Skip to content

NYDFS Cybersecurity Regulation

The New York Department of Financial Services (NYDFS) Cybersecurity Requirements for Financial Services Companies, codified as 23 NYCRR 500, establishes cybersecurity requirements for financial institutions operating in New York State. Effective since March 2017, this regulation mandates specific cybersecurity programs, policies, and controls including risk assessments, penetration testing, and incident response plans. It applies to all banks, insurance companies, and other financial services institutions licensed to operate in New York.

Terraform Registry Subdomain: nydfs23

module "..." {
  source  = "nydfs23.compliance.tf/terraform-aws-modules/<module>/aws"
  version = "<version>"
}

module "..." {
  source = "https://nydfs23.compliance.tf/terraform-aws-modules/<module>/aws"
}

Refer to the Terraform Registry Endpoints section for more details.

Implemented Controls

The following controls are implemented as part of this framework.

Enable/Disable Controls

You can customize the Terraform module for the desired compliance requirements by enabling/disabling individual controls.

Examples

S3 bucket module with NYDFS Cybersecurity Regulation compliance framework controls enabled, and a couple of controls disabled

module "..." {
  source = "https://nydfs23.compliance.tf/terraform-aws-modules/s3-bucket/aws?disable=apigateway_rest_api_stage_use_ssl_certificate,apigateway_stage_cache_encryption_at_rest_enabled"
}