NYDFS Clarifies Expectations For Third-party Cybersecurity Risk Management

On October 21, 2025, the New York State Department of Financial Services (NYDFS) issued an industry letter highlighting risks associated with third-party service providers – such as providers of cloud computing, file transfer systems, artificial intelligence (AI), and FinTech solutions – and strategies for managing these risks as part of an effective cybersecurity program under its cybersecurity regulation, 23 NYCRR Part 500 (Part 500).

The letter reflects NYDFS's continued focus on third-party risk as a leading source of cybersecurity exposure. The letter is not a formal rule or amendment under Part 500, and the letter even expressly states that it does not impose new requirements or obligations on covered entities. However, this prescriptive guidance signals supervisory priorities and establishes practical benchmarks for the cybersecurity protections NYDFS examiners may expect to see with respect to covered entities' third-party risk management programs. Covered