What Is 23 NYCRR 500?
23 NYCRR 500 refers to Title 23 of the New York Codes, Rules and Regulations, Part 500, officially known as the New York Department of Financial Services (NYDFS) Cybersecurity Regulation.
23 NYCRR 500 was established to enforce comprehensive cybersecurity requirements for financial services companies operating in New York. This regulation applies to banks, insurance companies and other financial institutions regulated by NYDFS and aims to strengthen cybersecurity resilience in the financial sector.
Key components of 23 NYCRR 500 include:
- Mandating cybersecurity programs to protect data.
- Requiring appointment of a Chief Information Security Officer (CISO).
- Establishing risk assessments, policies, incident response and third-party management.
- Requiring annual certification of compliance to NYDFS.