NY DFS Compliance Checklist
Interactive checklist to track your progress toward NY DFS 23 NYCRR 500 compliance. Check off items as you complete them.
Designate a CISO
500.04Limited ExemptAppoint a qualified Chief Information Security Officer responsible for overseeing the cybersecurity program.
Board Reporting
500.04Limited ExemptCISO reports to the board at least annually on the cybersecurity program.
Senior Governing Body Oversight
500.04Limited ExemptSenior governing body has sufficient understanding of cybersecurity matters.
Written Cybersecurity Policy
500.03Implement and maintain a written cybersecurity policy covering all 14 required areas.
Policy Approval
500.03Policies approved by senior officer or governing body.
Incident Response Plan
500.16Written incident response plan addressing required elements.
Business Continuity & Disaster Recovery
500.16Plans for recovery from cybersecurity events.
Access Privilege Management
500.07Limit user access privileges and periodically review access rights.
Multi-Factor Authentication
500.12Implement MFA for remote access and privileged accounts.
Password Policy
500.07Enforce strong password requirements or equivalent controls.
Conduct Risk Assessment
500.09Perform periodic risk assessments covering cybersecurity risks.
Update Risk Assessment
500.09Review and update risk assessment annually or when material changes occur.
Annual Penetration Testing
500.05Limited ExemptConduct annual penetration testing from a qualified party.
Vulnerability Assessments
500.05Limited ExemptPerform bi-annual vulnerability assessments.
Continuous Monitoring
500.05Limited ExemptImplement continuous monitoring or periodic penetration testing.
Audit Trail
500.06Maintain audit trails to detect and respond to cybersecurity events.
Encryption in Transit
500.15Encrypt nonpublic information in transit over external networks.
Encryption at Rest
500.15Encrypt nonpublic information at rest.
Data Retention Policy
500.13Implement secure disposal of nonpublic information.
Security Awareness Training
500.14Provide regular cybersecurity awareness training for all personnel.
Training Updates
500.14Update training to address current threats and risks.
Third-Party Security Policy
500.11Written policies for third-party service provider security.
Vendor Due Diligence
500.11Assess third-party cybersecurity practices.
Vendor Contractual Requirements
500.11Include cybersecurity requirements in vendor contracts.
Incident Response Plan
500.16Documented plan for responding to cybersecurity events.
72-Hour Notification
500.17Notify DFS within 72 hours of qualifying cybersecurity events.
Test Response Plan
500.16Periodically test and update the incident response plan.
File Annual Certification
500.17Submit certification of compliance by April 15th each year.
Maintain Certification Records
500.17Keep documentation supporting certification for 5 years.
Need Help With Your Compliance Program?
Buffalo Sentinel automates evidence collection, tracks your compliance status, and generates audit-ready reports.