NYDFS Cybersecurity Regulation: The 2023 Amendments and What They Require of Leadership

The November 2023 amendments to New York's cybersecurity regulation for financial services—23 NYCRR 500—place direct accountability for cybersecurity outcomes on boards and senior executives. These changes are not technical adjustments. They establish governance obligations, access control requirements, and third-party oversight standards that require executive ownership, not just technical implementation.

For financial institutions operating in or serving New York, the regulation creates a specific problem: leadership is now accountable for a security outcome without a clear owner, sequence, or way of measuring progress. The compliance deadline has passed for many provisions, and organizations that lack executive-level cybersecurity leadership face a gap between regulatory expectation and operational reality.

What the Regulation Is and Who It Affects

23 NYCRR 500 is the cybersecurity regulation issued by the New York State Department of Financial Services. It applies to banks, insurance companies, and other entities licensed or required to operate under New York banking or insurance law. The November 2023 amendments expanded requirements across governance, access controls, incident response, and third-party risk management.

The regulation applies regardless of where the covered entity is headquartered. If you are licensed to do business in New York as a financial institution, you are subject to 23 NYCRR 500.

Why the 2023 Amendments Matter to the Business

The amendments shift responsibility from technical teams to the board and senior executives. Compliance is no longer a matter of implementing tools or controls. It requires documented risk decisions, board-level oversight, and accountability for outcomes.

The consequences of non-compliance are regulatory: enforcement actions, consent orders, fines, and reputational damage. The New York Department of Financial Services has enforcement authority and has used it. More important, the regulation requires written certification by senior executives, creating personal accountability for the adequacy of the organization's cybersecurity program.

Organizations that treat this as a technical compliance exercise miss the point. The regulation requires governance: someone accountable for strategy, risk decisions, and reporting to the board. Many organizations have technology teams but no executive owner for cybersecurity outcomes.

What the 2023 Amendments Require

The amendments address governance, access controls, incident response, and third-party risk. Each area requires executive decision-making, not just technical implementation.

Governance and Oversight

The board of directors or equivalent governing body must receive regular reports on cybersecurity, including material cybersecurity risks and the status of the cybersecurity program. Senior leadership must approve the cybersecurity policy and the cybersecurity program annually.

This means someone must be able to explain to the board what the organization's cybersecurity risks are, what decisions have been made about those risks, and whether the program is adequate. That explanation must be credible, documented, and defensible.

Access Controls and Privileged Access

The amendments require multi-factor authentication for privileged accounts and for remote access to the organization's network. Organizations must limit access to nonpublic information based on business need. Periodic reviews of user access rights are required.

These are technical controls, but the decision about what constitutes adequate access control is a risk decision. Leadership must determine what level of access is appropriate, how exceptions are handled, and how compliance is measured.

Third-Party Service Provider Risk Management

The regulation requires covered entities to maintain a written policy for third-party service providers. That policy must address due diligence, minimum cybersecurity practices, and periodic assessment of service providers based on risk.

Organizations must identify and assess the cybersecurity risks associated with each third-party service provider that has access to nonpublic information or that performs services critical to the organization's operations. This is not a vendor management spreadsheet. It is a risk assessment process that requires judgment and executive oversight.

Incident Response and Notification

The amendments require a documented incident response plan and require notification to the Department of Financial Services within 72 hours of a cybersecurity event that meets certain criteria. The organization must determine whether an event is reportable, which requires someone who understands both the technical facts and the regulatory standard.

Incident response is not solely a technical function. It requires coordination between legal, compliance, communications, and technology teams, with clear executive ownership of the decision-making process.

Who Is Accountable and What Adequate Ownership Looks Like

The regulation requires the board or equivalent governing body to exercise oversight. Senior leadership—typically the Chief Executive Officer or equivalent—must approve the cybersecurity program and certify compliance annually.

Many organizations assign a Chief Information Security Officer (CISO) or equivalent. The regulation requires the CISO to report to the board or a senior officer. The CISO is accountable for implementing the program, but the board and senior executives remain accountable for the adequacy of that program.

Adequate ownership means someone who can:

• Translate technical risk into business terms for the board and senior leadership
• Make or inform risk decisions about controls, exceptions, and risk acceptance
• Coordinate across legal, compliance, IT, and operations to ensure the program addresses regulatory requirements
• Report on the status and effectiveness of the program in a way that is credible to regulators
• Manage third-party risk and incident response with the authority to make binding decisions

This is an executive function. It cannot be delegated entirely to IT or to a managed service provider. Technology teams implement controls; they do not own the regulatory position or the risk decisions.

The Gap Many Organizations Face

The most common gap is the absence of an executive who owns cybersecurity as a risk and governance function. Organizations may have capable IT teams, external consultants, or managed service providers. These are necessary, but they do not fulfill the governance requirement.

Without executive ownership, organizations struggle to:

• Provide credible board reporting
• Make defensible risk decisions
• Coordinate third-party risk management
• Determine whether a cybersecurity event is reportable
• Certify compliance with confidence

The regulation does not require a full-time employee. It requires accountability, judgment, and the ability to make and defend risk decisions. This is the role that [virtual CISO (vCISO) leadership](/vciso/) is designed to fill: executive ownership of cybersecurity strategy, governance, and regulatory compliance without the cost or commitment of a full-time executive hire.

How This Relates to Regulatory and Framework Readiness

23 NYCRR 500 is one of several regulatory frameworks that impose cybersecurity governance requirements on financial institutions and other regulated entities. Other frameworks include SEC cybersecurity disclosure rules, the Gramm-Leach-Bliley Act Safeguards Rule, and various state data protection laws.

Each regulation has specific requirements, but all share a common structure: they require governance, risk management, third-party oversight, and incident response. Organizations that build a governance foundation around one framework are better positioned to address others.

Regulatory and framework readiness means the organization has:

• Executive ownership of cybersecurity risk and compliance
• Documented policies and procedures that reflect actual practice
• A governance process for making and documenting risk decisions
• A third-party risk management process that scales with the organization
• Incident response capability with clear decision rights and notification procedures
• A reporting process that gives the board and senior leadership confidence in the adequacy of the program

This readiness cannot be purchased as a product. It is built through executive leadership, governance discipline, and the ability to translate regulatory requirements into operational practice.

What Leadership Should Do Next

If your organization is subject to 23 NYCRR 500, begin by determining whether you have adequate executive ownership of cybersecurity. Ask:

• Who is accountable for our cybersecurity program and regulatory compliance?
• Can that person credibly report to the board on our cybersecurity risks and the adequacy of our program?
• Do we have documented policies that reflect our actual practice?
• Can we demonstrate that access controls, third-party risk management, and incident response meet the regulatory standard?
• If we experienced a cybersecurity event today, do we know who would determine whether it is reportable and what our notification obligations are?

If the answer to any of these questions is unclear, you have a governance gap. The regulation does not allow that gap to remain open.

Closing the gap requires executive ownership. For many organizations, that means establishing [vCISO leadership](/vciso/): a fractional or interim executive who owns strategy, governance, risk decisions, regulatory positioning, and board reporting. This is not a consulting engagement. It is executive accountability.

Heights Consulting Group provides vCISO leadership to financial services organizations that need executive ownership of cybersecurity without a full-time hire. If you are subject to 23 NYCRR 500 and need to establish governance, clarify accountability, or prepare for board certification, a confidential consultation can help you determine the right approach for your organization.

Reach out when the question is no longer whether you need executive cybersecurity leadership, but how to establish it in a way that fits your organization.