NYDFS Part 500 Preparation Package

Package 01: NYDFS Part 500

Assemble the entity facts and existing cybersecurity records that a Part 500 auditor, examiner or consultant will ask for first. Who uses it: Compliance teams, CISOs, project coordinators, business contacts and internal IT. Scope: 23 NYCRR Part 500 for an entity operating, or required to operate, under a license, registration or similar authorization from the New York Department of Financial Services. Other DFS examination areas, such as financial condition or anti money laundering, need their own preparation.

Before you gather

Start with the DFS license or other authorization and the legal entity. Ask counsel to record the basis for coverage under 500.1(e) and any exemption, starting from the license itself. A limited exemption under 500.19(a) removes specified duties, not the whole regulation. Gather the employee and independent contractor counts, revenue, year end assets and affiliate information so the specialist can apply the definitions, including the Class A tests in 500.1(d).

Know the clocks before you need them. A covered entity must notify the superintendent as promptly as possible and no later than 72 hours after determining that a cybersecurity incident has occurred (500.17(a)(1)). An extortion payment requires notice within 24 hours of the payment and a written explanation within 30 days (500.17(c)). Each year by April 15 the entity files a certification of material compliance or an acknowledgment of noncompliance, signed by its highest ranking executive and its CISO (500.17(b)). Since November 1, 2025, multifactor authentication must be used for any individual accessing any information system of a covered entity, with a narrower list for entities that qualify for a limited exemption under 500.19(a) (500.12(a)).

Keep the activities distinct. A Class A independent audit under 500.2(c), the annual filing, a DFS examination and a readiness review each have a different scope and different evidence. Read the adopted amendment for the rule text and the DFS reading copy for navigation; the September 10, 2026 DFS letter on risk assessments is guidance. Ask the receiving professional to reconcile the current rule with the examination request before the final evidence list is fixed.

Using the worksheets

Give each request to its suggested owner and record each response, including any gap, in Gathering-checklist.csv. Point to records held in the approved evidence location, where passwords, real patient data and controlled technical information stay.

NYDFS Part 500: records to find

Each request below matches a row in Gathering-checklist.csv. Record the response, status and record IDs there.

DFS-R01 Entity and authorization file

Ask: Legal or compliance.

Gather: Legal name, DFS license or registration numbers, authorizations, affiliate chart, covered activities and a copy of any examination letter.

Where to ask: Corporate records, licensing team, DFS correspondence.

Why it matters: The recipient must identify the actual entity and engagement scope.

If missing or uncertain: Record who holds each authorization or request.

Sources: DFS01 500.1(e); DFS04

DFS-R02 Exemption and Class A support

Ask: Finance, HR and compliance.

Gather: Prior determinations and notices; employee or contractor counts and methods; relevant multiyear revenue and year end assets; affiliates and shared systems or programs; changes to eligibility.

Where to ask: Finance reports, HR roster, corporate chart, submission receipts.

Why it matters: Supports professional decisions under 500.1(d) and 500.19 without asking the coordinator to classify the entity.

If missing or uncertain: Use Pending determination; obtain missing affiliate figures or dated receipt. Confirm that any past exemption still applies for the current period.

Sources: DFS01 500.1(d), 500.19; DFS03

DFS-R03 Prior filings and regulator requests

Ask: Compliance.

Gather: Prior calendar year certification or acknowledgment, supporting file, signatory authority, exemption notices, regulator correspondence and unresolved examination items.

Where to ask: Compliance repository and DFS portal receipts.

Why it matters: The April 15 certification or acknowledgment is signed by the highest ranking executive and the CISO (500.17(b)); these records connect the period to actual filings.

If missing or uncertain: List absent years, filing confirmations and signatory gaps. No one should sign a certification from checklist completion.

Sources: DFS01 500.17(b), 500.19; DFS03

DFS-R04 Program policies and approvals

Ask: CISO or security lead.

Gather: Current and period relevant cybersecurity policies, operating procedures, approval records, policy revision history and any affiliate program adoption agreement.

Where to ask: Policy library, board portal, service agreements.

Why it matters: Shows what the organization adopted and when; procedures and implementation records are separate from policy statements.

If missing or uncertain: Supply draft or superseded documents with their status stated. Ask who holds the actual approval record.

Sources: DFS01 500.2, 500.3, 500.4; DFS04

DFS-R05 Governance and staffing records

Ask: Executive sponsor and HR.

