NYDFS Part 500: Training deadlines and documentation requirements

New York's Department of Financial Services issued cybersecurity regulation 23 NYCRR Part 500 in 2017, and the amended version took effect in 2023. Among its requirements is a clear mandate for annual security awareness training. If your organization is covered by Part 500, you must train your personnel and you must document it. Here is what you need to know.

Who is covered by Part 500

The regulation applies to any person or entity operating under a license, registration, or charter from the New York Department of Financial Services. This includes banks, insurance companies, money transmitters, mortgage brokers, and other financial services providers. If you are not sure whether you are covered, consult your legal counsel or compliance officer. The penalties for non-compliance are substantial.

What the regulation requires

Section 500.14(a) of the regulation states that covered entities must "provide regular cybersecurity awareness training for all personnel." The regulation defines "regular" as at least annually and requires that the training be updated to reflect risks identified by the entity's risk assessment. The training must also be provided to new personnel within a reasonable time after their hire.

What the training must cover

While the regulation does not specify a detailed curriculum, the DFS has provided guidance on expected topics. Training should address: the entity's cybersecurity policies and procedures; the risks to the entity's information systems and nonpublic information; social engineering and phishing awareness; incident detection and reporting; and the employee's role in maintaining security. The training should be appropriate to the employee's role and responsibilities.

Documentation requirements

Part 500 requires covered entities to maintain records of their cybersecurity program, including training. Documentation should include: the training curriculum or materials; dates when training was provided; a roster of personnel who completed training; evidence of completion, such as certificates or signed acknowledgments; and records of any remedial training provided. These records must be available for DFS examination.

What happens during a DFS examination

The DFS conducts periodic examinations of covered entities' cybersecurity programs. During an examination, the DFS will review the entity's cybersecurity policies, risk assessments, incident response plans, and training records. Inadequate training documentation is a common finding and can result in enforcement action. The DFS has imposed significant penalties on entities that failed to maintain adequate cybersecurity controls.

How to satisfy the requirement

The most practical approach is to implement a standardized, documented training program that covers all required topics, delivers training to every covered employee annually, and produces completion records and certificates. The program should be reviewed and updated at least annually to reflect current risks. A training platform that automates enrollment, delivery, and documentation makes this straightforward and audit-ready.