NYDFS Part 500 and AI Readiness — Assessment Artifacts

01Engagement at a glance

Applicability was tested, not assumed. Each applicable section of the regulation was decomposed into criteria that a person can pass or fail against retained evidence, and each criterion records which testing method produced its conclusion.

118

Testable criteria derived from the Part 500 sections in scope for assessment

Effectively implemented

Substantially implemented, improvement opportunity

Partially implemented

Not implemented

Implemented but insufficiently evidenced

Not applicable, rationale documented

AI systems in the environment, against 4 on the informal register at kickoff

7 high 14 moderate 10 low

High — regulatory exposure or material NPI risk Moderate — control or evidence deficiency Low — limited residual risk, deficiency isolated

The 31 findings are drawn from the 19 partially implemented, 5 not implemented and 7 insufficiently evidenced criteria. The seven evidence findings and the two formal risk acceptances are carried as dispositions alongside the high / moderate / low rating, not as separate severity levels.

Scope and applicability

Entity 1

Chartered institution

Covered entity, full Part 500 scope
Core banking, treasury, retail channels
Approximately 1,000 staff

Entity 2

Licensed lending subsidiary

Covered entity in its own right
§ 500.19(b) exemption tested and not available — it reaches a subsidiary only to the extent the subsidiary is covered by the affiliate’s program, and this one is not, nor adopted under § 500.2(d)
Own program and own filing obligation under § 500.17(b)

Entity 3

Technology services affiliate

Not itself regulated
Shares information systems and cybersecurity resources with both covered entities
In scope for testing, and included in the Class A aggregation

Determination

Class A test under § 500.1(d)

Run separately for each covered entity — Class A status attaches to an entity, not to a group
First limb met — at least $20M gross annual revenue in each of the last two fiscal years, counting the entity’s own operations plus its affiliates’ operations in New York State
Second limb not met — under 2,000 employees averaged, and under $1B gross annual revenue, both counting affiliates wherever located
The two limbs aggregate affiliates differently, so the workpaper records them separately
Result: both are covered entities, neither is Class A. §§ 500.2(c), 500.7(c), 500.14(b) do not apply
Re-run annually — the margin is not large and a single acquisition would change it. Counsel confirmed

On the guidance cited throughout. Five NYDFS issuances bear on this work: the AI industry letter of October 16, 2024, the third-party service provider guidance of October 21, 2025, the vishing letter of February 6, 2026, and both letters of May 21, 2026 — the frontier AI advisory and the heightened threat environment guidance. Each states that it imposes no new requirements and instead explains how existing Part 500 obligations apply.

That distinction is kept visible here rather than blurred. Where the regulation reaches a weakness, it was raised as a finding against the section, with guidance cited as the Department’s stated expectation for how that section is satisfied. Where only the guidance reaches it, it was raised as a recommendation and labelled as one. Presenting a guidance expectation as a regulatory breach inflates the finding count and costs the report credibility with the people who will check.

02Part 500 readiness matrix

An extract of the requirements matrix. The full matrix carries applicability by entity, control owner, testing method and closure evidence for all 118 criteria. Filter by domain, or search above.

