Financial Services · Free Resource
NYS DFS 23 NYCRR 500 Compliance Checklist
The 12 governance, technical, and documentation requirements every DFS-covered NY financial firm needs before filing its annual Certification of Compliance (due April 15) — with a plain-English score guide. Save this page or print it (Ctrl/Cmd+P).
⏱ The DFS Second Amendment is past its phased deadlines — active examination is underway now.
1
Governance
Board-level cybersecurity oversight documented
Your board (or equivalent senior governing body) receives regular cybersecurity program updates and approves the cybersecurity budget — with meeting minutes to prove it in an examination.
2
Governance
CISO designated and reporting to the board annually
Internal or outsourced, the CISO function must deliver a dedicated written cybersecurity briefing to senior leadership at least once a year — not buried in an operations update.
3
Documentation
Annual Certification of Compliance backed by real evidence
Filing the April 15 certification without documentation to substantiate every control is itself a regulatory risk — examiners are trained to ask for the paper trail.
4
Technical
MFA enabled on every system containing nonpublic information
Not just VPN and external portals — the Second Amendment closes the loophole. Internal workstations, databases, and network shares touching NPI all need MFA now.
5
Technical
Encryption at rest for all NPI
Client records, transaction data, and any device that stores nonpublic information — encrypted, not just access-controlled.
6
Technical
Encryption in transit for all NPI
Email, file transfer, and any client-portal traffic carrying nonpublic information needs to be encrypted end to end.
7
Documentation
Current, documented asset inventory — reviewed within 12 months
Hardware, software, and data, kept current — not an annual snapshot. "We know what we have" isn't a compliant answer if you can't produce the document on request.
8
Technical
Formal vulnerability management program, with documented remediation
Regular scanning is only half the requirement — prioritized remediation timelines and evidence that high/critical findings were actually closed are equally required.
9
Technical
Third-party penetration test within the past 12 months
Conducted by a qualified outside party, not an internal self-assessment.
10
Administrative
Incident response plan tested within the past 12 months
Test results documented and reviewed by senior leadership — an untested plan is a hope, not a plan.
11
Administrative
Third-party vendors with NPI access reviewed for cybersecurity adequacy
Every service provider that touches nonpublic information — including your IT provider — needs a documented cybersecurity review, not an assumption of adequacy.
12
Administrative
Staff cybersecurity training completed and documented
Every person with NPI access, every year, with a record of who completed it.
Score Yourself
10–12 checked Strong postureMinor documentation gaps — worth a second look before filing.
6–9 checked Moderate exposureReal gaps — close these before your next Certification of Compliance.
0–5 checked High riskAct now — this is the profile of a firm a DFS examination would go badly for.
This page is yours to keep — bookmark it, print it, or share it with your compliance officer.
Free Consultation
Want Wlad to Score This For You?
Book a free 30-minute DFS Compliance Review. Wlad will walk your actual environment against this exact checklist and give you a written report within 24 hours — at no charge.
Schedule My Free Compliance Review →Questions first? Send us a message or call (516) 734-1515