NY-DFS 23 NYCRR Part 500: MFA Compliance for Financial Services

Last updated on March 3, 2025

In the realm of financial services, cybersecurity is of paramount importance. Recognizing this, the Department of Financial Services enacted a regulation on March 1, 2017, known as 23 NYCRR Part 500 or the Cybersecurity Regulation. This regulation was specifically designed to safeguard the information systems of financial services companies and the nonpublic information stored on those systems.

As the cybersecurity landscape continues to evolve, so too must the regulations that govern it. In response to this ever-changing environment and the increasing sophistication of cyber threats, the Cybersecurity Regulation was amended. This amendment, which came into effect on November 1, 2023, significantly enhances the security measures that organizations are expected to implement, thereby bolstering their cyber resilience.

The Growing Importance of Identity Protection

The amended Part 500 places a strong emphasis on the protection of the identity attack surface. This focus is a direct response to the alarming rise in the use of compromised credentials for malicious access. As cybercriminals continue to exploit weak or stolen credentials to gain unauthorized access to systems, identity protection has emerged as a critical component of any robust cybersecurity strategy.

To address this issue, the amended Part 500 mandates the implementation of comprehensive Multi-Factor Authentication (MFA) and protection for privileged accounts. It also requires the adoption of best practices in the monitoring, detection, and response to cyber threats. These requirements underscore the importance of robust identity and access management in maintaining a strong cybersecurity posture.

500.12 Multi-Factor Authentication: A Closer Look

Section 500.12 of the regulation specifically addresses Multi-Factor Authentication (MFA). The definition of Multi-Factor Authentication can be found in Section 500.1 Definitions. The definition of MFA in NYCRR Part 500 is tantamount to generally agreed-upon definitions from other credible sources, such as NIST.

MFA is a security measure that requires users to provide two or more authentication factors to gain access to a resource such as an application, online account, or a VPN. By requiring multiple forms of verification, MFA provides an additional layer of security that can protect against compromised credentials.

According to the NYCRR Part 500 regulation, MFA should be utilized for any individual accessing any information systems of a covered entity. The specific requirements are as follows:

• Remote Access: MFA should be utilized for any remote access to the covered entity’s information systems. This requirement recognizes the increased risk associated with remote access, which can often be exploited by cybercriminals to gain unauthorized access to systems.
• Third-Party Applications: MFA should be utilized for remote access to third-party applications, including but not limited to those that are cloud-based, from which nonpublic information is accessible. This requirement highlights the potential security risks associated with third-party applications, which can often be a weak point in an organization’s security posture.
• Privileged Accounts: MFA should be utilized for all privileged accounts other than service accounts that prohibit interactive login. Privileged accounts often have access to sensitive information and systems, making them a prime target for cybercriminals. By requiring MFA for these accounts, the regulation aims to provide an additional layer of security.

Cybersecurity Program

The regulation requires each covered entity to maintain a cybersecurity program designed to protect the confidentiality, integrity, and availability of the covered entity’s information systems and nonpublic information stored on those information systems. The cybersecurity program should be based on the covered entity’s risk assessment and designed to perform core cybersecurity functions.

Risk Assessment

The risk assessment should be carried out in accordance with written policies and procedures and should be documented. Such policies and procedures should include criteria for the evaluation and categorization of identified cybersecurity risks or threats facing the covered entity, criteria for the assessment of the confidentiality, integrity, security, and availability of the covered entity’s information systems and nonpublic information, and requirements describing how identified risks will be mitigated or accepted based on the risk assessment.

Cybersecurity Policy

Each covered entity is required to implement and maintain a written policy or policies, approved at least annually by a senior officer or the covered entity’s senior governing body for the protection of its information systems and nonpublic information stored on those information systems. Procedures should be developed, documented, and implemented in accordance with the written policy or policies. The cybersecurity policy or policies and procedures should be based on the covered entity’s risk assessment and address, at a minimum, the following areas to the extent applicable to the covered entity’s operations.

Rublon MFA and Compliance with NY-DFS 23 NYCRR Part 500

Rublon MFA is a powerful tool that can help organizations comply with the NY-DFS 23 NYCRR Part 500 regulation. By enabling Rublon MFA for all users, organizations can meet the regulation’s requirements for Multi-Factor Authentication, thereby significantly enhancing their cybersecurity posture.