Regulatory area	Control objective	Evidence expected	Gap observed	Corrective action
Cybersecurity program and policy§ 500.2, 500.3	Program based on the risk assessment; written policy approved annually by the senior governing body or a senior officer, covering the enumerated topics	Approved, version-controlled policy set; the approval record itself, with date and approver; mapping from policy topics to the enumerated list	Policy set complete and current, but two topics were addressed only inside standards that had never been through the same approval path	Fold the two standards into the approved policy scope; single annual approval covering the full enumerated list
CISO reporting§ 500.4(b), (c)	Annual written report to the senior governing body covering the six enumerated matters; timely reporting of material cybersecurity issues	The report itself; the tabled minute; the record of what was reported out of cycle and when	Five of six matters covered well. Plans for remediating material inadequacies were a single paragraph without owners or dates	Rebuild the report template against the six matters; remediation section drawn directly from the finding register
Senior governing body oversight§ 500.4(d)	Sufficient understanding to exercise oversight; reports received and reviewed; confirmation that management has allocated sufficient resources	Minutes showing questions asked and decisions taken; the resourcing confirmation; the record of any advisor engaged	Minutes recorded receipt of reports. No record of management being challenged on a risk acceptance or on a resourcing decision	Restructure committee papers so risk decisions are presented as decisions with options considered; minute the challenge, not just the receipt
Risk assessment§ 500.9	Reviewed and updated at least annually and whenever a business or technology change causes a material change to cyber risk	Dated assessment; the written criteria for evaluating and categorizing risk; the trigger log for interim updates	Annual cadence met. Generative AI adoption across several business units had not triggered an interim update	Define material-change triggers explicitly, including new AI use cases and new third-party data flows; log each trigger evaluation
Multi-factor authentication§ 500.12(a)	MFA for any individual accessing any information system, regardless of location or user type	Authentication method registration and sign-in telemetry, not policy configuration; the enumerated access path inventory tested against it	Remote and privileged access covered. Three internally hosted legacy applications and one core platform path authenticated on-premises users with a single factor	Two remediated by front-ending with the identity provider; two carried on written CISO-approved compensating controls under § 500.12(b), with an annual review date and a retirement path
Access privileges§ 500.7	Least privilege; periodic review of all access privileges; prompt termination on departure or role change; password policy	Completed review records naming the reviewer, the exceptions found, and how each was resolved; termination timing evidence reconciled to HR	Reviews occurred. Reviewer approval was not captured, exceptions were tracked in an email thread, and the resolution of two exceptions could not be established	Move reviews into a workflow with recorded approval, exception tracking and retention; reperform the current cycle to establish a clean baseline
Identity reconciliation§ 500.7, 500.13(a)	Every identity, including privileged and non-human, traceable to an approved owner	Three-way reconciliation between the directory, the HR joiner-mover-leaver record, and the privileged access record	Service accounts and application registrations had no consistent ownership record; several had privileges granted by a person no longer employed	Assign named owners to all non-human identities; ownership becomes a recertification item, not a one-off cleanup
Asset inventory§ 500.13(a)	Complete, accurate, documented inventory tracking, as applicable to each asset, owner, location, classification or sensitivity, support expiration date and recovery time objective, with a defined tracking method and update and validation frequency	The inventory itself; the written method and frequency; reconciliation output against independent inventories	CMDB carried owner and location only. Support expiration date and recovery time objective were applicable and absent, and there was no reconciliation against any other source	Extend the schema to all five data points; automate reconciliation against endpoint, vulnerability, cloud resource and network discovery inventories, with differences investigated
Vulnerability management§ 500.5	Annual penetration testing from inside and outside the boundary; automated scans at a risk-based frequency and promptly after material changes; timely risk-prioritized remediation	Test reports with tracked remediation; scan coverage measured against the asset inventory; aging analysis; tickets showing closure evidence	Testing and scanning were sound. Remediation was measured by count closed, not by age against criticality, so a small population of aged findings on internet-facing assets was not visible to management	Report aging by exploitability and asset criticality; define risk-based remediation windows and escalate breaches to the risk committee