Gather: CISO appointment or service arrangement, responsible management, governing body reports, relevant minutes, budget or resource decisions and qualifications or training of security staff.

Where to ask: Board records, HR, vendor agreements.

Why it matters: Helps the auditor plan interviews and understand responsibility and oversight.

If missing or uncertain: Provide names and dates, and mark each report as located, being located or not prepared.

Sources: DFS01 500.4, 500.10

DFS-R06 Risk assessment history

Ask: Risk lead.

Gather: Current and prior assessments, methodology, scoped systems or data, business inputs, threats, vulnerabilities, control evidence, accepted risks and resulting action plans.

Where to ask: Risk register and assessment repository.

Why it matters: Shows why risks and controls were selected and whether changes were considered. The 2026 letter emphasizes traceable, business specific work.

If missing or uncertain: Identify omitted systems, missing rationale or updates awaiting approval as questions for the specialist.

Sources: DFS01 500.9; DFS05

DFS-R07 System and data inventory

Ask: IT and business system owners.

Gather: Hardware, software, cloud or OT inventory where relevant, owners, locations, sensitivity, support dates, recovery objectives, network or data flow diagrams and inventory reconciliation records.

Where to ask: Asset register, network team, procurement and provider portals.

Why it matters: Supports the scope of the review, including specialized systems and third party dependencies.

If missing or uncertain: Use the source atlas and owner interviews to identify unconfirmed repositories.

Sources: DFS01 500.1(i), 500.13

DFS-R08 Access and authentication records

Ask: Identity administrator.

Gather: Account and privileged account lists, review or approval records, joiner or leaver examples, MFA configurations and coverage or exclusions, remote access settings and written compensating control approvals.

Where to ask: Identity, HR, application administrators and provider.

Why it matters: Since November 1, 2025, 500.12(a) requires multifactor authentication for any individual accessing any information system; these records let the specialist compare approved access with actual coverage.

If missing or uncertain: Describe unsupported systems and missing review periods, and record an MFA exception as approved when its written approval is attached.

Sources: DFS01 500.7, 500.12

DFS-R09 Existing vulnerability and penetration test records

Ask: Security lead and service provider.

Gather: Scope, qualifications, dated internal or external penetration test reports, scan or manual review coverage, risk based schedule, significant change records, remediation tickets and existing retest results.

Where to ask: Security provider and ticket system.

Why it matters: Prepares the 500.5 review. Obtain existing work first; scanners, penetration testing and an audit are different activities.

If missing or uncertain: Record absent scope or results and request professional planning. Written authorization, safe scope and third party permissions precede any new test.

Sources: DFS01 500.5; NI05

DFS-R10 Logs and reconstruction examples

Ask: Security operations and finance systems.

Gather: Logging policy, inventory, actual earliest or latest retained dates, protected storage, alert review records, and examples of reconstructing a material financial transaction and a relevant cyber event.

Where to ask: SIEM, financial application owner, archive and provider.

Why it matters: 500.6 distinguishes transaction records from cyber audit trails. Show actual coverage with the earliest and latest retained records.

If missing or uncertain: Identify missing systems or time periods and whether the source ever logged the activity. Supply records as they exist today.

Sources: DFS02 500.6; DFS01 500.14

DFS-R11 Application and supplier records

Ask: Application owners and procurement.

Gather: Application security procedures or reviews, change records, third party inventory, risk based due diligence, security clauses, incident notice terms and reassessments.

Where to ask: Development, procurement, vendor management and contracts.

Why it matters: Connects internal and external services to the entity scope and evidence responsibilities.

If missing or uncertain: Request the actual contract and shared responsibility records; a vendor certificate alone is incomplete.

Sources: DFS01 500.8, 500.11

DFS-R12 Encryption and disposal records

Ask: IT and records management.

Gather: Data inventory, encryption coverage or key management descriptions, exceptions and approvals, disposal policy, retention schedule and disposal records with preservation overrides.

Where to ask: Storage, application owners, records team.

Why it matters: Lets the specialist trace protection and lifecycle decisions to the relevant information.

If missing or uncertain: Describe uncertainty about keys, backups or disposal without supplying secrets. Ask counsel about retention conflicts.

Sources: DFS01 500.13, 500.15

DFS-R13 Monitoring and training records

Ask: Security operations and HR.

Gather: Risk based monitoring coverage, detection and filtering descriptions, training content or attendance and social engineering exercises if conducted; Class A EDR or centralized logging records if potentially relevant.

