NYDFS Cybersecurity 2025 — 72-Hour Rule & Class A/B Controls

NYDFS Cybersecurity (2025): Minimum Controls & Class Sizes

New York’s 23 NYCRR Part 500 (as amended in late 2023) is fully in effect through 2025 for covered financial services entities. At a minimum, firms must implement a risk-based cybersecurity program, MFA for sensitive access, vendor oversight, and incident reporting within 72 hours for qualifying events—plus 24-hour notice if a ransomware payment is made, followed by a 30-day explanation. These requirements sit alongside size-based tiers (Class A/Class B) that calibrate controls and audits. :contentReference[oaicite:0]{index=0}

Key dates: the annual compliance certification to DFS is due by April 15 each year for the prior calendar year. :contentReference[oaicite:1]{index=1}

Who’s covered

“Covered entities” include organizations licensed, registered, or chartered by the New York Department of Financial Services—banks, trust companies, money transmitters, mortgage lenders/servicers, virtual-currency businesses, insurers and producers, and certain consumer finance firms. Limited exemptions exist for small entities, but exempt firms still have notice/certification duties. :contentReference[oaicite:2]{index=2}

Program & risk

NYDFS requires a documented, risk-based cybersecurity program with board/senior-officer oversight. Core controls include: periodic risk assessments; written policies (access, data governance, systems security, third-party risk); a designated CISO with authority; continuous monitoring/vulnerability management; incident response and business continuity; independent testing; and annual attestation/certification. :contentReference[oaicite:3]{index=3}

MFA & access

MFA is mandatory for remote access and other risk-based scenarios; larger firms must extend MFA to privileged and third-party access and pair it with EDR, PAM, and enhanced monitoring. Least-privilege, timely access reviews, and password/secret management are recurring exam focuses. :contentReference[oaicite:4]{index=4}

Incident reporting

• 72 hours: notify DFS after determining that a reportable cybersecurity event occurred (including events at affiliates or material third parties). :contentReference[oaicite:5]{index=5}
• 24 hours: notify DFS if you make a ransomware/extortion payment; submit a written description within 30 days detailing why payment was necessary and what alternatives were considered. :contentReference[oaicite:6]{index=6}
• File electronically via the DFS portal; maintain root-cause, mitigation, and notification documentation. :contentReference[oaicite:7]{index=7}

Class A/B sizing

The 2023 amendments introduced size-based tiers. Class A companies face additional obligations (e.g., independent audits, EDR, external vulnerability scanning, PAM), while other covered firms (Class B here as shorthand) follow the core baseline.

Tier	Who qualifies (summary)	Notable extra obligations
Class A	Covered entity with ≥ $20M NY-sourced gross revenue and either (i) >2,000 employees (incl. affiliates) or (ii) ≥ $1B global gross revenue (each over last two FYs). :contentReference[oaicite:8]{index=8}	Independent audits; endpoint detection & response (EDR); privileged access management (PAM); external vuln scanning; heightened testing/reporting. :contentReference[oaicite:9]{index=9}
Class B (other covered entities)	All other DFS-regulated entities below Class A thresholds. :contentReference[oaicite:10]{index=10}	Baseline Part 500 controls: risk-based program, MFA, IR/BCP, awareness training, vendor risk management, annual certification. :contentReference[oaicite:11]{index=11}

Audit evidence

DFS examiners routinely request board/CISO reports, risk assessments, policy approvals, access logs, change control records, incident drills, penetration-test results, and third-party due-diligence files. Maintain an audit trail that ties controls back to risk assessment findings and Part 500 sections. :contentReference[oaicite:12]{index=12}

AI guidance & PIA alignment (what changed for 2025)

DFS issued AI-related cybersecurity guidance (Oct. 16, 2024) stressing AI-enabled social-engineering and attack risks, recommending governance, training, access control, vendor scrutiny, and data-management measures—under existing Part 500 obligations. Consider documenting AI risks inside your risk assessment and running a Privacy Impact Assessment (PIA) for systems processing nonpublic information. :contentReference[oaicite:13]{index=13}

For PIA technique and templates, see U.S. federal references (helpful even for New York-regulated entities): CFPB/HHS/GSA guidance on when and how to run PIAs and publish results. :contentReference[oaicite:14]{index=14}

FAQs

Are deadlines staggered?

Yes. The 2023 amendment set phased effective dates by control type. Annual compliance certification continues each year (due April 15), while enhanced controls (e.g., EDR/PAM for Class A) rolled in on later milestones during 2024–2025. Check DFS bulletins for your control-specific deadlines. (Source: Department of Financial Services)

PIA?

A Privacy Impact Assessment helps identify and mitigate privacy risks in systems handling nonpublic information. While Part 500 doesn’t mandate “PIAs” by name, DFS expects risk-based governance; using a PIA framework supports risk assessments and vendor oversight. (Sources: CFPB, HHS)

AI guidance?

DFS issued advisory guidance on October 16, 2024 addressing AI-related cyber risks (deepfakes, supply-chain, access control). It reinforces existing Part 500 duties rather than creating new rules. (Sources: DFS, Reuters)

Third-party risk?

Yes. Covered entities must assess and monitor material vendors, include contractual security clauses, and escalate/report third-party incidents that affect customers or operations. (Source: Department of Financial Services)

References

• NYDFS — Cybersecurity Resource Center :contentReference[oaicite:15]{index=15}
• 23 NYCRR Part 500 — Second Amendment (final text) :contentReference[oaicite:16]{index=16}
• Reuters — DFS AI Cybersecurity Guidance (Oct. 2024) :contentReference[oaicite:17]{index=17}
• DFS Press Release — Amendments Announced (Nov. 1, 2023) :contentReference[oaicite:18]{index=18}
• DFS Press Release — AI Cybersecurity Guidance (Oct. 16, 2024) :contentReference[oaicite:19]{index=19}
• DFS — Certification of Compliance (due April 15) :contentReference[oaicite:20]{index=20}
• ACA Group — 24-hour ransomware payment notice :contentReference[oaicite:21]{index=21}
• Katten — Annual compliance submission (Apr. 15, 2025) :contentReference[oaicite:22]{index=22}
• CFPB — Privacy Impact Assessments (PIA) overview :contentReference[oaicite:23]{index=23}
• HHS — PIAs & resources :contentReference[oaicite:24]{index=24}

Key Takeaways

• 72-hour cyber-event notice, plus 24-hour ransomware-payment notice and 30-day rationale filing. :contentReference[oaicite:25]{index=25}
• MFA, vendor risk governance, and incident response are table stakes; documentation matters. :contentReference[oaicite:26]{index=26}
• Class A (large firms) owe extra controls: independent audits, EDR, PAM, external scanning. :contentReference[oaicite:27]{index=27}
• Annual certification due April 15; keep audit evidence exam-ready. :contentReference[oaicite:28]{index=28}
• DFS AI guidance (Oct. 2024) expects AI risk to be integrated into your Part 500 program; consider PIAs to evidence privacy risk work. :contentReference[oaicite:29]{index=29}

← Back to Main Guide