Cybersecurity Policy Report, NYDFS flags recurring gaps in cybersecurity risk assessments, (Sep 11, 2026)
Covered entities must revisit assessments at least annually and whenever business or technology changes materially alter their cyber risk, according to newly issued cybersecurity guidance.
The New York State Department of Financial Services (NYDFS) has issued guidance clarifying how entities subject to the agency’s Cybersecurity Regulation should design, conduct, document, update, and use cybersecurity risk assessments (New York State Department of Financial Services, Industry Letter, Sept. 10, 2026). According to the NYDFS, the guidance does not create any new obligations but, instead, focuses on recurring deficiencies identified during examinations and investigations and on whether an entity can demonstrate that assessed risks informed control selection, compensating controls, and risk-acceptance decisions.
The NYDFS Cybersecurity Regulation, commonly referred to as Part 500, requires covered entities to maintain cybersecurity programs based on their risk assessments. Written policies and procedures must set criteria for evaluating and categorizing risks, assessing the confidentiality, integrity, security, and availability of information systems and nonpublic information, and explaining how the cybersecurity program addresses identified risks. NYDFS said the assessment must support decisions about controls and accepted risk, while retained documentation must show how risks were identified, assessed, and addressed, including the methodology, data, conclusions, and management rationale, with a risk register or comparable mechanism tracking results, remediation, and changes in residual risk and with accepted risks supported by a documented justification.
The guidance noted that a particular assessment methodology is not mandated. Accordingly, an entity may align its process with a recognized framework, although the approach should fit the entity’s business model, technology environment, and risk profile. However, NYDFS favors a clear, repeatable process with consistent likelihood and impact criteria so results can be compared over time. In addition, the scope should reflect the entity’s size, complexity, activities, and technology, with a current asset inventory as a foundation and consideration of emerging, third-party, interdependency, concentration, and single-point-of-failure risks, including third-party exposure assessed by service criticality, data sensitivity, connectivity, and disruption impact.
Recurring gaps. Examination and investigation reviews have exposed five recurring weaknesses, NYDFS said. Some assessments rely on incomplete asset inventories or omit nonpublic-information flows, critical processes, cloud environments, third parties, or other dependencies. Others use inconsistent methods that do not reliably identify, prioritize, document, or distinguish inherent and residual risk. NYDFS also found assessments that overlook emerging threats, interdependencies, concentration risk, and single points of failure.
Governance failures included unassigned ownership, undocumented response decisions, weak integration into enterprise processes, and no update after a material change. In other cases, policies, controls, and resource decisions could not be tied to identified cyber risks. The guidance’s documentation standard therefore emphasizes traceability: entities should be able to connect risks to controls, compensating measures, remediation, and decisions to accept residual risk.
Assessment results must inform the design, implementation, and updating of cybersecurity policies, procedures, controls, and testing plans. Where applicable, a chief information security officer or senior officer must oversee the process, with input from relevant business, operations, compliance, legal, and other stakeholders. Results should reach senior management and, when appropriate, the senior governing body. However, Part 500 does not require formal board or senior-management approval of the assessment, NYDFS said.
NYDFS urged covered entities to confirm that the right personnel participate, the scope and methodology fit the entity’s size and risk, and assessments respond to material changes in operations, technology, systems, data handling, third-party relationships, threats, and vulnerabilities, including after major system migrations, mergers or acquisitions, significant outsourcing, changed threat-actor capabilities, or adoption of emerging technologies. The agency emphasized that dynamic, regularly refreshed assessments better support Part 500 compliance and operational resilience.
RegulatoryActivity: BankingOperations CyberPrivacyFeed DataPrivacy DataSecurity NewYorkNews Privacy StateBankingLaws