Topic · ny-dfs-500

NY DFS Part 500

New York DFS Part 500 — the NY Department of Financial Services cybersecurity rule.

RSS feed ↗

trade-press
NYDFS ties AI risk to cyber assessment obligation
The guidance doesn't impose new rules, but it tells examiners exactly where to look, and NYDFS has already found the gaps it's flagging.
NYDFS issued Sept. 10 guidance clarifying that annual cyber risk assessments under its 2017/2023 cybersecurity regulation must consider whether AI adoption, quantum computing advances, supply-chain attacks, ransomware evolution, and geopolitical conflict materially alter a firm's risk profile. The guidance does not create new obligations but identifies common gaps NYDFS has already observed during examinations, including failure to account for emerging technologies and concentration risk from third-party dependencies. Covered entities range from banks and insurers to their service providers.
SEP 14
trade-press
NY DFS issues frontier AI cyber advisory ahead of federal frameworks
NY DFS Part 500 entities face accelerated vulnerability management timelines now, not after federal rulemaking catches up.
New York DFS published a May 21 advisory urging Part 500-regulated financial entities to strengthen cybersecurity posture against frontier AI-enabled threat actors. The advisory imposes no new legal requirements but signals regulatory expectations: expedited vulnerability identification and remediation, dependency mapping for third-party service providers, and heightened monitoring. NY DFS explicitly says regulated entities should reassess whether current vulnerability management timelines are fast enough given AI-accelerated exploitation. Federal agencies have not yet issued comparable guidance on frontier AI risks.
MAY 26

NY DFS Part 500

NYDFS ties AI risk to cyber assessment obligation

NY DFS issues frontier AI cyber advisory ahead of federal frameworks