Requirements ยท Financial services
NYDFS 23 NYCRR Part 500
New York Department of Financial Services Cybersecurity Regulation. 15 Moraph products list it under “Requirements it supports”. The products support this requirement; meeting it remains your organization’s responsibility.
About the rule
What it is
23 NYCRR Part 500 is the Cybersecurity Regulation of the New York State Department of Financial Services (NYDFS), first effective in 2017 and amended in November 2023. It applies to banks, insurers and other organizations licensed, registered or chartered by the Department, and requires a risk-based cybersecurity program, a chief information security officer, multi-factor authentication and other controls. Covered entities must notify the Department of certain cybersecurity incidents within 72 hours and file an annual notice of compliance with it.
Source: NYDFS Cybersecurity Resource Center. This summary is for orientation only; read the rule itself or ask your counsel for what it requires of you.
Citations
How the products cite it
The exact wording on the product pages, with how many products use each.
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500) 6 products
- NYDFS Cybersecurity Requirements for Financial Services Companies (23 NYCRR Part 500) 2 products
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500), Section 500.16 1 product
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500), including Section 500.12 on multi-factor authentication 1 product
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500), including Section 500.15 on encryption 1 product
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500), including Section 500.7 on access privileges 1 product
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500), including cybersecurity awareness training 1 product
- NYDFS Cybersecurity Regulation 23 NYCRR 500.11 (third-party service provider security policy) 1 product
- NYDFS Cybersecurity Requirements for Financial Services Companies (23 NYCRR 500.5, vulnerability management) 1 product
For what it requires of your organization, read the rule itself or ask your counsel.
Products
The 15 products that support it
API Security & Integration
Securing the connectivity between legacy mainframes (COBOL) and modern fintech apps.
Lists:
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
Business Continuity Planning
Managing disaster recovery plans and automated testing logs for examiners.
Lists:
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500), Section 500.16
CRM for Finance
Managed Salesforce Shield encryption with key material held by Moraph outside Salesforce, so Salesforce does not store your decryption keys. Field permissions remain your decision.
Lists:
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500), including Section 500.15 on encryption
Data Loss Prevention
Network and endpoint blocking of outbound transmission of SSNs or credit card numbers (PAN).
Lists:
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
Database Security
Real-time monitoring of SQL queries to detect mass data exfiltration events.
Lists:
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
Endpoint Detection & Response
24/7 managed detection and hunting on teller workstations to reduce ransomware risk. Recovery, backups and notification decisions remain your institution's.
Lists:
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
Identity Access Management
MFA and SSO configurations tuned to support the FFIEC Authentication and Access guidance (2021). Your institution owns the risk assessment and the adequacy decision.
Lists:
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500), including Section 500.12 on multi-factor authentication
Mobile Device Management
"Containerized" corporate apps on advisor personal phones, allowing selective wipe of business data.
Lists:
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
Privileged Access Management
Vaulting and rotating passwords for core banking admin accounts.
Lists:
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500), including Section 500.7 on access privileges
Public Cloud Infrastructure
Managing the tenant with "Policy as Code" guardrails designed to block public S3 buckets holding consumer data. Guardrails reduce, not remove, misconfiguration risk; data decisions remain yours.
Lists:
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
Secure File Transfer
Encrypted "drop box" for clients to upload tax returns without using insecure email.
Lists:
- NYDFS Cybersecurity Requirements for Financial Services Companies (23 NYCRR Part 500)
Security Awareness Training
Phishing simulations tailored to financial fraud (e.g., "Wire Transfer Request"), producing training evidence for examiners and cyber insurers. Premium decisions remain the insurer's.
Lists:
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500), including cybersecurity awareness training
Third-Party Risk Scoring
Continuous credit-rating-style monitoring of vendor security postures.
Lists:
- NYDFS Cybersecurity Regulation 23 NYCRR 500.11 (third-party service provider security policy)
Virtual Desktop Infrastructure
Secure remote workspaces designed to keep PII off loan officers' local laptops, under file, clipboard and print policies you approve. Access decisions remain yours.
Lists:
- NYDFS Cybersecurity Requirements for Financial Services Companies (23 NYCRR Part 500)
Vulnerability Management
Authenticated scanning of the banking network on your schedule (e.g., weekly), supporting the GLBA Safeguards Rule's vulnerability-assessment requirement (16 CFR 314.4(d)(2)). Risk assessment and remediation remain the institution's.
Lists:
- NYDFS Cybersecurity Requirements for Financial Services Companies (23 NYCRR 500.5, vulnerability management)
Not sure which requirements apply to you? Request a gap analysis. All requirements: Requirements our products support.