Third-party service providers§ 500.11	Written policy covering identification, minimum practices, due diligence and periodic reassessment; guidelines addressing access controls, encryption, event notification and representations	The tiered register; completed due diligence with validation, not questionnaires alone; executed contract clauses; reassessment records	Finding, § 500.11(b)(3): of 14 critical providers, six had no cybersecurity event notification clause. Recommendation, October 2025 guidance rather than the regulation: no provider was required to disclose subcontractors, and none addressed use of institutional data for model training	Standard clause set covering notification, subcontractor disclosure with a right to reject, data location, deletion on exit, and an explicit AI training clause; re-paper or schedule at renewal
Vendor offboarding§ 500.11, 500.7	Complete revocation of provider access on termination, across interactive, federated and programmatic paths	The offboarding record showing token invalidation, key rotation, federation revocation, data return and certified destruction	A provider retired 18 months earlier had interactive accounts disabled at the time, but an OAuth consent grant and a service principal with mailbox scope remained active	Revised runbook covering non-interactive access; a periodic sweep for consent grants and service principals with no active contract behind them
Incident response§ 500.16(a)(1)	Plan addressing the nine enumerated elements, including recovery from backups and root cause analysis	The plan; the distribution record; exercise records showing decisions taken and corrective actions tracked to closure	Plan was complete against the enumerated elements. Exercises had been run but produced no recorded decisions and no corrective actions	Exercise output becomes a tracked action list with owners and dates, closed against evidence like any other finding
Business continuity and backups§ 500.16(a)(2), (d), (e)	BCDR plan with the enumerated elements; annual testing of plans and of the ability to restore critical data from backups; backups protected from unauthorized alteration or destruction	Restoration test results for the whole period, including failures; immutability configuration; the offsite storage arrangement	Restoration was tested and passed. Testing covered file and database recovery but had never exercised a full application-stack recovery for the lending platform	Add a full-stack recovery test to the annual schedule for platforms carrying a recovery time objective the business relies on
Event notification§ 500.17(a), (c)	Notice within 72 hours of a determination that a cybersecurity event meeting the § 500.17(a)(1) criteria has occurred; 24-hour notice and 30-day written description for extortion payments	The determination procedure; the decision record for events evaluated and not reported; evidence the path has been exercised	Procedure existed. No documented determination criteria, so the judgement rested on one individual, and no record was kept of events considered and not reported	Written determination criteria with a decision log; the reporting path exercised in a tabletop with legal and the executive present
Encryption§ 500.15	NPI encrypted in transit over external networks and at rest, with compensating controls at rest governed by written CISO approval	Configuration exports; the data discovery output showing where NPI actually lives; approved compensating control records with review dates	Strong in the managed estate. Two file shares holding NPI were outside the classification and encryption baseline because they predated it	Bring the shares into the baseline; make data discovery periodic so the encryption position is measured against where NPI is, not where it was
Monitoring and training§ 500.14	Risk-based monitoring of authorized user activity; malicious code protection; annual training including social engineering	Log source coverage measured against the asset inventory; detection use case inventory; training completion by population, including contractors	Log coverage was good for the managed estate and thin for business-managed SaaS. Training completion excluded a contractor population	Extend log ingestion to SaaS carrying NPI; close the contractor training population and report completion against the full in-scope headcount
Annual filing support§ 500.17(b)	A supportable basis for a Certification of Material Compliance, or a complete Acknowledgement of Noncompliance identifying sections, nature, extent and remediation timeline	The evidence position by section; the finding register with owners and dates; the five-year retention arrangement	Evidence had historically been assembled during the filing window from whatever was still retrievable	Continuous evidence retention by control, with the matrix maintained through the year; the filing window becomes a review, not a search