Rublon MFA provides an additional layer of security that protects against compromised credentials. It requires users to provide two or more verification factors to gain access to a resource, making it much more difficult for cybercriminals to gain unauthorized access to systems.

Furthermore, Rublon MFA can be utilized for any individual accessing any information systems of a covered entity, including remote access and third-party applications. It can also be utilized for all privileged accounts, providing an additional layer of security for these high-risk accounts.

By implementing Rublon MFA, organizations can not only comply with the NY-DFS 23 NYCRR Part 500 regulation but also significantly enhance their overall cybersecurity. To see how Rublon MFA can benefit your organization, start your Free Rublon Trial today.

NY-DFS 23 NYCRR Part 500 vs. Rublon MFA – Compliance Table

NYCRR Part 500 Cybersecurity Regulation	Rublon MFA Compliance
Effective Controls: Each Covered Entity should use effective controls, such as Multi-Factor Authentication or Risk-Based Authentication, based on its Risk Assessment. These controls are designed to safeguard against unauthorized access to Nonpublic Information or Information Systems, thereby protecting both the integrity of the systems and the confidentiality of the Nonpublic Information they contain.	Rublon MFA serves as an effective control by offering a robust Multi-Factor Authentication solution. It not only provides an additional layer of security for all users and resources but also extends its protection to a wide range of systems, including legacy applications, VPNs, cloud apps, Microsoft technologies like Remote Desktop Services or OWA and many more. Both on-premises and cloud, this comprehensive coverage ensures that all potential points of unauthorized access are secured.
Remote Access: Multi-Factor Authentication is required for any individual accessing the Covered Entity’s internal networks from an external network, unless approved otherwise in writing by the Covered Entity’s CISO. This requirement acknowledges the increased risk associated with remote access, which can often be exploited by cybercriminals to gain unauthorized access to systems.	Rublon MFA is designed to secure remote access to internal networks from an external network. It provides an additional layer of security for remote access via RDP, Remote Desktop web client, Remote Desktop Web Access, Remote Desktop Gateway, and other remote services and VPNs, thereby reducing the risk of unauthorized access. Furthermore, Rublon MFA’s flexibility allows it to be implemented across various industries, including financial services, making it a versatile solution for securing remote access and complying with cybersecurity regulations from the European Union and United States.
Third-Party Applications: Multi-Factor Authentication is required for remote access to third-party applications, including but not limited to those that are cloud-based. This requirement underscores the potential security risks associated with third-party applications, which can often be a weak point in an organization’s security posture, regardless of whether they are hosted on-premises or in the cloud.	Rublon MFA can be implemented for remote access to third-party applications, including cloud-based applications. Rublon MFA introduces strong MFA with Single Sign-On (SSO) capabilities to cloud apps using the SAML protocol.
Third-Party Service Provider: The Third Party Service Provider’s policies and procedures for access controls should include the use of Multi-Factor Authentication. This requirement extends to all third-party service providers, regardless of the nature of their service or the type of access they require, emphasizing the importance of strong access controls across all aspects of the Covered Entity’s operations.	Rublon MFA can be incorporated into the Third Party Service Provider’s policies and procedures for access controls. By requiring Rublon Multi-Factor Authentication for access to relevant Information Systems and Nonpublic Information, Rublon MFA can help ensure their security.
Privileged Accounts: Multi-Factor Authentication is required for all privileged accounts. This includes all accounts with elevated privileges, such as administrators or superusers, due to the increased risk associated with these accounts. By requiring MFA for these accounts, the regulation aims to provide an additional layer of security.	Rublon MFA can be implemented for all privileged accounts and administrator accounts. It provides an additional layer of security for these high-risk accounts, thereby reducing the risk of unauthorized actors accessing sensitive information. Rublon MFA’s ability to secure a wide range of account types, including administrator and superuser accounts, makes it a comprehensive solution for securing privileged accounts across various industries. Further, Rublon MFA’s robust access control via Application- and Group-Based Access Policies allows for granular control over your MFA settings, allowing you to tailor policies for specific applications and user groups. This is especially useful for organizations that need to implement more stringent authentication settings for specific user groups — such as employees with higher-level security privileges, IT admins, or high-risk accounts

Enhance Your Financial Security for 30 Days →

Conclusion

The NY-DFS 23 NYCRR Part 500 regulation provides a comprehensive framework for financial services companies to enhance their cybersecurity measures. The emphasis on Multi-Factor Authentication in the regulation highlights the importance of robust identity and access management in today’s cybersecurity landscape. By understanding and implementing these requirements, organizations can significantly improve their cyber resilience and protect their critical information systems and data.

