NYDFS Updates Regulated Firms On Upcoming Cyber Requirements

Financial firms doing business in New York should be mindful of a recent e-blast sent by the state's financial regulator concerning cybersecurity requirements that become effective in less than two months. The New York Department of Financial Services (DFS), in a “Cybersecurity Regulation Updates and Reminders” e-blast on Feb. 27, 2025, discusses annual compliance requirements under DFS' cybersecurity regulation, 23 NYCRR Part 500 (Part 500), and alerts covered entities to new requirements under Part 500 taking effect on May 1, 2025, including requirements relating to access management, vulnerability management and protections against malicious code.

The e-blast reminds recipients that entities covered under Part 500 (generally, banks, insurance companies and other financial firms, collectively “covered entities”) must submit annual compliance notifications to DFS. The e-blast states, “Covered entities now have the option to submit either a Certification of