Frameworks · Americas
23 NYCRR Part 500
23 NYCRR Part 500 is the New York Department of Financial Services Cybersecurity Regulation for the entities it licenses. The Second Amendment was finalised in November 2023, with phased deadlines through 1 November 2025. It introduced enhanced requirements for large Class A companies. It also requires notice to the Department within 72 hours of a cybersecurity event and within 24 hours of an extortion payment, and annual certification of compliance by senior leadership.
Who it applies to
It applies to banks, insurers, money transmitters, virtual currency businesses and other entities licensed by the New York Department of Financial Services. Class A companies have additional requirements.
Main requirements
Programme & governance
Entities need a cybersecurity programme and policy, a CISO who reports to the board, and annual certification.
Controls
Required controls include access privileges, multi-factor authentication, asset inventory, encryption, monitoring and vulnerability management.
Class A additions
Large companies need independent audits, privileged access management and enhanced monitoring.
Notification
Cybersecurity events are reported to the Department within 72 hours. Extortion payments are reported within 24 hours, with an explanation within 30 days.
How xmodo supports it
- 1
The regulation is set up section by section, with Class A requirements as a scope. A company that crosses the threshold adds obligations to the same programme.
- 2
The 72-hour and 24-hour reporting deadlines start on the incident record from the moment an event is classified.
- 3
xmodo generates the annual certification from the status of your controls, with the evidence behind each attestation.
Related frameworks
23 NYCRR Part 500 shares requirements with the frameworks below. Controls you already run for any of them count towards 23 NYCRR Part 500 as well.
Frequently asked questions
Are we a Class A company?
Class A status depends on revenue and headcount thresholds set in the amended regulation. Once you confirm your status with counsel, xmodo adds the Class A requirements to your scope.