Do You Need to Comply with the Cybersecurity Regulation?

You are required to comply with the Cybersecurity Regulation if you are a Covered Entity. The definition of Covered Entity in Section 500.1 includes individuals and small businesses that operate under or are required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under New York’s Banking, Insurance or Financial Services Laws.

DFS cannot advise a particular individual or small business on whether it is a Covered Entity. Each individual and small business must do its own analysis, based on its specific business and circumstances, to determine whether it is a Covered Entity.

If you are not a Covered Entity, you are not required to comply with the Cybersecurity Regulation.

Visit Exemptions from Cybersecurity Regulation to learn more.

Determine Whether You Qualify for Any of the Exemptions Listed in the Cybersecurity Regulation. 

Many individual brokers, agents, and adjusters, as well as some small businesses, qualify for an exemption. The exemptions are listed in Section 500.19 and fall into two categories: full and limited, described below.

Use the “Am I Exempt from DFS’s Cybersecurity Regulation” flowchart to help determine whether an individual or small business qualifies for an exemption.

Full Exemptions

Three subsections of 500.19 provide for full exemptions: Sections 500.19(b), 500.19(e), and 500.19(g).

• To qualify for a Section 500.19(b) exemption, an employee, agent, wholly-owned subsidiary, representative, or designee must be fully covered by the cybersecurity program of another Covered Entity for which they are an employee, agent, wholly-owned subsidiary, representative or designee. 
• To qualify for a Section 500.19(e) exemption, a Covered Entity must be an individual insurance broker (subject to Insurance Law section 2104) who meets the following three conditions: (1) does not maintain, control or use, even indirectly, any Information Systems and does not have any Nonpublic Information; (2) has not, for anything of value, acted or aided in any manner in soliciting, negotiating or selling any policy or contract or in placing risks or taking out insurance on behalf of another Person for at least one year; and (3) does not otherwise qualify as a Covered Entity (for example, does not hold another type of license).
• To qualify for a Section 500.19(g) exemption, a Covered Entity must not otherwise qualify as a Covered Entity by virtue of another license, and must be (1) a charitable annuity society, (2) a risk retention group not chartered in NY, (3) an individual insurance agent placed in inactive status under Insurance Law §2103, (4) an individual mortgage loan originator placed in inactive status under Banking Law §599-i, or (5) an accredited reinsurer, certified reinsurer, or recognized reciprocal jurisdiction reinsurer pursuant to 11 NYCRR Part 125. 

Limited Exemptions

If you do not qualify for any of the full exemptions, you may qualify for a limited exemption.

The most common limited exemptions for which small businesses and individuals qualify are those listed in Section 500.19(a).

• To qualify under Section 500.19(a)(1), a business, along with any Affiliates, must have fewer than 20 employees and independent contractors.
• To qualify under Section 500.19(a)(2), an individual or small business must have less than $7,500,000 in gross annual revenue in each of the last 3 fiscal years from (1) all of its business operations, wherever located, and (2) its Affiliates’ New York business operations.
• To qualify under Section 500.19(a)(3), an individual or business must have less than $15,000,000 in year-end total assets, including assets of all Affiliates.

When analyzing whether an individual or small business qualifies for one of the exemptions listed in Section 500.19(a), remember that “Affiliate” is defined broadly in Section 500.1(a) of the Cybersecurity Regulation as any person that controls, is controlled by, or is under common control with another person. “Control” in this context means the possession, direct or indirect, of the power to direct or cause the direction of the management and policies of a person, whether through the ownership of stock of such person or otherwise.

Individuals and small businesses also may qualify for the limited exemption set forth in Section 500.19(c) if they (1) do not operate, maintain, use, or control a computer or other device that holds electronic data, including phones; and (2) do not, and are not required to, control, own, access, generate, receive, or possess confidential customer and other sensitive business and private information.

In addition, captive insurance companies that do not and are not required to directly or indirectly control, own, access, generate, receive, or possess Nonpublic Information (other than information relating to its corporate parent company or Affiliates) may qualify for the limited exemption set forth in Section 500.19(d).

You may qualify for more than one of the limited exemptions listed above. If you do, you should indicate all applicable exemptions when you submit your Notice of Exemption.

Whether you qualify for an exemption depends on your specific circumstances. DFS cannot make that determination for you.

If you do NOT qualify for an exemption, you must comply with all sections of the Cybersecurity Regulation (except those applicable only to Class A Companies) and can skip Steps 3 and 4.

If You Qualify for an Exemption, Submit a Notice of Exemption.

Visit the Cybersecurity Submissions page to learn how to Submit a Notice of Exemption.

If you qualify for a full exemption pursuant to Section 500.19(b) as an employee, agent, representative, or designee of another DFS-regulated business, or if your business qualifies for the Section 19(b) exemption because it is a wholly owned subsidiary of another DFS-regulated entity, you will need to provide the name of the DFS-regulated entity whose cybersecurity program covers all aspects of your or your business’ work when submitting your Notice of Exemption.

