The New York Department of Financial Services published its guidance on cybersecurity risk assessments on September 10, 2026, as an industry letter to every regulated entity. It says plainly that it “does not create new obligations.” What it does is put in writing what DFS examiners look for when they read a firm’s risk assessment, and where they have found assessments too thin to support the cybersecurity program built on them.
For a compliance lead or a CISO at a licensed fintech, the useful reading is a split: which lines restate a rule in Part 500, the DFS cybersecurity regulation, and which are DFS’s “should” list. The first group can be cited in an examination finding. The second is how DFS will judge whether the first group was done well.
Who the letter reaches
The letter is addressed to all DFS-regulated entities, which Part 500 calls covered entities: anyone operating under a license, registration or charter under the Banking Law, the Insurance Law or the Financial Services Law. That includes money transmitters and the virtual currency firms in our BitLicense and trust charter register.
Size does not remove the duty. Part 500’s limited exemption for firms with fewer than 20 employees and contractors, under $7.5 million in annual revenue in each of the last three years, or under $15 million in year-end assets switches off a list of sections that includes 500.4 (CISO reporting and board oversight). Section 500.9, the risk assessment, is not on that list, and neither is 500.13, the asset inventory (DFS text of the 2023 amendment, Section 500.19). A 15-person licensee still needs a written, documented assessment. The letter adds that a firm exempt from naming a CISO should give oversight to a senior officer or an outside expert with enough security and IT knowledge.
Required by Part 500 vs. expected by DFS
| Topic | What Part 500 requires | What the September 2026 letter expects |
|---|---|---|
| How often | Review and update “as reasonably necessary,” at least annually, and whenever a business or technology change materially changes cyber risk (500.9(a)) | Treat system migrations, mergers, significant outsourcing, major developments in security technology such as frontier AI models, and adoption of emerging technology as likely material changes; also weigh actively exploited critical vulnerabilities and geopolitical events |
| Method | Written policies with criteria for categorizing risks, for assessing confidentiality, integrity and availability against existing controls, and for how risks are mitigated or accepted (500.9(b)) | A repeatable method that estimates likelihood and impact and applies the same rating criteria each cycle, so results compare year to year |
| Record | The assessment must be documented (500.9(b)) | Link each risk to the controls or compensating measures chosen; record every risk acceptance with its justification and residual risk; keep a risk register |
| Link to the program | The cybersecurity program is based on the risk assessment (500.2(b)) | Be able to show how the assessment led to specific controls, compensating controls and acceptance decisions |
| Assets | A complete, documented asset inventory with owner, location, sensitivity, support end date and recovery time objective (500.13(a)) | Use the inventory as the starting input; map where nonpublic information sits and how it moves |
| Vendors | Third-party service provider policies based on the risk assessment (500.11(a)) | Rate each provider by criticality, data sensitivity, connectivity and the impact of its failure, including cloud hosts, payment processors and affiliates |
| Leadership | CISO’s annual written report covers material cyber risks (500.4(b)(3)); the board oversees cyber risk management (500.4(d)) | Get input from business, operations, legal and compliance; report results to senior management. Board approval of the assessment itself is not required |
The asset inventory row carries a date worth noting. Under the amendment’s transition schedule, Section 500.13(a) applied two years after the amendment’s November 2023 effective date, which is why DFS describes the amended rule as fully in effect from November 2025. The 2026 assessment cycle is the first in which every firm should have had a complete inventory to start from.
The gaps DFS says it keeps finding
The letter draws on DFS’s examinations and investigations and lists five recurring weaknesses: asset inventories that are stale or skip cloud environments and vendors; methods that never separate inherent from residual risk; assessments that ignore new technology, interdependencies and concentration risk; risk decisions without an owner or a written reason; and programs whose controls cannot be traced back to any identified risk.
Concentration risk gets its own section. DFS asks firms to look for single points of failure, where systems that seem low-risk one by one all depend on the same cloud provider, managed service provider or software platform. The press release lists that shared-dependency question among four factors to weigh, with material technology change, emerging risk such as AI, and whether existing controls still fit the risks found. Our explainer on NYDFS AI cybersecurity guidance covers the earlier letters on AI threats that the new guidance points back to.
A worked example: one risk register row
DFS does not prescribe a scoring method. It cites NIST SP 800-221, whose semi-quantitative example (Figure 7, taken from NIST SP 800-30) multiplies likelihood by impact and treats a product above 0.20 as high and 0.06 to 0.20 as moderate. NIST presents those cutoffs as one enterprise’s choice; they are not a DFS threshold.
Take a hypothetical New York money transmitter with 15 staff, inside the limited exemption. Its asset inventory shows that the ledger database, the identity-verification vendor’s integration and the payout API all run in one cloud region. The numbers below are the firm’s own estimates, shown only to make the arithmetic visible.
| Field | Entry |
|---|---|
| Risk | A region-wide cloud outage stops payouts and ledger writes |
| Assets (from 500.13 inventory) | Ledger database, KYC integration, payout API |
| Inherent likelihood × impact | 0.5 × 0.8 = 0.40, high |
| Response | Warm standby in a second region; a written manual payout procedure |
| Residual likelihood × impact | 0.5 × 0.3 = 0.15, moderate |
| Decision on the remainder | Accepted by the senior officer, with the reason recorded |
| Owner and next review | Head of engineering; annual review, or sooner if the cloud contract or architecture changes |
| Part 500 hooks | 500.9(a) and (b), 500.11(a), 500.13(a) |
The control lowers impact, not likelihood, because the outage is just as likely to happen; the firm can now keep paying customers while it lasts. That before-and-after record, with a named owner and a written acceptance, is the traceability the letter asks for.
What to check before the next certification
Each covered entity must file its annual Part 500 compliance certification or acknowledgment by April 15, signed by its highest-ranking executive and its CISO (Section 500.17(b)). The filing due April 15, 2027 covers calendar year 2026, and a certification must rest on “data and documentation sufficient” to show material compliance. An assessment updated after a cloud migration but never written down will not support it.
The letter’s own closing checklist is short: confirm the right people take part in the assessment, check that scope and method fit the firm’s size, and make sure the assessment changes when the business, its vendors or its threats change. Our overview of NYDFS Part 500 requirements covers the rest of the regulation, and licensing questions sit in our guide to the New York money transmitter license.
