NYDFS 23 NYCRR 500

23 NYCRR 500 is New York DFS's cybersecurity regulation for covered financial services entities. It is a cybersecurity rule first. Third-party service provider security is one required component, but the regulation also covers the cybersecurity program, policies, governance, risk assessment, access controls, asset inventory, incident response, business continuity, reporting, and certification.

Official sources

NYDFS states that amendments to Part 500 strengthened governance, controls, risk assessments, incident notification, and remediation expectations.

What the regulation is trying to do

NYDFS wants covered entities to maintain a cybersecurity program that is actually tied to their risk profile. The rule expects governance, documented policies, responsible leadership, risk assessment, technical controls, incident response, reporting, and evidence that gaps are remediated.

Third-party service provider security matters because covered entities often rely on outside parties that access nonpublic information or support critical systems. The covered entity still needs to understand and manage that risk.

What the regulation covers

Key areas include:

cybersecurity program and written cybersecurity policies;
CISO or qualified cybersecurity leadership and reporting;
risk assessment and asset inventory;
access privileges, MFA, privileged access, and account management;
vulnerability management, penetration testing, monitoring, and logging;
incident response and business continuity / disaster recovery planning;
cybersecurity event notification and extortion payment reporting where applicable;
third-party service provider security policy and oversight;
annual certification or acknowledgement of compliance and remediation.

What teams need to do

Teams should map the cybersecurity program to systems, data, users, providers, incidents, and evidence. For third parties, the useful record is not just "vendor approved." It should show whether the provider accesses nonpublic information, supports a critical system, has appropriate security evidence, is subject to contractual security terms, and can support incident response.

NYDFS implementation should also connect provider issues to remediation. If a provider has a control gap, the covered entity should know the owner, risk, compensating controls, due date, and reporting status.

Evidence to maintain

Cybersecurity policies, program documentation, and governance records.
Risk assessments, asset inventory, and control mapping.
Access reviews, MFA evidence, privileged access evidence, vulnerability evidence, and monitoring

records.

Incident response and business continuity / disaster recovery plans.
Cybersecurity event investigation, notification, remediation, and board or management reporting.
Third-party service provider security policy, assessments, contract terms, and monitoring records.
Certification, acknowledgement, exception, and remediation evidence.

Common gaps

Third-party security reviews are not connected to the covered entity's own risk assessment.
Providers with access to nonpublic information are not clearly separated from low-risk vendors.
Security evidence is collected annually but not refreshed after incidents, contract changes, or

service changes.

Incident response plans mention providers but do not define who must provide what information and

how quickly.

Remediation evidence exists in tickets but is not connected to NYDFS reporting and certification

workflows.

How Halbarad helps

Halbarad helps NYDFS-covered entities manage the provider side of the cybersecurity program. It can connect a third-party security record to nonpublic information access, critical systems, contract terms, control evidence, incidents, findings, remediation, and reporting.

Halbarad can help teams:

identify third parties that access nonpublic information or support critical systems;
collect cybersecurity evidence and keep it tied to the provider's risk profile;
use Spark Assessment to review public evidence, attestations, trust-center material, incident

history, and framework mappings;

use Nth-Party Discovery to identify downstream providers and concentration exposure;
use Continuous Monitoring to detect outages, advisories, status-page changes, and trust-center

updates;

manage issues, remediation, approvals, residual risk, and audit trail through Governance