NYDFS Issues Guidance On Risk Assessments

On September 10, 2026, the New York State Department of Financial Services (“DFS”) issued an industry letter providing guidance on how to conduct and use the risk assessments mandated by the cybersecurity requirements under 23 NYCRR Part 500 (the “Cybersecurity Regulations”). The letter examines five topics: governance and oversight; methodology for identifying cybersecurity-related risks; scope of assessments; documentation; and integration to ensure risk assessments are impacting future policies, procedures, and controls. This letter sets the standard that examiners will use in future DFS inquiries and likely signals that risk assessments and audits will face rigorous examinations going forward. It is also the seventh cybersecurity-related industry letter DFS has issued since January 2026, signaling continuing risks and clarifications are needed to address cybersecurity concerns.