Part 500 Cybersecurity Requirements for Financial Services Companies

IMPORTANT NOTE REGARDING CONTENT CURRENCY: The date provided at the bottom of every rule section is the date of the most recently produced official NYCRR supplement covering that section. See Help for additional information on the currency of this unofficial version of the NYS Rules.

• 23 CRR-NY I 500 Notes
• s 500.0 Introduction.
• s 500.1 Definitions.
• s 500.2 Cybersecurity program.
• s 500.3 Cybersecurity policy.
• s 500.4 Chief information security officer.
• s 500.5 Penetration testing and vulnerability assessments.
• s 500.6 Audit trail.
• s 500.7 Access privileges.
• s 500.8 Application security.
• s 500.9 Risk assessment.
• s 500.10 Cybersecurity personnel and intelligence.
• s 500.11 Third party service provider security policy.
• s 500.12 Multi-factor authentication.
• s 500.13 Limitations on data retention.
• s 500.14 Training and monitoring.
• s 500.15 Encryption of nonpublic information.
• s 500.16 Incident response plan.
• s 500.17 Notices to superintendent.
• s 500.18 Confidentiality.
• s 500.19 Exemptions.
• s 500.20 Enforcement.
• s 500.21 Effective date.
• s 500.22 Transitional periods.
• s 500.23 Severability.