The New York Department of Financial Services (NYDFS) amended its cybersecurity regulation, 23 NYCRR Part 500, in November 2023 and phased the new requirements in over two years. The final phase took effect on November 1, 2025. For banks, insurers, agencies, and other DFS-licensed entities, the two biggest items are multi-factor authentication (MFA) for everyone and a documented asset inventory.
MFA for any user, any system (500.12)
Covered entities must now require MFA for any individual accessing any information system. That includes employees, contractors, and third parties, and it is no longer limited to remote access or systems that hold nonpublic information. If MFA is not feasible for a particular system, the CISO may approve reasonably equivalent or more secure compensating controls in writing, and those approvals must be reviewed at least annually.
Smaller entities that qualify for the limited exemption still need MFA for remote access to their systems, remote access to third-party applications that hold nonpublic information, and all privileged accounts other than service accounts.
Asset inventory (500.13)
Covered entities must maintain written policies and procedures for a complete, documented inventory of information systems. For each asset the inventory must track:
- Owner
- Location
- Classification or sensitivity
- Support expiration date
- Recovery time objectives
The policy must also state how often the inventory is updated and validated. A spreadsheet that IT touches once a year will not meet this standard.
The annual filing
By April 15 each year, covered entities must submit either a certification of material compliance or an acknowledgment of noncompliance that identifies the gaps and a remediation timeline. The certification for calendar year 2025 is due April 15, 2026, and it will be the first one that covers every amended requirement. It must be signed by the highest-ranking executive and the CISO.
What regulators are focusing on
NYDFS enforcement actions have repeatedly cited weak access controls, missing MFA, and incomplete asset inventories. With the transition period over, expect examiners to ask for evidence: MFA coverage reports, CISO approvals for any exceptions, and an inventory that matches what is actually on the network.
Checklist before your next certification
- Confirm MFA coverage across every system and user type, including vendors and service providers.
- Document and date any CISO-approved compensating controls.
- Build or clean up your asset inventory so it includes all five required data points.
- Update your risk assessment, policies, and incident response plan to reflect the amended regulation.
- Collect evidence throughout the year so the April filing is not a scramble.
How Eagle can help
Eagle supports financial services organizations with NYDFS Part 500 gap assessments, risk assessments, policy development, and audit evidence collection ahead of the annual certification. Contact us to see where you stand.
Sources: Hogan Lovells; Greenberg Traurig. This article is general information, not legal advice.
