NY DFS Compliance Checklist

Appoint a qualified Chief Information Security Officer responsible for overseeing the cybersecurity program.

CISO reports in writing at least annually to the senior governing body on the cybersecurity program, including material risks and plans for remediating material inadequacies.

Implement and maintain written cybersecurity policies covering the 15 areas in 500.3, to the extent they apply to your operations.

Policies approved at least annually by a senior officer or the senior governing body.

Written incident response plan addressing required elements, including recovery from backups and root cause analysis.

Limit user and privileged access to what each job needs, review all access at least annually, and promptly terminate access after departures.

MFA for any individual accessing any information system (required since 1 Nov 2025). Limited-exemption entities: remote access to your systems, remote access to third-party applications holding nonpublic information, and privileged accounts.

Perform periodic risk assessments covering cybersecurity risks.

Penetration testing from inside and outside your system boundaries by a qualified party, at least annually.

Run automated vulnerability scans, and manually review systems they miss, at the frequency your risk assessment sets.

A monitoring process that promptly informs you of new vulnerabilities, and timely remediation prioritized by risk.

Maintain audit trails to detect and respond to cybersecurity events.

Risk-based controls to monitor authorized users and detect unauthorized access to nonpublic information.

Written policy requiring industry-standard encryption of nonpublic information in transit over external networks.

Encrypt nonpublic information at rest, or use CISO-approved compensating controls reviewed at least annually if infeasible.

Documented inventory of information systems tracking owner, location, classification, support expiration date and recovery time objective (required since 1 Nov 2025).

At least annual cybersecurity awareness training for all personnel, including social engineering.

Written policies for third-party service provider security.

Assess third-party cybersecurity practices.

Documented plan for responding to cybersecurity events, including ransomware.

Notify DFS within 72 hours after determining that a cybersecurity incident occurred at your company, an affiliate or a third-party service provider, and keep DFS updated.

Notify DFS within 24 hours of any extortion payment and send a written explanation within 30 days.

By April 15 each year, file a certification of material compliance or an acknowledgment of noncompliance for the prior year, signed by your highest-ranking executive and your CISO.