NYDFS Final Cybersecurity Rules – MFA, Asset Inventory, And Third-Party Risk

Go-To Guide:

• The last remaining provisions of the amendments to the New York Department of Financial Services' (DFS) cybersecurity regulation called Part 500 came into effect Nov. 1, 2025.
• DFS adopted these regulations two years ago but allowed regulated entities additional time to comply with these final provisions, recognizing the cost and burden involved.
• The final provisions require multi-factor authentication in some circumstances and require regulated entities to implement policies and procedures to maintain an inventory of the assets they protect.
• DFS issued guidance on the considerations it expects covered entities to include as part of assessing and addressing the risks from third parties, including vendors, cloud-based systems, FinTech platforms, and AI agents.