Assess NYDFS Part 500 alongside Reg S-P

Confirm the entity and scope

Identify DFS authorization and the legal entity under review. Document coverage, exemption subsection and qualification evidence, Class A determination and responsible reviewer. SEC registration or New York clients alone do not answer these questions.

Assess the sections

Review each topic against the source. Record a basis for each judgment, dated evidence for addressed responses, and actions for gaps. Limited exemptions can leave program, access, risk, vendor, MFA, inventory, training and reporting duties in force. Confirm exact remaining duties for the chosen exemption.

Reuse evidence thoughtfully

The crosswalk identifies related Reg S-P work and explains differences. Reuse inventories, policies and operating evidence where relevant. Incident reporting, customer notification and DFS filings have separate recipients, triggers and timing. One assessment does not approve the other.

Keep the work and connect the program

Download and reopen an editable copy without an account, or deliberately save a private copy to a free account. An enabled firm program can connect the same activities, released evidence and corrective actions to separately reviewed framework topics. No public answers upload automatically.

Source & applicability

NYDFS-500 — 23 NYCRR Part 500, second amendment and DFS exemption guidance

Source for the section-level assessment of DFS cybersecurity duties, scope, exemptions and Class A requirements. Coverage depends on the legal entity's authorization under the Banking, Insurance or Financial Services Law. Confirm scope and exemptions independently of SEC registration. Product crosswalks indicate related work, not equivalent obligations.

SEC-registered and state-registered firms may have different obligations. Have the appropriate professionals review what applies to your firm. No regulatory determination is made here.