from it.
Put the 72-hour notice in your incident plan with the DFS portal link and who presses send.

Most of these controls are the same ones any small company needs; our small business checklist covers costs per user. If customers also ask for an independent report, see what SOC 2 costs.

Sources: NYDFS Cybersecurity Resource Center · 23 NYCRR §500.17 (notices and annual filing) and §500.19 (exemptions), Cornell Legal Information Institute. Summary as of October 2026; not legal advice.

Questions people ask

Who has to comply with 23 NYCRR 500?

Any person or company operating, or required to operate, under a license, registration, charter or similar authorization under New York's Banking Law, Insurance Law or Financial Services Law. That includes banks, insurers, insurance agencies and brokers, mortgage companies and money transmitters, even if they are based outside New York.

What is the deadline for the annual NYDFS certification?

April 15 every year. You file either a certification of material compliance for the previous calendar year or an acknowledgment of noncompliance, signed by the highest-ranking executive and the CISO.

Does a small insurance agency have to comply?

Partly. With fewer than 20 employees and contractors, or under $7.5 million in revenue in each of the last three years, or under $15 million in assets, you qualify for the limited exemption in section 500.19(a). You still need MFA, a risk assessment, access controls, asset inventory, training, incident notices and the annual filing, among others.

How fast must a cybersecurity incident be reported to NYDFS?

No later than 72 hours after determining that a reportable incident occurred, through the DFS portal. Ransom or extortion payments have their own clock: notice within 24 hours and a written explanation within 30 days.

More guides

How much do managed IT services cost in Houston? — What Houston providers charge per user in 2026, what each tier includes, hurricane-season must-haves, and our own measurement of Houston business email.
Identity theft: what to do right now — Someone used your name or opened a card in it: the steps in order, from the first call to a clean credit report, with every official link.
How to freeze your credit at all six bureaus — Not just Equifax, Experian and TransUnion: Innovis, ChexSystems and NCTUE too. Free, no effect on your score, with every link and phone number.
Is identity theft protection worth it? — When paying is worth it and when free steps are enough, with Aura and LifeLock 2026 prices and what identity theft insurance really pays.
Aura vs LifeLock: prices, coverage and which to choose — Both compared with prices from their own sites: credit bureaus, stolen-funds limits, data removal, family plans and who each suits.
Ransomware recovery: what to do first and which service to call — The first hour, who to call, free decryptors, whether to pay, and how to pick a recovery service that won't quietly pay the attackers.
How to remove your personal information from the internet — Free opt-outs, California's DROP, Google's removal tool, and DeleteMe vs Incogni with 2026 prices.
California DROP: how to delete your data from every data broker at once — Step by step through California's free DROP: verify residency, build your profile, track each broker, and what DROP can't delete.
What to do after a data breach exposes your information — Steps for each type of data exposed: Social Security number, password, card, bank account, license, health and kids' information.
SOC 2 certification cost: Type 1 vs Type 2, line by line — What a first SOC 2 really costs in 2026: the CPA audit, readiness, software, pen test and your own team's time, with the ranges that hold up and how to cut them.
Vanta competitors: what buyers actually pay for each one — Drata, Secureframe, Sprinto, Thoropass and Hyperproof against Vanta, with the median prices real buyers paid and who each one fits.
Vanta pricing: what buyers actually pay — Median $20,000 a year across 375 purchases: price by company size, the add-ons and audit that cost extra, and how buyers negotiate it down.
Vanta vs Drata: real prices and which to choose — 611 real purchases compared: median price, ranges by size, frameworks, discounts, and which one fits a first SOC 2 or a scaling company.
Drata alternatives: real prices and who each one fits — Vanta, Secureframe, Sprinto, Thoropass and Hyperproof against Drata, with median prices paid and why companies switch.
Drata pricing: what companies really pay — Median $24,934 a year across 236 purchases: costs by company size, add-ons and audit fees, renewal increases and how to negotiate.
Secureframe vs Vanta: prices, plans and which to choose — Same median price, different strengths: multi-framework costs, CMMC, reviews and free trial, with real buyer data.
KnowBe4 pricing: per-user cost and what buyers really pay — List price per user by seat count turned into yearly cost, what 684 buyers really paid, add-ons, and the renewal increase to watch.
KnowBe4 alternatives: prices compared, including free ones — Huntress, Hoxhunt, Proofpoint, Microsoft's built-in training and free Gophish, with 2026 prices and who each one fits.
Cybersecurity for small business: the 10 controls that matter — The short list that stops most attacks on a small company, what each control costs per user, and the free government guides behind it.
CCPA cybersecurity audit requirements: who, what and when — Which businesses need California's annual cybersecurity audit, the 2028–2030 deadlines by revenue, and what the auditor checks.
HIPAA compliance for dental offices: a practical checklist — Risk analysis, safeguards, business associate agreements, patient access and breach notices for a dental practice, with HHS's free tools.
FTC Safeguards Rule checklist, and how the WISP fits in — The ten elements of the rule, the under-5,000-customer exemption, the 30-day breach notice, and IRS Publications 5708 and 4557 for tax preparers.