Read this guide freely. Request download access with your name and email.
GDF records the selected resource in its lead intake and private Stats.
Open your emailed link for seven days of preparation downloads in this browser.
No marketing subscription is created. Keep completed records in controlled systems.
Prepare an organized set of entity facts and existing cybersecurity records for a Part 500 auditor or consultant.
Business contacts, compliance teams, CISOs, project coordinators and internal IT
23 NYCRR Part 500 preparation for a potentially covered legal entity. Other DFS examination areas such as financial condition, anti-money laundering or transaction monitoring are outside this package.
Start with the DFS license or other authorization and legal-entity identity. Presence in New York, handling New York data, or supplying a regulated customer does not by itself decide whether the organization is a covered entity under 500.1(e). Ask counsel to document the basis and any exemption.
A limited exemption under 500.19(a) removes specified duties, not the whole regulation. Gather the underlying employee and independent-contractor counts, revenue, assets and affiliate information; let the specialist apply the exact definitions. Class A status also depends on specific revenue, employee and affiliate calculations.
Class A independent audits under 500.2(c), an annual filing under 500.17(b), a DFS examination and a consultant readiness review are different activities. The Class A audit is based on the risk assessment; do not describe a universal annual external-audit requirement.
Use the adopted amendment as regulatory evidence and the clearly marked DFS reading copy for navigation. The September 10 2026 risk-assessment letter is guidance. Ask the receiving professional to reconcile the current consolidated rule, amendments and the examination request before fixing the final evidence list.
Give each request to the suggested owner. Record what is available and what is unknown in the editable CSV checklist. Use a secure evidence location agreed with the recipient; the checklist is an index, not a place for passwords, real patient data or controlled technical information.
Records to find
Download the editable gathering checklist. CSV files contain plain records, without saved column widths or workbook formatting. Import as UTF-8, keep IDs as text, wrap text and widen columns before use. Blank client fields are intentional.
DFS-R01 Entity and authorization file
Ask
Legal or compliance
Gather
Legal name, DFS license/registration numbers, authorizations, affiliate chart, covered activities and a copy of any examination letter.
Prior determinations and notices; employee/contractor counts and methods; relevant multi-year revenue and year-end assets; affiliates and shared systems/programs; changes to eligibility.
Current and period-relevant cybersecurity policies, operating procedures, approval records, policy revision history and any affiliate program adoption agreement.
Where to ask
Policy library, board portal, service agreements
Why it may be needed
Shows what the organization adopted and when; procedures and implementation records are separate from policy statements.
If missing or uncertain
Supply draft or superseded documents with their status stated. Ask who holds the actual approval record.
CISO appointment or service arrangement, responsible management, governing-body reports, relevant minutes, budget/resource decisions and qualifications/training of security staff.
Where to ask
Board records, HR, vendor agreements
Why it may be needed
Helps the auditor plan interviews and understand responsibility and oversight.
If missing or uncertain
Provide names and dates; list unlocated reports separately from reports known never to have been prepared.
Current and prior assessments, methodology, scoped systems/data, business inputs, threats, vulnerabilities, control evidence, accepted risks and resulting action plans.
Where to ask
Risk register and assessment repository
Why it may be needed
Shows why risks and controls were selected and whether changes were considered. The 2026 letter emphasizes traceable, business-specific work.
If missing or uncertain
Identify omitted systems, missing rationale or updates awaiting approval as questions for the specialist.
Hardware/software/cloud/OT inventory where relevant, owners, locations, sensitivity, support dates, recovery objectives, network/data-flow diagrams and inventory reconciliation records.
Where to ask
Asset register, network team, procurement and provider portals
Why it may be needed
Supports the scope of the review, including specialized systems and third-party dependencies.
If missing or uncertain
Use the source atlas to identify unconfirmed repositories; do not scan production merely to fill the inventory.
Account and privileged-account lists, review/approval records, joiner/leaver examples, MFA configurations and coverage/exclusions, remote access settings and written compensating-control approvals.
Where to ask
Identity, HR, application administrators and provider
Why it may be needed
Allows the specialist to compare approved access with actual covered systems.
If missing or uncertain
Describe unsupported systems and missing review periods; do not call an MFA exception approved without the written record.
Logging policy, inventory, actual earliest/latest retained dates, protected storage, alert review records, and examples of reconstructing a material financial transaction and a relevant cyber event.
