meta_id 3174252

On May 21, 2026, the New York State Department of Financial Services (DFS) Acting Superintendent Kaitlin Asrow issued guidance identifying cybersecurity measures that DFS-regulated entities should consider adopting when facing a heightened threat environment. The guidance addresses scenarios such as geopolitical events that increase cyberattack risk or technological developments that materially change cybersecurity risks, including the release of frontier artificial intelligence (AI) models. The guidance provides a framework of best practices across three areas: reducing the attack surface, improving threat detection and readiness, and strengthening resilience and response. Acting Superintendent Asrow said the guidance "gives our regulated entities actionable steps that can be taken when the threat environment intensifies," emphasising that each entity should assess its unique circumstances and operations to identify which steps are warranted. New York State Acting Chief Cyber Officer Michaela Lee noted that as frontier AI models rapidly evolve, the guidance provides "a blueprint to strengthen financial resilience, reinforcing New York's national leadership in innovation and security." The guidance does not establish new legal requirements. Rather, it identifies best practices regulated entities should consider implementing to the extent not already required by the existing cybersecurity regulation, 23 NYCRR Part 500. DFS-regulated entities should review the guidance and assess their current cybersecurity posture against the recommended best practices. The full guidance is available on the DFS website, with additional cybersecurity resources accessible through the Department's Cybersecurity Resource Center.