NYDFS Sets Important Expectations For Part 500 Risk Assessments

New NYDFS guidance identifies common gaps in Part 500 risk assessments and signals how the Department will evaluate them in examinations and investigations. On September 10, 2026, the New York State Department of Financial Services (NYDFS) issued an Industry Letter providing guidance on how covered entities should design, conduct, and use the risk assessments required by Section 500.9 of its cybersecurity regulation, 23 NYCRR Part 500 (Part 500). The Industry Letter is addressed to all NYDFS-regulated entities and states that it “does not create new obligations.” Although Part 500 requires that a covered entity’s cybersecurity program be “based on” its risk assessment, the regulation does not describe what an adequate risk assessment looks like. In the Second Amendment rulemaking, NYDFS declined to add that detail, removing proposed language that would have required risk assessments to consider the specific circumstances of the covered entity. Based on its examinations,…