03AI risk and control crosswalk

AI risks were anchored to sections of Part 500 wherever the regulation reaches them, rather than to a separate AI framework. NIST AI RMF functions and the OWASP Gen AI categories structured the analysis; the regulation anchored the finding. Where a row is anchored to guidance rather than to the regulation, it says so, and it was raised as a recommendation.

AI risk	Part 500 anchor	NIST AI RMF	Technical control	Governance evidence
NPI leaving the estate through prompts, uploads or connectorsOWASP LLM02	§ 500.9 risk assessment § 500.14(a) monitoring § 500.15 encryption	Map, Manage	Classification-based upload control at the gateway and endpoint; DLP policy targeting designated NPI categories; approved enterprise service with contractual data handling terms	Approved AI acceptable-use standard; DLP event review record; the risk assessment update that recorded the AI trigger
Shadow AI — unapproved services in daily useInventory gap	§ 500.9 § 500.13(a) asset inventory § 500.14(a)	Govern, Map	Secure web gateway and cloud application telemetry baselined over 30 days; detection rule for new generative AI destinations; sanctioned alternative published alongside the restriction	The AI use-case register with business and technical owner per entry; the exception process and its approvals
AI features switched on inside SaaS the institution already assessed	§ 500.11 third parties § 500.9	Map, Measure	Tenant-level review of AI feature flags across the SaaS estate; feature-change notification made a contractual expectation	Reassessment record for each affected provider, dated after the feature was enabled rather than before
Prompt injection and indirect prompt injectionOWASP LLM01	§ 500.8 application security § 500.5 vulnerability management	Measure, Manage	Input and output validation; tool allowlists; retrieval scoped to the invoking user’s entitlements; injection testing before production and on material change	Preproduction security gate record; the test result and the defect it raised; sign-off before release
Excessive agency — an assistant acting beyond what the user could doOWASP LLM06; ASI02 tool misuse, ASI03 identity and privilege abuse	§ 500.7(a)(2), (a)(3) privileged account limits	Govern, Manage	Least privilege on the AI service identity, not on the human alone; human approval required before a payment, account change, access grant or production deployment; separation of duties preserved end to end	Entitlement design record; the approval log for actions the system is permitted to propose but not to execute
Retrieval and authorization boundary failure across customers	§ 500.7 § 500.8 § 500.15	Measure	Retrieval authorization tested with users from different business roles and different customer contexts, not with an administrative account; tenant isolation validated	Test evidence naming the roles used and the results per role; retest scheduled on index or model change
Insecure or hallucinated dependencies in AI-generated code	§ 500.8 secure development § 500.5	Manage	Static analysis and software composition analysis on generated code as on any other; infrastructure-as-code scanning; secrets scanning; dependency existence checks; human review before merge	Pipeline gate results retained per release; the secure development standard covering AI assistance explicitly
Deepfake and voice impersonation directing a payment or an account change	§ 500.9 § 500.14(a)(3) training § 500.16 response	Map, Manage	Out-of-band callback to a number of record; dual authorization above threshold; transaction limits; behavioral analytics on payment patterns; scripted help-desk identity verification that does not rely on voice	Training records covering the specific scenario; the verification procedure and evidence it is followed; tabletop record
AI-assisted phishing at higher quality and volume	§ 500.14(a)(3) § 500.14(a)(2) § 500.12	Manage	Phishing-resistant authentication for privileged and high-risk access; email and web filtering tuned for the pattern; simulation content updated to reflect quality that no longer contains the usual tells	Training completion against the full in-scope population including contractors; simulation results by cohort over time
Faster vulnerability discovery against legacy and internet-facing systems	§ 500.5 § 500.13(a)	Map, Manage	Risk-based remediation windows tightened for internet-facing and end-of-life assets; virtual patching and segmentation where remediation is not available; exposure reduction ahead of patch availability	Aging analysis by exploitability and criticality; the support expiration data point actually populated in the inventory
Concentration on a single model or cloud AI provider	§ 500.11 § 500.16 continuity	Govern, Map	Dependency map extended to model providers and material subprocessors; manual fallback defined for each customer-facing use case; portability assessed at design time rather than at exit	The dependency map; documented risk-informed decision where alternatives are genuinely limited; continuity test involving the provider
Fourth-party AI dependencies not disclosedRecommendation — guidance, not regulation	Oct 2025 guidance, read against § 500.11(a) due diligence	Govern, Map	Subcontractor disclosure required contractually, with a right to reject; periodic re-collection rather than a one-time list	Current subcontractor schedule per critical provider; the reassessment record when it changes
Institutional data used to train a provider’s modelRecommendation — guidance, not regulation	Oct 2025 guidance, read against § 500.11(b) contractual guidelines	Govern, Manage	Explicit contractual position on training use; tenant configuration verified against the contractual position rather than assumed from it	The executed clause; the configuration evidence; the date both were last verified together
Model or provider change altering behavior after assessment	§ 500.11 § 500.9	Measure, Manage	Change notification as a contractual expectation; revalidation of authorization and output-handling tests on material model change	Change log per AI system; the revalidation result tied to the change that triggered it

04Evidence is the difference between a control and a claim

Seven criteria in this engagement were closed as unable to determine. In every case the control probably operated. It could not be shown to have operated during a period that had already closed, which is a different and less comfortable statement. Evidence retention is a design decision made before the period starts.

