thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Advanced

NYDFS Cybersecurity Regulation

New York Department of Financial Services rule (23 NYCRR Part 500) requiring covered financial entities to maintain cybersecurity programs.

Definition

Part 500 requires a CISO, risk assessments, policies, MFA, encryption, asset inventories, incident response and business continuity plans, 72-hour incident notification, 24-hour notice of extortion payments, and an annual compliance certification or acknowledgment of noncompliance by 15 April. The 2023 amendment added Class A company requirements and phased in obligations through November 2025.

Example

A New York insurance company files its annual certification of compliance with NYDFS by 15 April.

Exam tip

Annual certification is due 15 April; extortion payments must be reported within 24 hours.

Related terms