Last reviewed: October 27, 2026 · Reading time: 10 minutes · This article is general information, not legal advice.
The amended New York Department of Financial Services (NYDFS) cybersecurity regulation, 23 NYCRR Part 500, was phased in over two years. On November 1, 2025 the last of those phases took effect, so every requirement is now enforceable. For banks, insurers, insurance agencies, money transmitters and other DFS-licensed businesses in New York, the grace period is over.
This article focuses on the parts of Part 500 that touch backup and recovery most directly, and on what recent enforcement actions tell us about where examiners are looking.
- Since November 1, 2025, expanded MFA (500.12) and a detailed asset inventory (500.13) are mandatory, alongside the earlier phases covering governance, encryption, and business continuity and disaster recovery planning.
- DFS has issued several cybersecurity penalties since 2025, from $250,000 to $2.25 million, citing missing MFA, weak risk assessments, poor data disposal and late incident notification.
- Covered entities must still report qualifying cybersecurity events to DFS within 72 hours.
- Tested, isolated backups help you meet the continuity and recovery requirements and reduce the chance that an incident turns into a reportable, penalty-bearing event.
What the final phase added
According to a Mondaq analysis of the final compliance phase, the November 2025 milestone brought these requirements fully into force:
| Section | Requirement | What an examiner will want to see |
|---|---|---|
| 500.12 Multi-factor authentication | MFA for any individual accessing any of the firm’s information systems, with exceptions only where the CISO approves documented compensating controls | MFA enforcement reports, conditional access policies, a written list of approved exceptions |
| 500.13 Asset inventory | A maintained inventory recording each asset’s owner, location, classification or sensitivity, support expiration date and recovery time objective | A current inventory with RTOs populated, and evidence it is reviewed |
| 500.5 Vulnerability management | Automated scans and manual review, with remediation prioritized by risk | Scan results, remediation tickets and timelines |
| 500.7 Access privileges | Annual access reviews, least privilege, prompt removal of leavers; privileged access management for larger (Class A) companies | Review sign-offs and deprovisioning records |
| 500.14 Monitoring and training | Activity logging, malware filtering and annual social-engineering training; endpoint detection and centralized logging for Class A companies | Training records, logging configuration, alerts |
Notice that the asset inventory now has to record a recovery time objective for each asset. That is a direct link between compliance and disaster recovery: you can’t write down an RTO you have never tested. If you need a refresher on setting realistic targets, read our guide to RTO and RPO for New York SMBs.
What recent enforcement tells us
DFS consent orders are the clearest signal of examiner priorities. Four recent examples:
| Firm | Announced | Penalty | Failures cited by DFS |
|---|---|---|---|
| PayPal | January 23, 2025 | $2,000,000 | Inadequate policies, insufficiently trained cybersecurity staff, and failure to require MFA (500.3, 500.10, 500.12) |
| Healthplex | August 14, 2025 | $2,000,000 | No MFA on Office 365 web access, no data disposal policy for Office 365, late notification to DFS, inaccurate compliance certifications |
| Delta Dental of New York | April 29, 2026 | $2,250,000 | Weak data disposal policies, insufficient incident response plans, notice to DFS outside the 72-hour window |
| Order Express | 2026 | $250,000 | Risk assessment didn’t address company-specific cyber risk; patching policy covered too few third-party applications. Exposed by a 2022 ransomware attack |
Three patterns stand out. First, MFA gaps keep appearing, often in Microsoft 365 web access. Second, late notification is treated as a violation in its own right, separate from the breach. Third, a ransomware incident tends to bring the rest of the programme under the microscope: Order Express was penalized years after its attack for weaknesses the investigation exposed.
Where backup and disaster recovery fit
Part 500 requires covered entities to maintain incident response and business continuity and disaster recovery plans, and to keep backups protected from unauthorised alteration or destruction. In practice that means:
- Backups the attacker can’t reach. Immutable or air-gapped copies, held outside your production credentials. See our breakdown of immutable vs traditional backups.
- Recovery objectives that match the inventory. If your asset inventory says a system has a four-hour RTO, your DR design and your last test should prove it.
- Tested plans with evidence. Examiners expect documentation: test dates, results, issues found and fixed.
- Fast, informed incident response. Knowing within hours what was affected, and that clean recovery points exist, is what makes a 72-hour notification realistic.
A 30-day action plan
- Pull an MFA coverage report for Microsoft 365, VPN, remote access and admin accounts. Close gaps or document CISO-approved compensating controls.
- Add an RTO and owner to every asset in your inventory, starting with systems holding nonpublic information.
- Confirm at least one backup copy is immutable and isolated from your production identity. Our ransomware protection service is built around this.
- Run a recovery test for your most critical system and record the actual time to restore.
- Rehearse the 72-hour notification decision with your incident response team and counsel.
Get an independent view before your next exam
Ron Klink will review your Microsoft 365 security, backup isolation and recovery evidence against what DFS examiners ask for.
Sources
- Mondaq, Are you ready? New York DFS cybersecurity regulation approaches its final compliance phase, 2025.
- Frankfurt Kurnit Klein & Selz, NYDFS imposes $2 million fine on PayPal, January 2025.
- Legal 500, Three key takeaways from the NY DFS Healthplex settlement, 2025.
- Phoenix Strategy Group, NYDFS enforces $2.25 million settlement, 2026.
- AccountsRecovery.net, NYDFS fines money transmitter $250K, August 2026.
