NYDFS Cybersecurity Regulation

Best for: Any NYDFS-licensed entity: state-chartered banks, mortgage brokers, insurance companies, licensed lenders, and money transmitters. Section 500.19 exempts entities with fewer than 20 employees (including independent contractors), under $5 million in New York gross annual revenue in each of the last three fiscal years, or under $10 million in total assets. Third-party service providers face indirect requirements through Section 500.11. If NYDFS licenses your operations, you must comply.

Mandatory?Mandatory for NY-licensed financial services companies

Who validates?Annual self-certification to NYDFS Superintendent

RenewalAnnual certification

ScopeAll DFS-licensed financial services companies operating in New York

🏛 New York Department of Financial Services (NYDFS) · NYDFS 23 NYCRR 500 (2023 amendments) Official source →

Get Started

module "..." {
  source  = "nydfs23.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

What Compliance.tf Covers vs. What You Handle

What Compliance.tf automates
- Encryption at Rest: Checks encryption configuration on backup recovery points, API Gateway caches, CloudTrail logs, and CodeBuild artifacts. Each control confirms that KMS CMK or default encryption is active on the relevant resource.
- Encryption in Transit: Flags ACM certificates within 30 days of expiration and verifies that API Gateway stages enforce SSL certificates for backend integration. Surfaces TLS configuration gaps at the API layer before they become audit findings.
- Audit Logging and Trail Integrity: Verifies CloudTrail is enabled across all regions, S3 data events are captured, log file validation is active, and trails integrate with CloudWatch Logs. Also confirms logging is enabled on API Gateway and CodeBuild.
- Monitoring and Alerting: Checks that CloudWatch alarm actions are enabled and that log groups enforce a minimum 365-day retention period. Detects disabled alarms that would produce gaps in incident detection.
- Network Exposure and Access Controls: Confirms API Gateway stages are associated with WAF web ACLs, Auto Scaling launch configurations do not assign public IPs by default, and load-balanced Auto Scaling groups use health checks.
- Backup and Recovery: Validates that backup plans enforce a minimum 35-day retention period and that manual deletion of recovery points is disabled. Produces automated evidence of backup policy configuration for examiner review.
What you handle
- Encryption at Rest: Key rotation schedules, documented key management procedures per Section 500.15, and formal approval of any compensating controls where encryption cannot be applied.
- Encryption in Transit: Enforcing minimum TLS version policies (TLS 1.2 or higher per NYDFS guidance), managing certificate renewal workflows, and verifying encryption in transit for non-AWS services and internal traffic.
- Audit Logging and Trail Integrity: Determining which events qualify as material cybersecurity events under Section 500.06, configuring alerting on those events, and retaining audit trail records for the five-year period the regulation specifies.
- Monitoring and Alerting: Building and tuning alert rules for cybersecurity events, maintaining the incident response plan required by Section 500.16, and reporting qualifying events to NYDFS within 72 hours per Section 500.17(a).
- Network Exposure and Access Controls: Defining WAF rule sets appropriate to your threat profile, implementing the access privilege limitations under Section 500.07, and completing the access privilege reviews introduced by the 2023 amendment.
- Backup and Recovery: Regular recovery procedure testing, documented recovery time objectives, and the business continuity and disaster recovery plan now required under Section 500.16(c) of the 2023 amendment.

Controls by Category

Audit Trail (Section 500.06) (5 controls)

Section 500.06 requires audit trails sufficient to reconstruct material activity, including all financial transactions and privileged access events. Multi-region trail coverage, log file integrity validation, and centralized aggregation are table stakes. The recurring gap is log completeness: organizations capture management events but miss data-plane activity like S3 object access, and assessors know exactly where to look for it.

At least one enabled trail should be present in a region CloudTrail trails should be integrated with CloudWatch logs CloudTrail trail log file validation should be enabled API Gateway stage logging should be enabled CodeBuild projects should have logging enabled

Data Retention and Backup (Section 500.13) (1 control)

Assessors want to see two things here: backup policies with enforced minimum retention windows, and deletion protection settings that prevent recovery points from being manually removed. The latter matters for ransomware and insider threat scenarios, and NYDFS examiners treat it as a control in its own right. Documented procedures for periodic data disposal round out the evidence package for Section 500.13.

Backup plan min frequency and min retention check

Encryption of Nonpublic Information (Section 500.15) (4 controls)

The most common finding under Section 500.15 is certificates that are expired or within days of expiry, which can force unencrypted fallback connections. Beyond certificates, assessors check that caches, backups, and log storage all use encryption with properly managed KMS keys. Where encryption is infeasible, expect to produce documented compensating controls; undocumented gaps are treated as failures.

API Gateway stage should uses SSL certificate API Gateway stage cache encryption at rest should be enabled CloudTrail trail logs should be encrypted with KMS CMK CodeBuild project artifact encryption should be enabled

Monitoring and Incident Detection (Section 500.05, 500.14) (2 controls)

The 2023 amendment significantly expanded Section 500.14, adding continuous monitoring or periodic vulnerability assessments and penetration testing as explicit requirements. Active, actionable alarms are checked alongside retention periods: Section 500.06(a)(2) sets a five-year retention requirement for audit trail records, so a 365-day log group retention period satisfies the automated check but almost certainly does not satisfy the regulation.

CloudWatch alarm action should be enabled

compliance.tf module Log group retention period should be at least 365 days