meta_id 2928292

On March 3, 2026, the New York State Department of Financial Services (DFS) issued a cybersecurity advisory to all regulated entities, reminding them of heightened cyber threats arising from ongoing global conflicts. While the DFS has not identified a specific, coordinated campaign targeting the financial services industry or its regulated entities, it emphasized that the current threat environment warrants increased vigilance. The advisory does not impose new requirements but reminds regulated entities of their obligation to comply with the DFS's cybersecurity regulation, 23 NYCRR Part 500. The DFS highlighted several best practices for entities to consider, including: promptly identifying and remediating known vulnerabilities by monitoring authoritative sources such as the Known Exploited Vulnerabilities Catalog ; preparing for disruptive and destructive cybersecurity incidents through reviewing and testing operational resilience procedures; reviewing personnel and customer communication strategies to address prolonged system disruptions; enhancing monitoring for suspicious and unauthorized activity; ensuring user and service account privileges follow the principle of least privilege; protecting against code injection attacks through restricting and validating user inputs; confirming information system, account, and authentication settings are securely configured; and monitoring financial transactions, including virtual currency business activity, to ensure compliance with applicable sanctions and anti-money laundering orders and guidance. The advisory applies to all entities regulated by the DFS, including banks, insurance companies, and other financial services providers. The DFS noted that the advisory is not exhaustive, and entities should consider taking additional steps to manage their unique cybersecurity risks based on their individual threat assessments and operational environments.