NYDFS’s final Part 500 deadline put the asset inventory underneath every other control

The week

November 1, 2025 was the last phased compliance date in the Second Amendment to the New York Department of Financial Services cybersecurity regulation, 23 NYCRR Part 500, finalized in November 2023. Two requirements took effect.

First, covered entities had to use multi-factor authentication for any individual accessing any of their information systems, not only remote or privileged access. Second, they needed written policies and procedures for a complete, accurate and documented inventory of information systems, tracking attributes such as owner, location, classification, support expiration date and recovery time objective. Part 500 applies to entities licensed or chartered by DFS, such as state-chartered banks, insurers and money transmitters. Nationally chartered banks are outside it.

The last week of October 2025 was busy for DFS-regulated firms closing out MFA projects. That was the visible deadline. The inventory requirement mattered more, because nearly every other obligation in Part 500 assumes the firm knows what it has. The final phase breaks into three parts: universal MFA, the inventory, and the annual certification that ties both to named executives. They are best built in reverse order of attention, inventory first.

Universal MFA: the exceptions were the work

By late 2025 most covered entities already used MFA for email, remote access and privileged accounts. The remaining work was the long tail. It included internal applications with their own logins, legacy systems that cannot accept modern authentication, shared workstations in branches and call centers, and third-party portals staff use daily.

The regulation lets the CISO approve, in writing, reasonably equivalent or more secure compensating controls where MFA is not feasible. Those approvals must be reviewed at least annually. Examiners will look hardest at this exception process. A firm with a short, documented list, each entry carrying a compensating control and a retirement date, stands in a very different position from one with an informal understanding that some systems are hard.

The deeper design question is whether MFA is enforced centrally or application by application. Firms that pushed authentication through a single identity provider found the deadline far easier than those retrofitting MFA into each application. That choice also governs how fast a firm can react when an MFA method proves weak. SMS codes and push approvals vulnerable to fatigue attacks can be replaced once, centrally, instead of in dozens of places.

Shared and non-human access is the trickiest corner. Branch kiosks, call center workstations used across shifts, and service accounts that log in to other systems all strain a rule written for individuals. Each needs an explicit treatment: badge-based or proximity authentication for shared stations, and vaulted, rotated credentials for service accounts, with a documented rationale.

The asset inventory: the control under the controls

Part 500’s other requirements quietly depend on an inventory. Risk assessments need to know what systems exist. Vulnerability management needs a list of assets to scan. Access reviews need a list of systems with users. Business continuity planning needs recovery objectives per system. End-of-life planning needs support dates. Without a single inventory, each program keeps its own partial list, and the lists disagree.

The amended rule asks for policies and procedures that keep the inventory complete and current, with specific attributes for each asset. The difficult attributes are not technical. Owner and classification require business decisions. Recovery time objective requires IT and the business to agree on what matters. Support expiration date requires vendor information many firms never recorded, especially for appliances and embedded software.

Firms that made progress ran the inventory as a product with an owner, not a spreadsheet refreshed for an audit. They fed it from automated discovery, such as endpoint management, cloud provider APIs, identity provider application lists and network scanning. They reconciled that against the configuration management database. Differences between discovered and recorded assets became a weekly work queue, not an annual surprise.

Software-as-a-service and vendor-run systems are where inventories most often fall short. A firm may not run the infrastructure, but the information system still holds its data and still counts. Expense reports and single sign-on logs are practical ways to find SaaS applications that never went through procurement. Vendor contracts should require the attributes the inventory needs, such as hosting location and support dates.

Certification: named people, annual exposure

The Second Amendment also changed the annual filing due by April 15. Covered entities must either certify material compliance, or acknowledge non-compliance, identify the gaps and give a remediation timeline. The filing must be signed by the highest-ranking executive and the CISO, or the senior officer responsible for cybersecurity where there is no CISO.

That made the November 2025 requirements personal. A CEO and CISO certifying in April 2026 were vouching for universal MFA and a maintained inventory from the date those requirements applied. DFS has penalized inaccurate certifications in past enforcement actions. The honest alternative, acknowledging specific gaps with a plan, is explicitly allowed. Where gaps exist it is usually the safer choice, and firms should take counsel’s view on how to document it.

The amended rule also expects the senior governing body to have enough understanding of cybersecurity to oversee it, and the CISO to report to that body at least annually. Those reports are the natural place to show inventory coverage, MFA exceptions by age and remediation progress. A board that has seen the same three figures through the year is in a far better position to support an April certification than one seeing them for the first time.

The three parts connect through evidence. The inventory tells the firm where MFA must apply. The MFA exception list is a subset of the inventory with added risk attributes. The certification rests on evidence from both, so signers should see inventory coverage and exception counts before they sign. A firm that built the inventory first found the other two easier to prove.

With hindsight

DFS followed the deadline with guidance rather than leniency. In December 2025 it published frequently asked questions on the expanded MFA requirement, and it revised them in early 2026. Firms with ambiguous cases, such as shared devices and service accounts, gained clearer answers, though some of them had to revisit exceptions they had already approved.

The April 15, 2026 certification was the first filed after every amended requirement was in force. MFA was always going to be the easier half to evidence, because it is largely binary and testable. Inventory completeness is harder to prove, particularly for SaaS applications and systems run by third parties, and it remains the more likely weak point. An inventory designed as an operational system also serves vulnerability management, resilience planning and vendor oversight. One built only for the filing has to be rebuilt each year.