Where to ask
SIEM, financial application owner, archive and provider
Why it may be needed
500.6 distinguishes transaction records from cyber audit trails. A product retention setting alone does not show actual coverage.
If missing or uncertain
Identify missing systems/time periods and whether the source ever logged the activity. Do not create historical evidence.
Data inventory, encryption coverage/key-management descriptions, exceptions and approvals, disposal policy, retention schedule and disposal records with preservation overrides.
Where to ask
Storage, application owners, records team
Why it may be needed
Lets the specialist trace protection and lifecycle decisions to the relevant information.
If missing or uncertain
Describe uncertainty about keys, backups or disposal without supplying secrets. Ask counsel about retention conflicts.
Risk-based monitoring coverage, detection and filtering descriptions, training content/attendance and social-engineering exercises if conducted; Class A EDR/centralized logging records if potentially relevant.
Where to ask
SOC, learning platform and providers
Why it may be needed
Supplies actual operational records for monitoring/training and conditional Class A review.
If missing or uncertain
List unavailable dates and excluded personnel or systems; specialist determines relevance.
Incident inventory, determination times, decision records, third-party notices, DFS submissions/updates and extortion-payment records if any, kept in a restricted workspace.
Where to ask
Incident case files, counsel and compliance
Why it may be needed
Specialists need facts to evaluate distinct incident, payment and other reporting clocks.
If missing or uncertain
Escalate an active incident immediately. Record unknown times; do not wait to finish this package or set every clock from the same event.
Prior independent audit reports if applicable, scope and independence records, management responses, open actions, assigned owners, target dates and existing verification records.
Where to ask
Audit/risk repository
Why it may be needed
Lets the recipient see earlier work, limitations and unresolved matters without implying closure.
If missing or uncertain
Track missing evidence separately from a proposed corrective action and from accepted verification.
Download the response template. A useful answer names the actual system, period, supporting record and limits. If you do not know, name the person or provider who can answer.
1. Which legal entity and DFS authorization does the request concern?
Suggested responder
Legal or compliance
Useful supporting record
Attach authorization and examination request or record who has them.
2. Which period, systems and affiliates does the receiving professional expect to review?
Suggested responder
Engagement sponsor and auditor
Useful supporting record
Return a marked diagram and entity list.
3. Which MFA routes, privileged accounts and older applications are outside the normal configuration?
Suggested responder
Identity and application owners
Useful supporting record
Provide dated coverage and exception records, with no credentials.
4. What did the last internal and external penetration tests actually cover?
Suggested responder
Security lead
Useful supporting record
Return scope, dates, reports and exclusions.
5. How did the risk assessment affect decisions about each critical service and common provider?
Suggested responder
Risk and service owners
Useful supporting record
Link risk entries, decisions, control records and action owners.
6. Which logs can you still retrieve for the review period?
Suggested responder
Security operations
Useful supporting record
List each source, earliest/latest dates, gaps and relevant retention policy.
7. What evidence shows a critical system was restored and used successfully?
Suggested responder
Recovery owner
Useful supporting record
Supply actual exercise records with limitations.
8. Who can securely supply missing records and approve disclosure to the recipient?
Suggested responder
Project sponsor
Useful supporting record
Provide a responsibility list and approved transfer route.
Missing facts and specialist decisions
These are explicit handoff questions. Marking records Received does not resolve them. Add client-specific questions and a responsible person.
DFS-Q01 Does this legal entity qualify as covered, exempt or Class A for the period?
Ask
Counsel and receiving Part 500 specialist
Gather
Authorizations, affiliate facts, figures and prior notices
Resolution needed
Written period-specific scope determination; gathering receipt is not this determination.
DFS-Q02 Is the planned engagement a DFS examination, Class A independent audit, internal review or readiness consultation?
Ask
Sponsor and receiving auditor
Gather
Examination letter, charter and intended deliverables
Resolution needed
Agreed scope, independence, criteria and recipient responsibilities.
Entity and period confirmed by the engagement sponsor; exemption/Class A issues visibly pending where unresolved.
Each applicable preparation request has a response or a named gap, period and next owner.
Restricted incident and testing material is indexed without being exposed in an ordinary email attachment.
Specialist receives the actual examination request and determines the final criteria and evidence sufficiency.
Download the record index. Use the shared walkthrough for custody, restricted records, missing information and receipt steps.
Sources for this package
Official laws/rules establish duties within their scope. Guidance explains programs; NIST supplies methods; vendor documentation describes possible product behavior. Actual contracts, facts, configuration and case orders still matter.
