NYDFS Issues Guidance on the Million Dollar Question—How to Conduct Cybersecurity Risk Assessments Under Part 500

In this entry for Alston & Bird’s Privacy, Cyber & Data Strategy blog, authors Kim Peretti, Lance Taubin, Ashley Miller & Jacqueline Moreira discuss the New York State Department of Financial Services’ (NYDFS) September 2026 guidance on conducting and using cybersecurity risk assessments under Part 500. The authors explain that risk assessments are central to the regulation and should demonstrate how identified risks inform cybersecurity controls, compensating controls, and risk acceptance decisions.

Drawing on past examinations and investigations, NYDFS identifies several recurring deficiencies, including incomplete asset inventories, inconsistent methodologies, failure to account for emerging and interconnected risks, inadequate governance, and weak integration between risk assessments and cybersecurity programs. The guidance organizes its expectations around governance and oversight, a defined methodology, scope and coverage, documentation and traceability, and ongoing integration and updates.

The authors highlight NYDFS’s emphasis on a documented, repeatable methodology that considers threat intelligence, vulnerabilities, third-party dependencies, natural disasters, and potential financial, operational, regulatory, and reputational impacts. The Department also recommends recognized frameworks such as NIST CSF 2.0, while urging organizations to assess all relevant assets, emerging threats, third-party relationships, and concentration risks.

Finally, the guidance stresses documentation, traceability, and continuous updating rather than treating risk assessments as annual compliance exercises. Covered entities should be able to connect identified risks to mitigation measures and management decisions and update assessments following material changes such as acquisitions, system migrations, outsourcing, new technologies, or evolving threats. The authors conclude that the guidance offers a detailed benchmark that is likely to shape future NYDFS examinations, investigations, and enforcement actions.

CONTINUE READING…