Control area	Weak evidence	Stronger evidence
Privileged access review	A spreadsheet with no reviewer named, no date, and no record of what was found	Workflow record naming the reviewer, listing each exception, and showing how and when each exception was resolved
MFA coverage	A screenshot of the conditional access policy page	Authentication method registration and sign-in telemetry for the period, tested against an enumerated inventory of access paths
Asset inventory	A CMDB export	The same export reconciled against endpoint, vulnerability, cloud resource and network discovery inventories, with the differences investigated and dispositioned
Vulnerability remediation	A penetration test report	The report traced finding by finding to tickets, with closure evidence and retest results, plus aging analysis by exploitability and asset criticality
Backup restoration	A dashboard showing the most recent job succeeded	Restoration test results across the full period including failures, with the corrective action for each failure and the immutability configuration
Incident response readiness	A completed plan template and an attendance list from an exercise	Exercise record capturing the decisions taken, what did not work, and corrective actions tracked to closure against evidence
Third-party due diligence	A returned questionnaire accepted without validation	Attestation report read to its scope, period and exceptions, with complementary user entity controls identified and mapped to controls the institution actually operates
Policy approval	A policy document with a version number in the header	The approval record itself — who approved, on what date, against which version, minuted
Security awareness training	A completion percentage	Completion against a reconciled in-scope population including contractors, with the follow-up for non-completion
Risk acceptance	A verbal statement that the risk is known and accepted	Signed acceptance naming the accepting officer, the compensating controls, the expiry date, and the review that occurred at expiry

What makes evidence sufficient

Relevance and reliability

Does it speak to the control objective, or to something adjacent?
Was it produced by the system, or typed by a person describing the system?

Completeness and period coverage

Does it cover the whole assessment period, or the most recent successful instance?
Are exceptions included, or only the passes?

Traceability and repeatability

Can the population be traced back to an authoritative source?
Could someone else re-run this and reach the same answer?

Approval, retention and integrity

Is the approval recorded separately from the artifact being approved?
Is it retained for the five-year period supporting the annual filing?
Could it have been altered without trace?

On screenshots. They are useful as supporting context and poor as the sole basis for testing a material control. A screenshot shows a configuration at the moment it was captured. It says nothing about the period, and nothing about whether the setting held.

05Finding prioritization model

Classification and rating were kept separate. Classification records what the assessor found. Rating records how much it matters. Combining them produces a register where every unevidenced control looks like a breach, and management stops reading it. Evidence and Accepted below are dispositions carried alongside a P1–P3 rating, not additional severity levels. This model is the engagement’s, not the Department’s.

Priority	Regulatory significance	Cyber risk	Expected management action
P1 High	A section of the regulation is not materially complied with, and the position is systemic rather than isolated	Direct exposure of NPI, or a control failure on a path a threat actor is actively using	Interim mitigation within days. Named executive owner. Reported to the board risk committee at the next meeting, not the next cycle. Feeds directly into the annual filing decision
P2 Moderate	A design or operating deficiency within a section that is otherwise implemented	Material weakening of a control, mitigated in part by compensating controls	Remediation plan with owner and target date inside the current quarter. Progress reported monthly. Validated against evidence before closure
P3 Low	Requirement partially met, with the deficiency isolated rather than systemic; closing it strengthens the evidence position or the durability of the control	Limited residual risk	Scheduled into the normal work plan. Closed against evidence like any other item, not by assertion
Evidence disposition	Control appears implemented but cannot be shown to have operated during the period. Carried alongside a P1–P3 rating, not instead of one	Unknown, and that is the finding	Establish retention going forward, then reperform the current cycle to create a clean baseline. Do not backfill
Accepted disposition	Requirement met through a compensating control the regulation permits, such as the § 500.12(b) path, or risk formally accepted where it does not bear on a requirement	Residual risk understood and bounded	Written approval by the accountable officer, compensating controls documented, expiry date set, and the review actually performed at expiry

Classification statuses available in the matrix

Six of these carry a count in the 118-criteria breakdown. Design deficiency and operating deficiency are recorded per criterion as a sub-split of the partially implemented and not implemented populations, which is what tells a control owner whether to redesign the control or to fix how it runs.

