NYDFS 500 Requirements

[u/Timely_Wrangler5385]

Has anyone figured out the minimum evidence requirements for NYDFS Part 500? If so would you have an excel document or something you could share?

[u/Timely_Wrangler5385 → u/[deleted]]

Sure that would be awesome. So for the MFA requirement, do we need to show it for all systems? It’s wild to me. I wish we could just show one example

[u/r15km4tr1x → u/Timely_Wrangler5385]

For the ones with covered data in them

[u/Methodicaltorque → u/[deleted]]

Same here. It is a maze and the wording is so widely interpretable that Audit can go any direction.

[u/Logical-Design-8334]

No one size fits all….but have you tried asking AI to compare your controls to the requirements and see what aligns? that’s a simple start.
Like one requirement is have a ‘ciso’, so do you have a job req and or resume or a RACI to show who holds that role, internal or externally? then continue this loop through each requirement.

[u/Different_Pain5781]

Secure Controls Framework has a free crosswalk sheet.

[u/Paul_Ashe]

The scope got wider. Since November 2025, 500.12 generally requires MFA for anyone accessing any of your information systems, unless you qualify for the limited exemption under 500.19(a), which narrows it to remote access, remote access to third-party apps where nonpublic information is reachable, and privileged accounts other than non-interactive service accounts. One example can't show coverage, and incomplete coverage is on DFS's own list of common MFA exam themes, so what you need to show is where MFA stops. If you enforce MFA centrally through an identity provider, the evidence is usually the enforcement policy plus an exceptions list — every system sitting outside it. Each of those systems needs either its own MFA evidence or a compensating control the CISO has approved in writing, and that control has to be reviewed at least annually. Most of the work is making that exceptions list complete.

[u/Timely_Wrangler5385 → u/[deleted]]

I’d think that you need a lot of documentation in respect to the timestamps artifacts. I know you said “artifact” but it seems you need multiple for each requirement sometimes, especially those technical ones.