In a world where cyber threats are constantly evolving, staying ahead of the curve is crucial. Regulations like NY-DFS 23 NYCRR Part 500 play a vital role in setting the standard for cybersecurity practices and ensuring that organizations are equipped to protect themselves against the ever-changing threat landscape. By focusing on areas like Multi-Factor Authentication, these regulations not only help to protect sensitive information but also contribute to the overall security and resilience of the financial sector.

In conclusion, the NY-DFS 23 NYCRR Part 500 regulation serves as a guiding light for financial services companies navigating the complex world of cybersecurity. By adhering to its requirements, organizations can not only protect their information systems and nonpublic information but also foster a culture of cybersecurity awareness and resilience.

NYCRR Part 500 FAQ

What are the consequences of non-compliance to NY-DFS 23 NYCRR Part 500?

Non-compliance to NY-DFS 23 NYCRR Part 500 can lead to substantial penalties. These penalties can encompass substantial fines and other disciplinary measures. The specific penalties are contingent on the nature and extent of the non-compliance. Depending on the nature of non-compliance, the penalty might range from a few thousand to a few dozen thousand dollars a day.

What other regulations are financial companies required to comply with?

Besides NY-DFS 23 NYCRR Part 500, financial companies are required to adhere to a range of other regulations. These include regulations supervised by the Federal Reserve Board (FRB), which oversees the commercial banking sector in the United States. Other regulatory bodies include the Office of the Comptroller of the Currency (OCC), which supervises, regulates, and provides charters to banks operating in the U.S. The aim of financial regulations is to prevent and investigate fraud, maintain efficient and transparent markets, and ensure customers and clients are treated with fairness and honesty. The more cybersecurity-related regulations include PCI DSS, PSD2, DORA, GLBA, The FTC Safeguards Rule, SOX Act, BSA, FFIEC IT Examination Handbook, NAIC, and more.

How does NY-DFS 23 NYCRR Part 500 relate to other cybersecurity regulations?

NY-DFS 23 NYCRR Part 500 is a set of regulations specific to the state of New York. Still, it shares common objectives with other cybersecurity regulations: to safeguard sensitive information and ensure the integrity of information systems. It complements other cybersecurity regulations by providing specific guidance for financial services companies.

What are the key requirements of NY-DFS 23 NYCRR Part 500?

NY-DFS 23 NYCRR Part 500 mandates several key requirements for financial services companies. These include the establishment of a cybersecurity program, the adoption of a written cybersecurity policy, the designation of a Chief Information Security Officer (CISO), and the implementation of an incident response plan. The regulation also requires regular cybersecurity training for all personnel, periodic risk assessments, and the implementation of Multi-Factor Authentication (MFA) or risk-based authentication to protect against unauthorized access to nonpublic information or information systems.

Who is required to comply with NY-DFS 23 NYCRR Part 500?

NY-DFS 23 NYCRR Part 500 applies to all entities operating under or required to operate under a license, registration, charter, certificate, permit, accreditation, or similar authorization under the Banking Law, the Insurance Law, or the Financial Services Law of New York. This includes banks, insurance companies, and other financial services institutions.

What is the timeline for compliance with NY-DFS 23 NYCRR Part 500?

The regulation has a phased implementation timeline, with different requirements becoming effective at different times. Companies are expected to comply with each requirement by its specified effective date. Covered entities have until April 29, 2024, to come into compliance with Part 500. Reporting requirements take effect on December 1, 2023.

How does NY-DFS 23 NYCRR Part 500 affect third-party service providers?

NY-DFS 23 NYCRR Part 500 requires covered entities to implement written policies and procedures designed to ensure the security of Information Systems and Nonpublic Information that are accessible to, or held by, third-party service providers. This includes due diligence processes and periodic assessment of such third parties.

Does NY-DFS 23 NYCRR Part 500 require MFA for public websites?

Generally, no. NY-DFS 23 NYCRR Part 500 mandates Multi-Factor Authentication (MFA) to protect nonpublic information and the information systems that store or process it. Public-facing websites or pages (such as a contact form) that do not provide access to sensitive data typically do not fall under the MFA requirement. However, if a public website includes an area where users can log in and access nonpublic information, then MFA would be required for that protected portion of the site.