Passing

Effectively implemented

Designed, approved, implemented, operated consistently through the period, and evidenced

Passing with note

Substantially implemented

Requirement met; an improvement opportunity exists in durability, coverage or evidence quality

Deficient

Partially implemented

Some elements of the requirement are met and others are not, or coverage is incomplete against the population

Deficient

Design deficiency

Even if operated perfectly, the control as designed would not meet the objective

Deficient

Operating deficiency

Design is sound; the control did not operate consistently, or exceptions went undetected

Deficient

Not implemented

No control in place against the requirement

Open

Unable to determine

Evidence insufficient to reach a conclusion. Kept distinct rather than resolved into a pass or a fail

Out of scope

Not applicable

Requirement does not apply, with the rationale documented and re-tested annually rather than assumed permanent

06Illustrative remediation roadmap

Four tracks, not one queue, because the constraints differ. Containment needs no design. Regulatory closure needs owners and evidence. Validation needs the remediation to have actually happened. Program maturity needs time, which is why it sits deliberately outside the ninety days — compressing it produces a governance forum that exists on paper and nowhere else. Timeframes here reflect this engagement; every institution’s sequence depends on its own risk, complexity and dependencies.

Track 1

Days 0–30 · Containment

Priority activities

Confirm applicability and document the Class A determination with counsel
Stand up assessment governance and the evidence exchange
Begin evidence preservation on controls where the retention gap is about to make the period untestable
Block upload of designated NPI categories to unsanctioned AI services
Baseline generative AI usage from gateway and cloud application telemetry
Validate MFA coverage against every enumerated access path
Revoke residual third-party access — tokens, consent grants, service principals
Confirm the event determination and notification path works

Accountable

CISO, IAM lead, security operations, legal, procurement

Deliverables

Scope and applicability workpaper; AI usage baseline; MFA coverage position; evidence preservation instruction

Track 2

Days 31–60 · Regulatory closure

Priority activities

Complete evidence review and technical validation across all criteria
Close remaining MFA gaps, or approve compensating controls in writing with a review date
Rebuild the asset inventory to all five enumerated data points
Reconcile assets against endpoint, vulnerability, cloud and network inventories
Update the risk assessment for AI adoption and record the trigger
Publish the AI acceptable-use standard and stand up the use-case register
Re-tier critical providers; review contracts against the October 2025 guidance
Move privileged access review into a workflow with recorded approval

Accountable

CISO, infrastructure, cloud engineering, vendor management, risk, business owners of AI use cases

Deliverables

Completed requirements matrix; finding register with owners and dates; AI inventory; contract remediation schedule

Track 3

Days 61–90 · Validation and reporting

Priority activities

Validate remediation against evidence, not against status reports
Reperform the privileged access cycle to establish a clean baseline
Test restoration for a full application stack, not files alone
Run an executive tabletop covering deepfake-initiated payment fraud and the notification decision
Rebuild the CISO report against the six enumerated matters
Restructure board papers so risk decisions can be challenged
Assemble the filing readiness package for management and counsel

Accountable

CISO, executive committee, board risk committee, internal audit, legal

Deliverables

Executive readiness report; validated finding closures; filing decision support package

Track 4

Beyond day 90 · Program maturity

Priority activities

Stand up the AI governance forum with real executive ownership and a published risk appetite
Establish continuous control monitoring across the criteria that degrade quietly
Instrument the metric set and report it with denominators
Extend AI security testing into the release process rather than running it as a one-off
Fold third-party reassessment into a scheduled cycle tied to tier
Approve the longer-term remediation plan for findings that need architecture, not configuration

Accountable

CISO, CIO, business owners of AI use cases, risk, procurement, internal audit

Deliverables

AI governance charter and use-case register; continuous monitoring in operation; approved multi-quarter remediation plan

Why it sits here

Scoped and owned inside the ninety days, delivered outside them. Compressing governance to meet a filing date produces a forum that exists on paper and nowhere else

On the filing decision. The readiness package supports a decision it does not make. Whether a Certification of Material Compliance is supportable, or an Acknowledgement of Noncompliance is the correct filing, is for the institution’s highest-ranking executive, its CISO, its senior governing body and its counsel to determine on the facts. An assessor who tells a client what to file has confused two roles.

