NYDFS compliance software for 23 NYCRR 500 certification at insurance agencies, brokers, lenders and money transmitters

NYDFS compliance software helps a company licensed by the New York Department of Financial Services run the cybersecurity program required by 23 NYCRR Part 500. It keeps the risk assessment, policies, access reviews, vendor oversight, training and testing dates in one dated record with owners, so the annual certification is backed by documentation the department can examine.

Any person operating under, or required to operate under, a license, registration, charter or similar authorization under New York's Banking Law, Insurance Law or Financial Services Law. That includes insurance agents and brokers, mortgage brokers and servicers, money transmitters, banks, insurers and many fintechs, even when another regulator also supervises them.

By April 15 every year, covering the prior calendar year. You file either a certification of material compliance or an acknowledgment of noncompliance, signed by the highest-ranking executive and the CISO, or the senior officer responsible for cybersecurity if there is no CISO. Supporting records must be kept for five years.

Under 500.19(a), a covered entity with fewer than 20 employees and independent contractors, less than $7.5 million in gross annual revenue in each of the last three fiscal years, or less than $15 million in year-end total assets, counting affiliates, is exempt from several sections. It still needs a program, policies, a risk assessment, access reviews, vendor oversight, MFA, an asset inventory, training and the annual filing.

Yes, if the agency or its producers hold a New York license. Most small agencies qualify for the limited exemption, which removes the CISO, penetration testing, audit trail and incident response plan sections, but not the risk assessment, access privilege review, vendor policy, MFA for remote and privileged access, asset inventory, training or the April 15 filing. Exempt entities must also file a notice of exemption within 30 days.

You file an acknowledgment of noncompliance instead. It must identify every section you did not materially comply with, describe the nature and extent of the gap, and give a remediation timeline or confirm remediation is complete. Filing an inaccurate certification is the worse outcome, so knowing your gaps early matters.

At least annually, and again whenever a change in the business or its technology causes a material change to cyber risk. It must follow written policies that set criteria for rating risks, for judging the adequacy of existing controls, and for deciding how each risk is mitigated or accepted.

Since November 1, 2025, yes for most covered entities: MFA is required for any individual accessing any information system. Entities with the limited exemption must use MFA for remote access to their systems, for remote access to third-party applications holding nonpublic information, and for all privileged accounts other than non-interactive service accounts.

Complies publishes $47, $119 and $299 a month billed yearly, with the risk register and vendor due diligence from $119. Secureframe publishes a starting price of $7,500 a year for one framework. RiskWatch, Isora GRC and Centraleyes are quote-only, and Vendr reports a Hyperproof median of $41,400 a year.

Yes. On Growth, SOC 2, ISO 27001, HIPAA, GDPR and PCI DSS run on one cross-mapped control set, and your Part 500 obligations sit alongside them. On Scale, Part 500 becomes its own framework. An access review or vendor review recorded once counts wherever it applies.