[c0-author: Amy Gopinathan]
On November 1, 2023, New York Department of Financial Services (NYDFS or the “Department”) released the finalized revisions (the “Second Amendment”) to 23 NYCRR Part 500 (Part 500) – the most significant modifications to Part 500 since it was first enacted in 2017 and established cybersecurity requirements for NYDFS-regulated entities.1 The revisions, the Department explains in the introduction to its Cybersecurity Resource Center, are aimed at addressing the changes in the increasing sophistication of threat actors, the prevalence of and relative ease in executing cyberattacks, and the availability of additional controls to manage cyber risk (at a reasonable cost). These changes mark the culmination of an approximately yearlong effort, which first began in July 2022, when the Department published a “pre-proposed” draft amendment, which was revised first on November 9, 2022, and again on June 28, 2023, before being finalized on November 1, 2023. Throughout this process, the NYDFS solicited, considered, and responded to public comments.
The finalized version of Part 500 includes some notable changes (described in more detail below)…
