NY DFS 23 NYCRR 500

NY DFS Cybersecurity Regulation - CISO, IR plan, MFA, encryption, third-party security policy.


Short name	23 NYCRR 500
Region	Americas
Country or scope	United States
Sector	Finance
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers 23 NYCRR 500

Scan requirements: 7, all decided by a scan.
Controls: the scan requirements below, plus 15 controls from Safeguard's control catalog for 23 NYCRR 500.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for 23 NYCRR 500 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 7 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`NYDFS-500.13` Asset Inventory	Covered entities must maintain a complete, accurate, and documented inventory of their information systems as part of asset management, which for software means enumerating the components that make up each system (23 NYCRR 500.13(a), as amended 2023)	Scan
`NYDFS-500.13-TRK` Asset Tracking Detail	The asset inventory must track key information for each asset, such as owner, location, and support expiration, which at the software level requires each component record to carry at least a name and version (23 NYCRR 500.13(a) tracking requirements)	Scan
`NYDFS-500.09` Risk Assessment	Each covered entity must conduct periodic risk assessments of its information systems sufficient to inform the design of its cybersecurity program, which requires that system components be individually identifiable (23 NYCRR 500.09)	Scan
`NYDFS-500.11` Third-Party Service Provider Security Policy	Covered entities must implement written policies ensuring the security of information systems and nonpublic information accessible to or held by third-party service providers, which requires knowing the supplier behind each component in use (23 NYCRR 500.11)	Scan
`NYDFS-500.15` Encryption and Integrity Protection	Nonpublic information must be protected in transit and at rest through encryption or approved compensating controls, a protection posture that presupposes cryptographic integrity verification of the deployed software (23 NYCRR 500.15)	Scan
`NYDFS-500.16` Incident Response Readiness	Covered entities must maintain incident response and business continuity plans enabling prompt response and recovery from cybersecurity events; assessing which systems are affected requires known versions for the software in use (23 NYCRR 500.16)	Scan
`NYDFS-500.03` Documented Cybersecurity Policies	The cybersecurity program must be grounded in written, approved policies covering areas including asset inventory, systems operations, and vendor management, supported by formally identified and timestamped technical documentation (23 NYCRR 500.03)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`500.02`	Cybersecurity Program
`500.03`	Cybersecurity Policies
`500.04`	Chief Information Security Officer
`500.06`	Audit Trails
`500.07`	Access Privileges & Management
`500.08`	Application Security
`500.09`	Risk Assessment
`500.10`	Cybersecurity Personnel & Intelligence
`500.11`	Third-Party Service Provider Security
`500.12`	Multi-Factor Authentication
`500.13`	Limitations on Data Retention
`500.14`	Training & Monitoring
`500.15`	Encryption of NPI
`500.16`	Incident Response Plan
`500.17`	Notice to Superintendent

Policy templates

Written for 23 NYCRR 500:

NY DFS Cybersecurity Policy
Multi-Factor Authentication Policy
Third-Party Service Provider Security Policy

And 22 from the standard set, adapted to 23 NYCRR 500.