On September 10, 2026, the New York State Department of Financial Services (DFS) released an industry letter laying out new guidance for cybersecurity risk assessments that are required of entities covered by the DFS’ Cybersecurity Regulation, commonly referred to as Part 500. DFS describes the guidance as clarifying existing obligations and promoting best practices, not as imposing new requirements.
Regulatory framework
Part 500 requires that the cybersecurity program of a covered entity (generally, a financial services entity doing business in New York) be built on risk assessments and designed to protect the confidentiality, integrity and availability of its information systems and nonpublic information. Risk assessments must be reviewed and updated at least annually or whenever a change in business or technology materially affects the entity’s cyber risk. Written policies should set criteria for evaluating and categorizing risk, for judging the adequacy of existing controls, and for describing how the cybersecurity program responds to what the assessment finds. DFS emphasizes that entities must be able to show how a risk assessment shaped their cybersecurity controls, compensating controls and risk-acceptance decisions.
Common gaps
Drawing on examinations, investigations and interviews with covered entity personnel, DFS points to five categories of recurring weakness that have led to deficient cybersecurity programs: (i) asset inventories that are outdated or fail to capture where nonpublic information resides or flows, including gaps around third-party providers and cloud environments; (ii) inconsistent methodologies that do not consistently identify, prioritize or document risks or distinguish between inherent and residual risks; (iii) failure to account for evolving and interconnected risks, such as emerging technology, concentration risk and single points of failure; (iv) governance insufficiencies, including unassigned ownership, undocumented risk decisions and risk assessments that are not refreshed after material changes; and (v) failure to account for or inform the cybersecurity program, resulting in policies, controls and resource decisions that are not demonstrably based on the covered entity’s identified cyber risks.
Best practices
After defining common gaps, DFS outlines five categories of best practices, summarized below, to ensure compliance with Part 500 and incorporate “dynamic, data-driven” risk assessments into a robust cybersecurity program:
- Governance: A CISO or senior officer should own the risk assessment process, with input from business, operations, compliance and legal stakeholders, and results should reach senior management and, as appropriate, the board.
- Methodology: Assessments should follow a consistent, repeatable approach with defined likelihood and impact ratings, informed by threat intelligence, incident data and prior findings. The guidance makes clear, however, that no specific framework is mandated, while noting that many covered entities align their methodologies with NIST’s Cybersecurity Framework 2.0, Cyber Risk Institute’s Profile v2.2 and ISO 27005:2022, Edition 4 (October 2022).
- Scope: Coverage should extend to the full asset inventory, third-party and supply-chain exposure, and interdependencies or concentration risk arising from shared vendors and infrastructure, as well as emerging risks such as AI adoption.
- Documentation: Entities should maintain traceable records linking each identified risk to a control or compensating measure, along with a risk register or similar mechanism for tracking remediation and residual risk.
- Integration and refresh: Assessment results must inform policies, controls and testing plans and be updated at least annually or sooner after events such as system migrations, M&A or significant developments in cybersecurity technologies (such as frontier AI models).
Takeaways
DFS concludes the industry letter by encouraging covered entities to review their risk assessments and risk assessment procedures in light of this guidance. Covered entities should treat the five areas of recurring weakness as a checklist for internal review (mindful that these might not be the only items DFS considers in its review of whether an entity is compliant), confirming ownership and reporting lines, testing whether the assessment methodology is consistent, verifying that asset inventory and third-party/vendor scope are up to date, and ensuring clear documentation linking risk assessments to subsequently implemented policies and controls.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
