Regulation guide

NYDFS 23 NYCRR 500 Cybersecurity

Operationalize the NYDFS 23 NYCRR 500 Cybersecurity requirements—from regulatory obligations and evidence collection to vendor assessments, continuous monitoring, governance, and remediation workflows.

Overview

23 NYCRR 500 is New York DFS's cybersecurity regulation for covered financial services entities. It is a cybersecurity rule first.

NYDFS wants covered entities to maintain a cybersecurity program that is actually tied to their risk profile. The rule expects governance, documented policies, responsible leadership, risk assessment, technical controls, incident response, reporting, and evidence that gaps are remediated.

Third-party service provider security matters because covered entities often rely on outside parties that access nonpublic information or support critical systems. The covered entity still needs to understand and manage that risk.

This implementation guide explains what the regulation requires, how those requirements translate into operational controls and evidence, and how Halbarad helps organizations operationalize compliance through assessments, continuous monitoring, governance workflows, and supply chain risk intelligence.

Official Sources

NYDFS states that amendments to Part 500 strengthened governance, controls, risk assessments, incident notification, and remediation expectations.

Intent of the Guide

NYDFS wants covered entities to maintain a cybersecurity program that is actually tied to their risk profile. The rule expects governance, documented policies, responsible leadership, risk assessment, technical controls, incident response, reporting, and evidence that gaps are remediated.

Third-party service provider security matters because covered entities often rely on outside parties that access nonpublic information or support critical systems. The covered entity still needs to understand and manage that risk.

What the regulation covers

Key areas include:

  • cybersecurity program and written cybersecurity policies;
  • CISO or qualified cybersecurity leadership and reporting;
  • risk assessment and asset inventory;
  • access privileges, MFA, privileged access, and account management;
  • vulnerability management, penetration testing, monitoring, and logging;
  • incident response and business continuity / disaster recovery planning;
  • cybersecurity event notification and extortion payment reporting where applicable;
  • third-party service provider security policy and oversight;
  • annual certification or acknowledgement of compliance and remediation.

Operationalization Requirements

Teams should map the cybersecurity program to systems, data, users, providers, incidents, and evidence. For third parties, the useful record is not just "vendor approved." It should show whether the provider accesses nonpublic information, supports a critical system, has appropriate security evidence, is subject to contractual security terms, and can support incident response.

NYDFS implementation should also connect provider issues to remediation. If a provider has a control gap, the covered entity should know the owner, risk, compensating controls, due date, and reporting status.

Evidence Requirements

  • Cybersecurity policies, program documentation, and governance records.
  • Risk assessments, asset inventory, and control mapping.
  • Access reviews, MFA evidence, privileged access evidence, vulnerability evidence, and monitoring

records.

  • Incident response and business continuity / disaster recovery plans.
  • Cybersecurity event investigation, notification, remediation, and board or management reporting.
  • Third-party service provider security policy, assessments, contract terms, and monitoring records.
  • Certification, acknowledgement, exception, and remediation evidence.

Common Gaps

  • Third-party security reviews are not connected to the covered entity's own risk assessment.
  • Providers with access to nonpublic information are not clearly separated from low-risk vendors.
  • Security evidence is collected annually but not refreshed after incidents, contract changes, or

service changes.

  • Incident response plans mention providers but do not define who must provide what information and

how quickly.

  • Remediation evidence exists in tickets but is not connected to NYDFS reporting and certification

workflows.

How Halbarad Helps

Halbarad helps NYDFS-covered entities manage the provider side of the cybersecurity program. It can connect a third-party security record to nonpublic information access, critical systems, contract terms, control evidence, incidents, findings, remediation, and reporting.

Halbarad can help teams:

  • identify third parties that access nonpublic information or support critical systems;
  • collect cybersecurity evidence and keep it tied to the provider's risk profile;
  • use Spark Assessment to review public evidence, attestations, trust-center material, incident

history, and framework mappings;

  • use Nth-Party Discovery to identify downstream providers and concentration exposure;
  • use Continuous Monitoring to detect outages, advisories, status-page changes, and trust-center

updates;

  • manage issues, remediation, approvals, residual risk, and audit trail through Governance

workflows.

Halbarad supports operational evidence. It does not replace NYDFS rule interpretation or covered entity accountability.

Disclaimer

This guide is for general information only and is not legal advice. Review the official regulation, guidance, and supervisory materials, and consult qualified counsel or compliance advisors for your organization's specific obligations.