Note: An individual or small business may not list itself as the DFS-regulated entity on whose cybersecurity program it is relying. In other words, the entity eligible for the 500.19(b) exemption cannot be the same entity that is providing coverage under its cybersecurity program.

Individuals and small businesses that submit a Notice of Exemption indicating they qualify for a limited exemption pursuant to Sections 500.19(a), (c), or (d) do not have to resubmit such notices each year. They should periodically review their status to determine whether they still qualify for an exemption and must indicate which limited exemptions, if any, they qualify for on their required annual compliance notifications.

If your qualifications for an exemption have changed and you no longer qualify for an exemption, you are responsible for making sure your exemption is terminated. If your company submitted a Notice of Exemption on your behalf, the company may amend or terminate your exemption, but it is your responsibility to make sure that DFS is notified of the change.

Visit the Cybersecurity Submissions page to learn how to amend or terminate a previously submitted notice of exemption. 

If you qualify for a full exemption and have submitted a Notice of Exemption, you do not need to proceed past this step. However, if you only qualify for one or more limited exemptions pursuant to subsections (a), (c) or (d) of Section 500.19, you must submit a Notice of Exemption AND proceed to Step 4.

If You Qualify for One of the Limited Exemptions, Determine Which Sections of the Cybersecurity Regulation you Must Still Comply With.

If you qualify for a limited exemption pursuant to Section 500.19(a), you are still required to:

• Maintain a cybersecurity program (Section 500.2(a), (b), (d), and (e));
• Maintain written cybersecurity policies (Section 500.3);
• Limit access privileges, as required (Section 500.7(a));
• If passwords are used, implement a written password policy that meets or exceeds industry standards (Section 500.7(b));
• Conduct Risk Assessments (Section 500.9); 
• Implement Third-Party Service Provider policies and procedures (Section 500.11);
• Comply with applicable MFA requirements (Section 500.12);
• Maintain an asset inventory and limit data retention (Section 500.13); 
• Provide cybersecurity awareness training (Section 500.14(a)(3)); and
• Provide required notices to DFS, including the annual compliance notification, and notices regarding Cybersecurity Incidents and extortion payments (Section 500.17).

If you qualify for a limited exemption pursuant to Section 500.19(c) or Section 500.19(d), you are still required to:

• Conduct Risk Assessments (Section 500.9);
• Implement Third-Party Service Provider policies and procedures (Section 500.11); 
• Maintain an asset inventory and limit data retention (Section 500.13); and
• Provide notices to DFS, including an Annual Compliance Notification and notices of Cybersecurity Incidents and extortion payments (Section 500.17).

Take Action to Comply with the Sections of the Cybersecurity Regulation Applicable to You.

Once you determine which sections of the Cybersecurity Regulation apply to you, you must take action to comply. You can use the short descriptions below to prepare a list of actions needed to comply with the sections that apply to you:

Section 500.2 – Maintain a Cybersecurity Program

You must have a cybersecurity program that enables you or your company to: identify and assess cybersecurity risks; protect Nonpublic Information (such as confidential customer information or sensitive business information) and Information Systems storing such information from unauthorized access and other malicious acts; detect, respond, and recover from Cybersecurity Events; and comply with applicable regulatory reporting obligations.

Section 500.3 – Maintain Written Cybersecurity Policies

This section requires you to establish and maintain written cybersecurity policies that comprise the framework for your cybersecurity program. You should draft and implement these policies based on your Risk Assessment. Risks include, among other things, how much data you hold, the types of data you hold, and the number of people who can access that data. 

You only need to establish and maintain policies that are relevant to your business, but you must determine whether you need policies that cover the following topics and controls, all of which are listed in Section 500.3:

• Information security
• Data governance, classification, and retention
• Asset inventory, device management, and end of life management
• Access controls, including remote access and identity management
• Business continuity and disaster recovery planning and resources
• Systems operations and availability concerns
• Systems and network security and monitoring
• Security awareness and training
• Systems and application security and development and quality assurance
• Physical security and environmental controls
• Customer data privacy
• Vendor and Third-Party Service Provider management
• Risk Assessment
• Incident response and notification
• Vulnerability management

Cybersecurity policies must be approved at least annually by a Senior Officer or your Senior Governing Body.

Section 500.7 – Control Who Can Access Information Systems

You are required to know who has access to Nonpublic Information, including confidential customer and business information, held by or on behalf of your business AND to limit that access to people who need it for their job. You must periodically, but at a minimum annually, review who has and needs such access and remove or disable accounts and access that are no longer necessary. 

You must also impose limits on the number and use of as well as access to Privileged Accounts, only allow secure connections where devices can be remotely controlled, promptly terminate access when employees leave, and have a written password policy that meets industry standards, among other things.

