Third-Party Vendor Management Under NY DFS

Your organization's security is only as strong as your weakest vendor. Section 500.11 of NY DFS 23 NYCRR 500 requires covered entities to implement written policies and procedures for the security of information systems and nonpublic information accessible to or held by third-party service providers.

What Does Section 500.11 Require?

Your third-party service provider security policy must include:

• Risk-based identification and assessment of third-party service providers
• Minimum cybersecurity practices required of third-party service providers
• Due diligence processes for evaluating third-party providers
• Periodic assessment of providers based on the risk they present and the continued adequacy of their cybersecurity practices

The policies must also include guidelines for due diligence or contract terms covering, as applicable: the provider's access controls, including MFA; its use of encryption for nonpublic information in transit and at rest; notice to you of cybersecurity events that directly affect your systems or your nonpublic information it holds; and representations and warranties about its cybersecurity (500.11(b)).

Who Is a Third-Party Service Provider?

Under 500.1(s), a third-party service provider is a person that:

• Is not your affiliate and is not a governmental entity
• Provides services to you
• Maintains, processes or is otherwise permitted access to your nonpublic information through those services

Building Your Vendor Management Program

Step 1: Inventory Your Vendors

Create a comprehensive list of all third-party providers that access your systems or data. For each vendor, document:

• What services they provide
• What data they access or store
• How they connect to your systems
• Contract end date and renewal terms

Step 2: Categorize by Risk

Not all vendors pose the same risk. Categorize them based on:

Step 3: Conduct Due Diligence

Before engaging a new vendor (and periodically for existing vendors), assess their security practices:

• Security questionnaire: Request completion of a standardized security questionnaire
• Certifications: Review SOC 2 reports, ISO 27001 certification, or other attestations
• Policies: Request copies of relevant security policies
• Insurance: Verify cyber liability insurance coverage

Step 4: Contractual Requirements

Ensure vendor contracts include appropriate security provisions:

• Data protection and confidentiality requirements
• Prompt notice to you of cybersecurity events that directly affect your systems or your nonpublic information
• Right to audit security practices
• Data return/destruction upon termination
• Use of encryption and MFA, and representations and warranties about the vendor's cybersecurity

Step 5: Ongoing Monitoring

Vendor management isn't a one-time activity. Implement ongoing monitoring:

• Annual reassessment of high-risk vendors
• Review of SOC 2 reports when issued
• Monitoring for security incidents or breaches at vendors
• Periodic review of vendor access and permissions