Content Gen Dashboard

Generated

1997 chars

New York Department of Financial Services Issues Cybersecurity Risk Assessment Guidance

On September 10, 2026, the New York State Department of Financial Services (DFS) issued new cybersecurity guidance outlining expectations for DFS-regulated entities conducting risk assessments to inform their cybersecurity programs. Acting Superintendent Kaitlin Asrow said the guidance clarifies regulatory requirements under the DFS cybersecurity regulation and shares best practices entities should consider implementing. The guidance emphasises that risk assessments form the foundation of strong cybersecurity programs and outlines key elements including governance and oversight, methodology, scope, and documentation. DFS-regulated entities must review and update risk assessments at least annually and whenever a material change in business or technology occurs that affects cybersecurity risk. The guidance does not impose new obligations but rather clarifies existing requirements under the DFS cybersecurity regulation, which became effective in March 2017 with an updated amendment fully in effect as of November 2025. The guidance identifies factors entities should consider when performing risk assessments: material technology changes such as system migrations or acquisitions; third-party risk, including evaluating dependencies on cloud providers, managed service providers, or software platforms; emerging risk from adoption of artificial intelligence or other new technologies; and risk-informed controls to determine whether existing controls, policies, monitoring, or risk acceptance decisions require strengthening. The updated guidance applies to all DFS-regulated financial services entities operating in New York and supports the DFS's mission to enhance cybersecurity governance and strengthen protections for New York businesses and consumers against cybersecurity threats. The DFS has published the guidance on its newly refreshed Cybersecurity Resource Center, which serves as a centralised hub for cybersecurity guidance, resources, and frequently asked questions.

Agent draft

$0.07 · 25.7s · 2067 chars

New York Department of Financial Services Issues Cybersecurity Guidance on Risk Assessment Requirements

On September 10, 2026, the New York State Department of Financial Services (DFS) issued new cybersecurity guidance clarifying regulatory expectations for DFS-regulated entities conducting risk assessments to inform their cybersecurity programs. Acting Superintendent Kaitlin Asrow said that "risk assessments are the foundation of a strong cybersecurity program" and emphasized the need for cybersecurity programs to adapt as risks evolve. Under the DFS's cybersecurity regulation, 23 New York Codes, Rules and Regulations (NYCRR) Part 500, regulated entities must review and update risk assessments at least annually and whenever a material change in business or technology occurs. The guidance does not impose new legal obligations but rather clarifies existing regulatory requirements under the regulation, which became effective in March 2017 with an updated amendment fully in effect as of November 2025. The guidance outlines key elements of effective risk assessments, including governance and oversight, methodology, scope, documentation, and integration into cybersecurity programs. It identifies four critical factors entities should consider: material technology changes such as system migrations or acquisitions; third-party risk, including dependencies on cloud providers and managed service providers; emerging risks from technologies such as artificial intelligence; and risk-informed controls to determine whether existing controls, policies, and monitoring require strengthening. The DFS has refreshed its Cybersecurity Resource Center, a hub providing guidance, resources, and frequently asked questions to assist covered entities in complying with cybersecurity requirements. All entities operating under a license, registration, charter, certificate, permit, accreditation, or similar authorization under New York's Banking Law, Insurance Law, or Financial Services Law must comply with the regulation. Regulated entities are encouraged to review the guidance and assess their current risk assessment practices against the outlined expectations.

5 tool calls

fetch https://www.dfs.ny.gov/reports_and_publications/press_releases/pr20260910 http · 3413 chars · 40 links
search "New York DFS Department of Financial Services cybersecurity guidance" → nids 92688, 91081, 94423, 93071, 94056
fetch https://www.dfs.ny.gov/cybersecurity http · 5152 chars · 40 links
search "DFS cybersecurity risk assessment regulation 23 NYCRR Part 500" → nids 92688, 91081, 94423, 93312, 94569
fetch https://www.dfs.ny.gov/industry_guidance/industry_letters http · 30136 chars · 40 links

Published

1308 chars

New York State Department of Financial Services Issues Cybersecurity Risk Assessment Guidance

On September 10, 2026, the New York State Department of Financial Services (DFS) issued new guidance outlining expectations for DFS-regulated entities conducting risk assessments of their cybersecurity programs. According to the DFS , the guidance is intended to clarify requirements under the DFS's primary cybersecurity regulation, 23 New York Codes, Rules and Regulations (NYCRR) Part 500 , as well as to share best practices that regulated entities should consider implementing. The guidance emphasizes that risk assessments form the foundation of strong cybersecurity programs and outlines key elements of such assessments, including governance and oversight, methodology, scope and documentation. The guidance also identifies factors that regulated entities should consider when performing risk assessments: Material technology changes, such as system migrations or acquisitions. Third-party risk, including evaluating dependencies on cloud providers, managed service providers or software platforms. Emerging risk from adoption of artificial intelligence (AI) or other new technologies. Risk-informed controls to determine whether existing controls, policies, monitoring or risk acceptance decisions require strengthening. The guidance does not impose any new obligations on regulated entities.