Part 500 evidence your CEO and CISO can sign on April 15

DFS states that the rule applies regardless of whether the entity is also regulated by other agencies. For a group that holds its New York licence through a US subsidiary, the cybersecurity program has to cover the systems that subsidiary shares with its parent.

The 500.19 limited exemption

Entities with fewer than 20 employees and independent contractors (counting affiliates), or below the revenue or asset thresholds in 500.19(a), are exempt from sections 500.4, 500.5, 500.6, 500.8, 500.10, parts of 500.14, 500.15 and 500.16. The risk assessment, policies, a narrower MFA scope, notices and the annual filing still apply, and a Notice of Exemption is filed with DFS within 30 days of determining eligibility.

The obligations we test first:

• Risk assessment (500.9): written, reviewed at least annually and after material change.
• CISO (500.4): reports in writing to the senior governing body at least annually.
• Vulnerability management (500.5): penetration testing from inside and outside at least annually by a qualified party, plus automated scans at a risk-based frequency.
• Access (500.7): least privilege and an annual review of every account.
• MFA (500.12): for any individual accessing any information system.
• Asset inventory (500.13): owner, location, classification, support end date and recovery time objective for each asset.
• Training (500.14): annual, including social engineering.
• Encryption (500.15): in transit over external networks and at rest.

Penetration testing is part of the minimum and is performed by a separate qualified party; we offer it on request.

The certification must rest on data and documentation sufficient to show material compliance (500.17(b)(1)), and the supporting records are kept for five years for DFS examination.

Choosing between the two filings

Where part of the rule was unmet last year, the acknowledgment is the accurate filing: which sections, what was missing and when it will be fixed. We help you make that call on evidence, section by section, and either attach the proof or record the gap with a plan.

What goes into the evidence file

MFA configuration exports, the asset inventory, the CISO's report to the board, tabletop minutes for the incident plan, backup restore test records, training records, scan and penetration test reports, and third-party assessments.

Section 500.16 requires written incident response and business continuity and disaster recovery (BCDR) plans covering roles, decision authority, internal and external communications, recovery from backups and root cause analysis. At least annually the entity tests these plans with critical staff and tests its ability to restore critical data from backups.

The 72-hour clock also runs when the incident happens at a vendor, so vendor contracts need fast notice clauses. When the same incident also touches EU or Canadian customer data, the notices stack; we map that on our incident response page.

DFS expects a risk assessment before selection, contract terms on security controls including encryption, risk-based periodic assessments and removal of access at offboarding. In a group where cloud services, KYC vendors and support are shared across jurisdictions, we build one vendor register and flag which vendors touch the New York licence.

The same vendors usually appear in your banking partners' questionnaires; see our security questionnaire service.