NYDFS Part 500
New York Department of Financial Services Cybersecurity Requirements for Financial Services Companies (23 NYCRR Part 500)
Part 500 is New York's cybersecurity regulation for DFS-licensed banks, insurers and other financial services companies, effective 1 March 2017. The Second Amendment, adopted on 1 November 2023, phased in stricter controls, and the final set took effect on 1 November 2025, including multi-factor authentication for any individual accessing any information system and a complete asset inventory. It is one of the few laws that names MFA and privileged access management explicitly.
Who it applies to
Individuals and entities operating under a DFS license, registration, charter or similar authorization. 'Class A' companies (at least 20 million dollars in New York revenue in each of the last two fiscal years and either more than 2,000 employees or more than 1 billion dollars in total revenue) face extra duties, and small covered entities have limited exemptions under section 500.19.
Identity requirements
- Use multi-factor authentication for any individual accessing any of the covered entity's information systems (section 500.12, from 1 November 2025); the CISO may approve reasonably equivalent controls in writing
- Limit user access privileges to what is necessary, review access at least annually, remove access promptly at termination, and limit and monitor privileged accounts (section 500.7)
- Class A companies must implement a privileged access management solution and an automated method of blocking commonly used passwords
- Maintain a written asset inventory of information systems
- Notify DFS of cybersecurity incidents within 72 hours, and of any ransom or extortion payment within 24 hours with a written justification within 30 days
- Submit an annual certification of compliance (or acknowledgment of non-compliance) by 15 April
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Authentication & MFA | MFA is required for all individuals accessing any information system, not only remote or privileged access; DFS guidance says SSO without MFA does not qualify. |
| Privileged access (PAM) | Privileged accounts must be limited and monitored, and Class A companies need a PAM solution and password blocklisting. |
| Identity governance (IGA) | Annual access reviews and prompt deprovisioning at termination are explicit requirements. |
| Breach notification | Cybersecurity incidents go to DFS within 72 hours, and ransom payments within 24 hours. |
| Audit, logging & accountability | An executive and the CISO sign the annual compliance certification, creating personal accountability. |
Penalties
Part 500 does not set its own fine schedule; section 500.20 lists factors DFS weighs, and penalties are assessed under the New York Banking, Insurance and Financial Services Laws. A single act or failure, including failing to comply for any 24-hour period, can count as a violation.
Status and dates last verified against primary sources on 2026-10-31.
NYDFS Part 500: frequently asked questions
- Does NYDFS Part 500 require MFA for everyone?
- Yes. Since 1 November 2025, section 500.12 requires multi-factor authentication for any individual accessing any information system of a covered entity, unless the CISO approves reasonably equivalent or more secure compensating controls in writing.
- What are the NYDFS incident reporting deadlines?
- Covered entities must notify DFS within 72 hours of determining that a reportable cybersecurity incident occurred, and report any extortion payment within 24 hours, followed by a written explanation within 30 days.
- What extra rules apply to Class A companies?
- Class A companies must, among other things, implement a privileged access management solution, automatically block commonly used passwords, and run independent audits of their cybersecurity program.