07Questions an assessor should ask

The useful ones are the questions that cannot be answered by pointing at a document.

ScopeWhich legal entities are covered, which are exempt, and when was the Class A determination last re-run rather than assumed?
OwnershipWho owns the requirements matrix, and when was it last updated by someone other than during a filing window?
Risk assessmentWhat business or technology change last triggered an interim update, and what change was considered and judged not to trigger one?
MaterialityHow does management decide that a cyber risk is material, and where is that written down?
OversightShow me a minute where management was challenged on a risk acceptance. Not where a report was received.
IdentityCan every privileged identity, including service accounts and application registrations, be traced to a named approved owner?
MFAWhich access paths were enumerated when MFA coverage was assessed, and how was that enumeration itself validated?
ExceptionsWho approves an exception, what is the expiry, and what happened at the last expiry?
AssetsHow would you detect an asset that is on the network but absent from both vulnerability scanning and endpoint detection?
VulnerabilitiesWhat is the oldest unremediated finding on an internet-facing asset, and who knows about it?
RecoveryWhen did you last restore a full application stack, as opposed to a file or a database?
Third partiesWhich providers can reach NPI or critical systems, and which of their subcontractors can?
ConcentrationWhich fourth parties create a dependency that more than one critical service shares?
AI inventoryWhich AI systems can process NPI, and how was that list produced rather than collected?
Shadow AIWhat does gateway telemetry say about generative AI use, and how does that compare to the register?
AgencyCan any AI system execute an action — a payment, an access grant, a deployment — without a human approving it?
AI supply chainCan you identify every system calling a third-party model API, including ones embedded in SaaS?
ContinuityWhat happens to each customer-facing AI use case if the model provider is unavailable for a day?
Training dataWhat does the contract say about your data training the provider’s model, and when did you last verify the tenant configuration matches it?
AI incidentsHow is an AI-related incident identified, classified, escalated, and evaluated against the 72-hour notification obligation?
OffboardingFor the last provider you terminated, what evidence exists that federated and programmatic access was revoked, not just interactive accounts?
The filingWhat evidence would management put in front of counsel when signing, and where is it retained for five years?

08Regulatory timeline the engagement worked against

Three NYDFS issuances landed inside the engagement window and changed the sequence, one of them covering two separate letters. Blue marks a Part 500 transitional deadline or filing date; green marks NYDFS guidance or an advisory.

1 November 2023

Second Amendment effective

Phased implementation under § 500.22 begins, running through November 2025.

16 October 2024

NYDFS industry letter on AI cybersecurity risks

Explains how Part 500 applies to AI risk. States plainly that it imposes no requirements beyond the regulation.

1 May 2025

Automated scanning, access controls, malicious code protection

§ 500.5(a)(2), § 500.7 and § 500.14(a)(2) take effect for covered entities.

21 October 2025

Third-party service provider guidance

Arrived at engagement kickoff. Drove the contract review, the subcontractor disclosure position, the offboarding runbook, and the AI training clause.

1 November 2025

Final transitional deadline

§ 500.12 MFA for any individual accessing any information system, and § 500.13(a) documented asset inventory. Both were live findings during fieldwork.

6 February 2026

NYDFS letter on an ongoing cyberthreat campaign involving targeted vishing attacks

Arrived while help-desk identity verification was an open low-rated finding. It was re-rated and pulled forward.

15 April 2026

Annual filing date

Certification of Material Compliance or Acknowledgement of Noncompliance for the prior calendar year, signed by the highest-ranking executive and the CISO. Supporting records retained five years.

