Most CISOs outside banking and insurance have filed the New York Department of Financial Services’ Cybersecurity Regulation under “not my problem.” That filing error is getting expensive. With the regulation’s Second Amendment fully phased in since November 2025 and a consent-order track record that has now cleared $144 million across 27 entities, NYDFS has quietly become one of the most active cybersecurity enforcers in the country — and its reach extends well past Wall Street.
A Regulation With a Longer Arm Than Its Name Suggests
23 NYCRR Part 500 applies to any entity operating under a license, registration, or charter from NYDFS — banks, insurers, mortgage brokers, money transmitters, and a long tail of financial-adjacent businesses. Crucially, it is not limited to companies headquartered in New York. A regional insurer domiciled in Ohio, a fintech licensed as a money transmitter, or a global bank’s US insurance subsidiary can all fall squarely within scope. Security leaders at companies with any New York-regulated business line should treat Part 500 as a binding requirement, not a regional curiosity.
The Certification That Now Carries Two Signatures
The Second Amendment changed who is accountable for compliance, not just what compliance requires. Covered entities must certify material compliance by April 15 each year, and that certification — or the “Acknowledgment of Noncompliance” filed in its place — now requires the signature of both the CISO (or the senior individual responsible for the cybersecurity program) and the entity’s highest-ranking executive. That pairing is deliberate. NYDFS has made clear it wants the CISO’s technical judgment and the CEO’s organizational accountability tied to the same document, closing the gap where boards historically treated cybersecurity sign-off as a delegated, technical-only function.
For CISOs, this is a governance moment as much as a compliance one. A certification bearing your name next to the CEO’s is a different risk posture than a report filed up the chain. It argues for the same documented, defensible decision process that public-company CISOs have built around SEC materiality determinations: a structured review, cross-functional input from legal and risk, and a clear record of what was certified and why.
The Enforcement Record Is No Longer Theoretical
Superintendent Adrienne Harris’s office has moved from warning letters to real penalties, and the pace is accelerating. Recent consent orders include a $2 million penalty against PayPal for delayed incident reporting and control gaps, over $19 million spread across eight auto insurers for lapses exposing consumer data, and a $2.25 million order against Delta Dental tied to a prior breach investigation. The common thread across these actions is not exotic technical failure — it is late notification, incomplete risk assessments, and governance documentation that did not hold up under examination.
That pattern should focus board attention. NYDFS examiners are testing whether the paper trail — risk assessments, access reviews, incident response logs, board reporting records — actually matches what the regulation requires, not just whether a program exists on paper.
What This Means for the Board Agenda
Three items belong on the next board or audit committee cycle for any organization with New York-regulated operations:
-
Confirm the certification pathway. Identify who within the enterprise is designated CISO for Part 500 purposes, and ensure the April certification decision runs through the same rigor as a material-incident determination — not a late-cycle signature request.
-
Stress-test the 72-hour and 24-hour clocks. The regulation requires notification of certain cybersecurity events within 72 hours, and ransomware payments within 24 hours of payment. Boards should confirm these triggers are built into incident response runbooks, not left to interpretation mid-incident.
-
Treat “material compliance” as a governance question, not just a technical checklist. NYDFS’s own guidance — including threat-environment advisories issued through 2026 — signals that examiners expect risk assessments and governance documentation to be current, specific to the entity, and reviewed at the board level, not templated.
The Bottom Line
NIS2 and DORA have dominated the regulatory conversation this year, but NYDFS has quietly built the kind of enforcement record — dollar penalties, named entities, specific control failures — that other regimes are still working toward. For any CISO with a New York-licensed business line anywhere in the organization, Part 500 deserves the same board-level attention currently reserved for EU regulation. The certification deadline is fixed; the defensibility of what gets signed is not.