AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor CISOs and compliance leads at DFS-licensed banks, insurers, agencies and lenders who sign the annual filing and keep the records behind it.
30-day trialUnlimited free viewersNo credit card required
Checked against primary sources on 18 October 2026.
Any person operating, or required to operate, under a license, registration, charter or similar authorization under New York's Banking, Insurance or Financial Services Law.
DFS examiners, through examinations and investigations; the annual notice of compliance goes to the Superintendent.
Annual notice of compliance by April 15; policies approved, risk assessment updated, training delivered and plans tested at least annually
23 NYCRR Part 500 as amended by the Second Amendment, 2023-11-01. Free to read.
| Date | What happens | Status |
|---|---|---|
| 2025-05-01 | 18-month phase: 500.5(a)(2), 500.7 access privileges, 500.14(a)(2) and 500.14(b) apply | Done |
| 2025-11-01 | Final phase: 500.12 multi-factor authentication and 500.13(a) asset inventory apply | Done |
| 2026-04-15 | Annual notice of compliance for calendar year 2025 due | Done |
| 2026-09-10 | DFS industry letter on how to conduct and use Part 500 risk assessments | Done |
| 2027-04-15 | Annual notice of compliance for calendar year 2026 due | Scheduled |
Each one needs an owner, an approval, and proof it reached the people it covers.
23 NYCRR 500.3
Written policies, approved at least annually by a senior officer or the senior governing body, based on the risk assessment and covering the areas the section lists.
23 NYCRR 500.9
Carried out under written policies and procedures, documented, and reviewed and updated at least annually or when a material change in cyber risk occurs.
23 NYCRR 500.4(b)
The CISO reports in writing at least annually to the senior governing body on the cybersecurity program and material cybersecurity risks.
23 NYCRR 500.14(a)(3)
Training for all personnel at least annually, including social engineering, and updated to reflect risks identified in the risk assessment.
23 NYCRR 500.16
Written incident response, business continuity and disaster recovery plans, tested at least annually with critical staff and management and revised as needed.
23 NYCRR 500.17(b)
By April 15, a certification of material compliance or an acknowledgment of noncompliance, signed by the highest-ranking executive and the CISO.
Citations are to the standard or regulation; wording is ours.
What reviewers sample about these documents and the people they cover.
Examiners ask for each cybersecurity policy with evidence of annual approval by a senior officer or the senior governing body.
DFS can request the records, schedules and data supporting the certification or acknowledgment, which must be kept for five years.
Expect requests for annual awareness training materials, including social engineering content, and completion records for all personnel.
Examiners ask for incident response and BCDR test records, who took part and the plan revisions that followed.
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
Need help with the rest of NYDFS Part 500? Find a consultant for your standard (opens in a new tab).
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
Entities under any 500.19(a) threshold (fewer than 20 employees and contractors, under $7.5 million revenue, or under $15 million in assets) are exempt from sections including 500.4, 500.15 and 500.16. They still keep written policies under 500.3, a risk assessment, annual awareness training under 500.14(a)(3) and the April 15 filing.
Yes. The Second Amendment took effect on 1 November 2023, and the last transitional period ended on 1 November 2025 with multi-factor authentication under 500.12 and asset inventory under 500.13(a).
The highest-ranking executive and the CISO, or, where there is no CISO, the senior officer responsible for the cybersecurity program. The filing is either a certification of material compliance or an acknowledgment of noncompliance with a remediation timeline.
On 10 September 2026 DFS issued an industry letter on how to conduct and use the risk assessments Part 500 requires. Because 500.3 policies must be based on the risk assessment, the guidance bears on policy content too.
At least annually, by a senior officer or the senior governing body. Procedures must be developed, documented and implemented in line with the approved policies.
free for 30 days