New York Cybersecurity Regulations - What You Need to Know

NYDFS Part 500 Cybersecurity Regulation: Webinar Highlights

On November 4, 2026, EisnerAmper's Technology Assurance team presented a webinar for the Greater New York Chamber of Commerce on New York's cybersecurity regulation for financial services companies, 23 NYCRR Part 500. The session explored the regulation's development, its enhanced requirements, implementation challenges, and the growing importance of artificial intelligence in cybersecurity risk management.

Background and Scope

23 NYCRR Part 500 establishes cybersecurity requirements for organizations regulated by the New York State Department of Financial Services (NYDFS). Depending on their activities and regulatory status, covered entities may include banks, insurers, mortgage companies, money transmitters, virtual currency businesses, and other financial services organizations operating under a DFS license, registration, charter, or similar authorization.

When first introduced, Part 500 was among the earliest comprehensive state cybersecurity frameworks directed specifically at the financial services industry. It requires covered entities to maintain a cybersecurity program designed to protect information systems and nonpublic information. Core expectations include risk assessments, written cybersecurity policies, access controls, incident response planning, third-party risk management, cybersecurity training, and regulatory reporting.

The regulation is intended to be risk-based rather than one-size-fits-all. An organization's obligations depend in part on its size, operations, systems, data, and exposure to cybersecurity threats. Determining whether an organization is covered - and whether it qualifies for any exemption - is therefore an important first step.