Announcing Agent Commander - The First Integrated solution from Veeam + Securiti.ai enabling the scaling of safe AI agents

View
Veeam

The Funniest Evening at RSA with Hasan Minhaj

Hasan Minhaj Request ticket
View
Contact Us See a demo

New York State Department of Financial Services Cybersecurity Regulations

Operationalize compliance with the most comprehensive PrivacyOps platform

Last Updated on March 26, 2025

Schedule Your
Personal Demo

Learn how you can leverage Securiti’s Data Command Center to address data security, privacy, governance, and compliance.

See a demo
Schedule your demo today

The New York State Department of Financial Service Cybersecurity Regulations (23 NYCRR 500) is a set of cybersecurity requirements mandatory for all financial institutions registered in New York working under its Banking Law, Insurance Law, or Financial Services Law.

Presented by the New York State Department of Financial Services (DFS), this regulation came into effect on March 1st, 2017, after two separate rounds of feedback and comments from both the general public and the industry itself. The regulation requires all covered financial institutions to undertake rigorous assessments of the risks posed to their systems and operations and undertake robust cybersecurity measures to address these risks.

Owing to increased and more sophisticated cybersecurity needs, the DFS announced the Second Amendment to the Cybersecurity Regulations, effective November 1, 2023. The amendments will come into effect in phases. For easy reference, the DFS has outlined key compliance dates for Small Businesses, Class A Businesses, Covered Entities on its website.

The Solution

Securiti offers organizations PI data discovery, DSR automation, documented accountability, and AI-process automation, among other privacy solutions, to ensure compliance with the New York State Department of Financial Services Cybersecurity Regulations.

Thanks to its state-of-the-art artificial intelligence and machine learning algorithm-based products, Securiti is a pioneer in offering enterprise solutions in data governance and compliance.

NYDFS compliance Solution

Request a demo today to learn how Securiti can aid you and your organization's compliance efforts.

 

Automate Risk Assessments & Audit Trails

Section(s): 500.2(b),500.2(c), 500.3(m), 500.3(o), 500.5, 500.6 , 500.9

Organizations can easily automate and schedule regular risk assessments to ensure their practices are fully compliant with the requirements of 23 NYCRR 500.

NYDFS Automatic Risk Assessment Audit
NYDFS Automatic Policy Alerts

Protect Nonpublic Information

Section(s): 500.2(a), 500.3(a), 500.15

Organizations can ensure all Non-public Information collected and retained by them is provided the appropriate protection by implementing security protocols such as encryption and tokenization.

Automate Incident Response Plan

Section(s): 500.1(f), 500.1(g), 500.16, 500.17

Organizations can implement and automate every step of their data breach incident response plan to ensure a proactive approach is adopted, resulting in minimal damage.

NYDFS Incident Response Plan
NYDFS Vendor Risk Management

Fulfill Vendor Risk & Third Party Service Provider Management Requirements

Section(s): 500.3(I), 500.11

Organizations can automate exhaustive regular risk assessments of vendors' and third parties' data practices to ensure they are compliant with the law's requirements.

Fulfill Data Governance & Classification Requirements

Section(s): 500.3(b), 500.3(c), 500.13(a)

Using data classification and data discovery, organizations can ensure all relevant nonpublic information is identified, classified, and all appropriate data governance controls are applied to ensure compliance with the regulation.

NYDFS Data Governance and Asset Classification
NYDFS Data Risk Explorer

Ensure Access Controls & Identity Management

Section(s): 500.3(d), 500.7, 500.12

By applying and monitoring strict access controls, organizations can ensure privilege to nonpublic information is only extended to authorized individuals, creating a secure infrastructural environment.

Automate System Security & Monitoring

Section(s): 500.3(g), 500.12, 500.14

Organizations can continuously monitor the security and access controls placed on Nonpublic Information to protect it from cybersecurity threats.

NYDFS personal data monitoring tracking
NYDFS DSR Workbench

Fulfill Data Retention Requirements

Section(s): 500.3(b), 500.13(b)

Organizations can apply data retention controls in real time to ensure they retain data for as long as it is required for business operations or other legitimate business purposes or by the law.

Facts Related To New York State Department of Financial Services Cybersecurity Regulation

Each organization subject to the NY DFS Cybersecurity Regulation:

1

Must appoint a Chief Information Security Officer (CISO) to oversee the implementation of the cybersecurity policy within the organization and have cybersecurity personnel and intelligence;

2

Must develop a cybersecurity program and policy for the protection of the Nonpublic Information stored on their Information Systems;

3

Must conduct regular risk assessments of its information systems to ensure cybersecurity risks to its business operations as well as the confidentiality, integrity, and security of Nonpublic Information through appropriate controls;

4

Must implement Multi-Factor Authentication or Risk-Based controls internally to eliminate illegal or unauthorized access to critical information systems resources;

5

Must electronically file a notice of exemption in the form set forth on the department’s website from the regulation with the NYDFS within 30 days of the determination that they are exempt;

6

Must adhere to the regulation or face enforcement actions by the Superintendent of Financial Services through hefty fines and civil penalties.

Analyze this article with AI

ChatGPT Claude Perplexity Grok
Prompts open in third-party AI tools.
IDC MarketScape

Securiti named a Leader in the IDC MarketScape for Data Privacy Compliance Software

Read the Report
Please enter a minimum of 3 characters to begin your search.