Where to ask: SOC, learning platform and providers.

Why it matters: Supplies actual operational records for monitoring or training and conditional Class A review.

If missing or uncertain: List the dates, personnel and systems each record covers so the specialist can judge relevance.

Sources: DFS01 500.14

DFS-R14 Response and recovery records

Ask: Continuity lead and IT.

Gather: Incident response and business continuity or disaster recovery plans; staff roles or training; offsite backup scope or protection; existing annual exercises and critical data or system restoration results; after action updates.

Where to ask: Continuity system, backup team, providers.

Why it matters: Supports review of prepared plans, staff participation and actual restoration evidence.

If missing or uncertain: Document an untested dependency as a question. Supply any restore exercise records alongside backup job reports.

Sources: DFS01 500.16

DFS-R15 Incident and notice chronology

Ask: Counsel and incident lead.

Gather: Incident inventory, determination times, decision records, third party notices, DFS submissions or updates and extortion payment records if any, kept in a restricted workspace.

Where to ask: Incident case files, counsel and compliance.

Why it matters: DFS notice is due no later than 72 hours after determining a cybersecurity incident occurred and within 24 hours of an extortion payment (500.17(a)(1) and (c)); these facts set those clocks.

If missing or uncertain: Escalate an active incident immediately. Record unknown times, escalate now, and set each clock from its own triggering event.

Sources: DFS01 500.1(g), 500.17; DFS03

DFS-R16 Prior assurance and open actions

Ask: Internal audit and project lead.

Gather: Prior independent audit reports if applicable, scope and independence records, management responses, open actions, assigned owners, target dates and existing verification records.

Where to ask: Audit or risk repository.

Why it matters: Lets the recipient see earlier work, limitations and unresolved matters without implying closure.

If missing or uncertain: Track missing evidence separately from a proposed corrective action and from accepted verification.

Sources: DFS01 500.2(c), 500.17(b)

NYDFS Part 500: questions for IT and system owners

A useful answer names the actual system, period, supporting record and limits. Where someone else holds the answer, record who can give it. The same questions are in IT-and-owner-questions.csv.

NYDFS Part 500: decisions and handoff

These decisions belong to counsel or the receiving specialist. Each stays open until its owner records a decision. Add questions specific to the client and a responsible person in Open-questions.csv.

Preparing the handoff

The handoff is ready when the engagement sponsor has confirmed the entity and period, with any exemption or Class A question marked as pending; every request has a response or a named gap with a period and a next owner; incident and testing material is indexed without travelling as an ordinary email attachment; and the specialist has the actual examination request from which to set the final criteria.

Use Record-index.csv for one row per file or defined record set, and follow the walkthrough in the library for custody, restricted records and receipt.

Sources for this package

Laws and regulations set duties within their scope; agency guidance explains how they are applied; NIST supplies methods; vendor documentation describes how a product can behave. The full list is in Source-register.csv.

DFS01 DFS final adopted second amendment to Part 500. Adopted regulatory text. 500.1 through 500.24 as amended November 1, 2023; read the amendment markup carefully. https://www.dfs.ny.gov/industry_guidance/regulations/final_adoptions_fs/rf_fs_2amend23nycrr500_text_20231101

DFS04 DFS cybersecurity FAQs. Agency interpretation. Exemptions, applicability and program guidance. https://www.dfs.ny.gov/cybersecurity/faqs

DFS03 DFS cybersecurity submissions. Agency filing guidance. Annual compliance notification; incident and extortion notices. https://www.dfs.ny.gov/cybersecurity/submissions

DFS05 DFS risk assessment guidance, September 10, 2026. Agency guidance. Risk identification, methodology and use of the risk assessment. https://www.dfs.ny.gov/industry_guidance/industry_letters/il20260910-cyber-risk-assessment

NI05 NIST SP 800-115. Technical testing guidance. Assessment planning, logistics, rules of engagement and reporting. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf

DFS02 DFS Part 500 reading copy. Agency reading copy. Full Part 500 reading copy; compare it with the adopted text. https://www.dfs.ny.gov/cybersecurity/23-NYCRR-Part-500

DFS07 23 NYCRR 500.12 and 500.17 (Cornell LII text). Regulatory text. 500.12(a) multifactor authentication; 500.17(a)(1) 72 hour notice, 500.17(b) April 15 filing, 500.17(c) extortion payment notice. https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.17