Section 500.9 – Conduct Risk Assessments

You must base your cybersecurity program on the identification, evaluation, and prioritization of cybersecurity risks to your business operations, including but not limited to risks to your Information Systems, the Nonpublic Information maintained on those systems, and your customers. You must conduct periodic Risk Assessments in accordance with written policies and procedures that must include:

• the criteria you will use to evaluate and categorize identified cybersecurity risks and threats;
• the criteria you will use to assess the confidentiality, integrity, security, and availability of your Information Systems and the Nonpublic Information maintained on them; and requirements that describe how identified risks will be controlled, minimized, or accepted and how your cybersecurity program will address those risks. 

These assessments must be reviewed and updated at least annually and when any changes to your business or technology materially impacts your cybersecurity risk.

Section 500.11 – Maintain a Policy Regarding the Use of Third-Party Service Providers

You must implement written policies and procedures designed to ensure the security of Information Systems and Nonpublic Information, including the confidential customer and sensitive business information, that are accessible to, or held by, Third Party Service Providers. A Third-Party Service Provider, for purposes of the Cybersecurity Regulation, is a non-governmental individual or organization that provides services to you, maintains, processes or otherwise is permitted access to your Nonpublic Information, and is not affiliated with you or your company. Law firms, internet hosting companies, and electronic storage providers are examples of Third-Party Service Providers.

Section 500.12 – Implement MFA

Use Multi-factor Authentication (“MFA”) for any remote access you allow into your Information Systems, for third-party applications where Nonpublic Information is accessible (including any cloud applications), and for accessing Privileged Accounts. If – and only if – you have a CISO, you may be able to use reasonably equivalent or more secure compensating controls so long as the CISO reviews and approves, in writing, the compensating controls to ensure their reasonable equivalence at least annually.

• New York Multi-Factor Authentication (MFA) Requirements One-Pager (PDF)

Section 500.13 – Maintain Asset Inventories and Limit the Data You Keep

You must have policies in place to implement and maintain an up-to-date asset inventory covering your Information Systems. Your cybersecurity program must include policies and procedures for the secure disposal on a periodic basis of Nonpublic Information.

Section 500.14 – Provide Cybersecurity Awareness Training 

Provide cybersecurity awareness training that includes social engineering for all personnel at least annually.

Section 500.17 – Notify DFS When Required 

The following are required notifications to DFS:

• Annual Compliance Notifications – Submit either a Certification of Material Compliance or an Acknowledgment of Noncompliance each year by April 15 regarding your compliance during the previous calendar year.
  • If you were materially compliant with all sections of the Cybersecurity Regulation that applied to you during the previous calendar year, submit a Certification of Material Compliance.
  • If you cannot certify that you were in material compliance with the sections of the Cybersecurity Regulation that were applicable to you during the prior calendar year, you must submit an Acknowledgment of Noncompliance which (1) acknowledges that you did not materially comply with all the requirements applicable to you; (2) identifies all applicable sections of the Cybersecurity Regulation that you have not materially complied with; (3) describes the nature and extent of the noncompliance; and (4) provides a remediation timeline or confirmation that remediation has been completed.
• Cybersecurity Incident Notifications – Notify DFS as promptly as possible but in no event later than 72 hours after you determine that a Cybersecurity Incident has occurred. A Cybersecurity Incident includes events that occurred at your business, any of your Affiliates, or a Third-Party Service Provider.
• Extortion Payment Notifications – If you make an extortion payment in connection with a Cybersecurity Event that occurred on your Information Systems, you must notify DFS within 24 hours of payment. Within 30 days of payment, you must provide the reasons payment was necessary and all diligence performed to find alternatives to payment. You must also describe the diligence you performed to ensure compliance with all applicable rules and regulations including those of the Office of Foreign Assets Control.

Visit the Cybersecurity Submissions page to learn more.

Submit a Notice of Compliance by April 15 Each Year.

If you materially complied with all of the sections of the Cybersecurity Regulation applicable to you during the previous calendar year, submit a Certification of Material Compliance by April 15 of each year. If not, submit an Acknowledgment of Noncompliance by April 15.

If you cannot certify that you were in material compliance with the Cybersecurity Regulation for the prior calendar year, you must submit an Acknowledgment of Noncompliance which:

1. acknowledges that you did not materially comply with all the requirements applicable to you;
2. identifies all applicable sections of the Cybersecurity Regulation that you have not materially complied with;
3. describes the nature and extent of such noncompliance; and
4. provides a remediation timeline or confirmation that remediation has been completed.

• Department of Homeland Security, Cybersecurity and Infrastructure Agency (CISA)
• Small Business Administration (SBA)
• Cyber Readiness Institute
• Global Cyber Alliance (GCA) Cybersecurity Toolkits

Check our Cybersecurity FAQs. If you still have questions regarding the Cybersecurity Regulation or compliance with Part 500, email [email protected].