21 May 2026

Frontier AI advisory and heightened threat environment guidance

Arrived after the filing period. Prompted re-examination of remediation timelines for internet-facing and end-of-life systems, coordination with providers on dependency maps, and the review path for AI-generated code.

09Metrics handed over

None of these is required by the regulation. They were chosen because each one degrades visibly when the underlying control stops working, which is the only property that makes a metric worth reporting.

Regulatory position

Evidence coverage

Percentage of applicable criteria with current validated evidence
Percentage of criteria whose evidence is older than the retention requirement allows
Percentage of critical findings past target date

Identity

Access integrity

Percentage of privileged accounts covered by required authentication strength
Count of orphaned or stale privileged accounts
Count of non-human identities without a named owner
Mean time to revoke third-party access after termination

Assets and exposure

Inventory quality

Percentage of assets reconciled across all authoritative inventories
Count of assets present in the network and absent from scanning or endpoint detection
Age of the oldest unremediated finding on an internet-facing asset

Third party

Provider position

Percentage of critical providers with a current assessment
Percentage with the full contractual clause set executed
Percentage with a current subcontractor schedule
Percentage of material providers with tested continuity arrangements

AI governance

Percentage of AI systems on the approved register
Count of unsanctioned AI services detected in the period
NPI-related DLP events involving AI destinations
Percentage of high-risk AI use cases with a completed security assessment
Percentage of AI applications tested for injection and authorization bypass

Caution

What metrics will not do

A rising completion percentage against a shrinking population is not improvement
Counting closed vulnerabilities without aging hides the population that matters
Any metric that becomes a target will be optimized, including by narrowing what is measured
Report the denominator alongside the number, every time

10Primary sources

Regulatory and framework references used in the assessment. Verified against the issuing bodies at the time of publication.

New York State Department of Financial Services, 23 NYCRR Part 500, Cybersecurity Requirements for Financial Services Companies (Second Amendment, effective November 1, 2023). dfs.ny.gov Cybersecurity Resource Center
NYDFS, Part 500 Implementation Timeline for Covered Entities. dfs.ny.gov
NYDFS Industry Letter, October 16, 2024, Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks. dfs.ny.gov
NYDFS Industry Letter, October 21, 2025, Guidance on Managing Risks Related to Third-Party Service Providers. dfs.ny.gov
NYDFS Industry Letter, May 21, 2026, Heightened Cybersecurity Risks Associated with Frontier AI Models. dfs.ny.gov
NYDFS Industry Letter, May 21, 2026, Guidance on Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment. dfs.ny.gov
NYDFS Industry Letter, February 6, 2026, Ongoing Cyberthreat Campaign Involving Targeted “Vishing” Attacks. dfs.ny.gov
NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, February 2024. csrc.nist.gov
NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, January 2023. nist.gov
NIST, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1, July 2024. nvlpubs.nist.gov
NIST, Security and Privacy Controls for Information Systems and Organizations, SP 800-53 Rev. 5. csrc.nist.gov
NIST, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, SP 800-161 Rev. 1. csrc.nist.gov
NIST, Secure Software Development Practices for Generative AI and Dual-Use Foundation Models, SP 800-218A, July 2024. csrc.nist.gov
OWASP Gen AI Security Project, OWASP Top 10 for LLM Applications 2025. genai.owasp.org
OWASP Gen AI Security Project, OWASP Top 10 for Agentic Applications 2026 — used for the tool-misuse and identity-and-privilege-abuse categories on the excessive agency row. genai.owasp.org
ISO/IEC 27001:2022 and ISO/IEC 42001:2023, used as management-system references for control governance and AI lifecycle governance respectively.

Framework alignment is not regulatory compliance. A control environment aligned to NIST, ISO or CIS, or covered by a third-party attestation, may still carry Part 500 applicability, evidence, governance or reporting gaps. An attestation report describes the service organization’s controls over a defined scope and period. It is an input to due diligence under § 500.11 and it is not proof of the covered entity’s own compliance.