Type

Videos
View More
January 20, 2025
Mitigating OWASP Top 10 for LLM Applications 2025
Generative AI (GenAI) has transformed how enterprises operate, scale, and grow. There’s an AI application for every purpose, from increasing employee productivity to streamlining...
View More
January 15, 2025
Top 6 DSPM Use Cases
With the advent of Generative AI (GenAI), data has become more dynamic. New data is generated faster than ever, transmitted to various systems, applications,...
View More
January 2, 2025
Colorado Privacy Act (CPA)
What is the Colorado Privacy Act? The CPA is a comprehensive privacy law signed on July 7, 2021. It established new standards for personal...
View More
December 24, 2024
Securiti for Copilot in SaaS
Accelerate Copilot Adoption Securely & Confidently Organizations are eager to adopt Microsoft 365 Copilot for increased productivity and efficiency. However, security concerns like data...
View More
November 1, 2024
Top 10 Considerations for Safely Using Unstructured Data with GenAI
A staggering 90% of an organization's data is unstructured. This data is rapidly being used to fuel GenAI applications like chatbots and AI search....
View More
October 29, 2024
Gencore AI: Building Safe, Enterprise-grade AI Systems in Minutes
As enterprises adopt generative AI, data and AI teams face numerous hurdles: securely connecting unstructured and structured data sources, maintaining proper controls and governance,...
View More
August 12, 2024
Navigating CPRA: Key Insights for Businesses
What is CPRA? The California Privacy Rights Act (CPRA) is California's state legislation aimed at protecting residents' digital privacy. It became effective on January...
View More
June 3, 2024
Navigating the Shift: Transitioning to PCI DSS v4.0
What is PCI DSS? PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards to ensure safe processing, storage, and...
View More
January 29, 2024
Securing Data+AI : Playbook for Trust, Risk, and Security Management (TRiSM)
AI's growing security risks have 48% of global CISOs alarmed. Join this keynote to learn about a practical playbook for enabling AI Trust, Risk,...
AWS Startup Showcase Cybersecurity Governance With Generative AI View More
October 17, 2023
AWS Startup Showcase Cybersecurity Governance With Generative AI
Balancing Innovation and Governance with Generative AI Generative AI has the potential to disrupt all aspects of business, with powerful new capabilities. However, with...

Spotlight Talks

Spotlight 50:52
From Data to Deployment: Safeguarding Enterprise AI with Security and Governance
Watch Now View
Spotlight 11:29
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Watch Now View
Spotlight 11:18
Rewiring Real Estate Finance — How Walker & Dunlop Is Giving Its $135B Portfolio a Data-First Refresh
Watch Now View
Spotlight 13:38
Accelerating Miracles — How Sanofi is Embedding AI to Significantly Reduce Drug Development Timelines
Sanofi Thumbnail
Watch Now View
Spotlight 10:35
There’s Been a Material Shift in the Data Center of Gravity
Watch Now View
Spotlight 14:21
AI Governance Is Much More than Technology Risk Mitigation
AI Governance Is Much More than Technology Risk Mitigation
Watch Now View
Spotlight 12:!3
You Can’t Build Pipelines, Warehouses, or AI Platforms Without Business Knowledge
Watch Now View
Spotlight 47:42
Cybersecurity – Where Leaders are Buying, Building, and Partnering
Rehan Jalil
Watch Now View
Spotlight 27:29
Building Safe AI with Databricks and Gencore
Rehan Jalil
Watch Now View
Spotlight 46:02
Building Safe Enterprise AI: A Practical Roadmap
Watch Now View
Latest
View More
February 24, 2026
Introducing Agent Commander
The promise of AI Agents is staggering— intelligent systems that make decisions, use tools, automate complex workflows act as force multipliers for every knowledge...
Risk Silos: The Biggest AI Problem Boards Aren’t Talking About View More
February 18, 2026
Risk Silos: The Biggest AI Problem Boards Aren’t Talking About
Boards are tuned in to the AI conversation, but there’s a blind spot many organizations still haven’t named: risk silos. Everyone agrees AI governance...
Largest Fine In CCPA History_ What The Latest CCPA Enforcement Action Teaches Businesses View More
February 23, 2026
Largest Fine In CCPA History: What The Latest CCPA Enforcement Action Teaches Businesses
Businesses can take some vital lessons from the recent biggest enforcement action in CCPA history. Securiti’s blog covers all the important details to know.
View More
February 19, 2026
AI & HIPAA: What It Means and How to Automate Compliance
Explore how the Health Insurance Portability and Accountability Act (HIPAA) applies to Artificial Intelligence (AI) in securing Protected Health Information (PHI). Learn how to...
California’s Delete Request and Opt-out Platform (DROP) and the Delete Act View More
March 11, 2026
California’s Delete Request and Opt-out Platform (DROP) and the Delete Act
Understand California’s DROP platform and the Delete Act, including compliance timelines, the 45-day cycle, broker obligations, and how to operationalize compliance.
Building A Secure AI Foundation For Financial Services View More
March 3, 2026
Building A Secure AI Foundation For Financial Services
Access the whitepaper and discover how financial institutions eliminate Shadow AI, enforce real-time AI policies, and secure sensitive data with a unified DataAI control...
Emerging AI Security Trends For 2026 View More
March 11, 2026
Emerging AI Security Trends For 2026
Securiti’s latest infographic provides security leaders with a walkthrough of all the emerging AI security trends for 2026 to help them assess and plan...
Safe AI, Accelerated: View More
March 11, 2026
Safe AI, Accelerated: Securing Data & AI Across the Lifecycle
Securiti’s latest infographic dives into the issue organizations face when scaling their AI projects safely, and how best they can address those challenges.
View More
February 18, 2026
Take the Data Risk Out of AI
Learn how to prepare enterprise data for safe Gemini Enterprise adoption with upstream governance, sensitive data discovery, and pre-index policy controls.
View More
December 22, 2025
Navigating HITRUST: A Guide to Certification
Securiti's eBook is a practical guide to HITRUST certification, covering everything from choosing i1 vs r2 and scope systems to managing CAPs & planning...
What's
New