New York Issues Guidance on Cybersecurity Risk Assessments

On September 10, 2026, the New York State Department of Financial Services (NYDFS) issued an industry letter (the “Guidance”) setting out its expectations for how regulated entities should conduct and use cybersecurity risk assessments under its Cybersecurity Regulation, 23 NYCRR Part 500 (the “NYDFS Cybersecurity Regulation”). NYDFS states that the Guidance creates no new obligations; in practice, however, it indicates what examiners will look for when reviewing covered entities’ risk assessments and use of those assessments, and it catalogs gaps NYDFS has identified in examinations and investigations.

‍

The central message is that a risk assessment can no longer be a standalone annual document, but rather a living tool influencing operations. NYDFS expects each covered entity to be able to demonstrate how its risk assessment drove its controls, compensating controls, and risk-acceptance decisions. In short, it is not enough for risk assessments to exist; they have to function in a covered entity’s cybersecurity program.

‍

What Does the NYDFS Cybersecurity Regulation Require of a Risk Assessment?

The NYDFS Cybersecurity Regulation applies to any person operating under a license, registration, charter, or similar authorization under New York’s Banking Law, Insurance Law, or Financial Services Law (each, a “Covered Entity”). These include banks, insurers, insurance agencies and brokers, mortgage companies, money transmitters, and virtual currency businesses, among them many fintech and crypto companies headquartered outside New York.

‍

Subject to applicable exemptions, each Covered Entity must base its cybersecurity program on a risk assessment that is sufficient to inform the program’s design. The risk assessment must be reviewed and updated at least annually, as well as whenever a change in the business or technology causes a material change to the entity’s cyber risk. It must also follow written policies and procedures that set out:

1. 1. criteria for evaluating and categorizing identified cybersecurity risks or threats;
2. 2. criteria for assessing the confidentiality, integrity, security, and availability of information systems and nonpublic information (NPI), including the adequacy of existing controls; and
3. 3. requirements describing how the cybersecurity program addresses the identified risks.

‍

Why NYDFS Issued the Guidance: Five Common Gaps in Risk Assessments

NYDFS reviews risk assessments during examinations and investigations, and the Guidance indicates that it has identified recurring weaknesses in risk assessments, including five that have contributed to deficient cybersecurity programs:

‍

• - Incomplete scope of assets: Outdated asset inventories; no map of where NPI flows or resides; and failure to include third-party providers, cloud environments, or critical business processes.
• - Weak methodology of risk evaluation: Inconsistent identification and prioritization of risks, no evaluation of existing risk-control effectiveness, and no distinction between inherent and residual risks.
• - Static views of risk: Failure to account for emerging technologies, concentration risk, interconnected risks, and single points of failure.
• - Poor governance and risk management: No assigned risk owners, undocumented risk-response decisions, and failure to update risk assessments after material changes.
• - Lack of connection to cybersecurity program: Policies, controls, and budgets that cannot be traced back to identified risks.

‍

What NYDFS Expects: Five Pillars of the Guidance

The Guidance is organized around five elements of an effective risk assessment. Some restate the NYDFS Cybersecurity Regulation’s requirements; others describe best practices NYDFS has observed in more mature programs.

‍

1. Governance and oversight

Where applicable, Covered Entities must designate a Chief Information Security Officer (“CISO”) or a senior officer to oversee the risk assessment process, and the written policies and procedures governing it must be approved at least annually by a senior officer or the senior governing body. NYDFS also expects input from business units, operations, compliance, and legal, not just IT and security, making cybersecurity compliance a holistic corporate endeavor. The NYDFS Cybersecurity Regulation does not require the board or senior management to formally approve risk assessments. However, NYDFS links the assessment to the CISO’s duty to report material risks to the senior governing body and to that body’s duty to confirm that management has allocated sufficient cybersecurity resources, making communication of assessment results to leadership an important governance practice.

‍

2. A defined, repeatable methodology

NYDFS does not mandate a particular framework for performing risk assessments. Although NYDFS points to NIST’s Cybersecurity Framework 2.0, the Cyber Risk Institute Profile, and ISO 27005 as common choices, it warns that a framework must be tailored to the assessing entity’s business. At a minimum, risk assessment methodology should estimate the likelihood and impact of risks and apply consistent rating criteria so that results can be compared over time. NYDFS also observes that mature programs apply the same criteria across vendor management, IT operations, and business continuity planning.

‍

3. Scope and coverage

NYDFS expects effective risk assessments to cover four areas:

‍

• - All assets that could affect information systems, including hardware, software, infrastructure, people, processes, and data, using the required asset inventory as a foundational input and considering where NPI resides and how it flows.
• - Emerging risks, including AI adoption, quantum computing’s potential effect on encryption, software supply chain attacks, evolving ransomware, and geopolitically driven nation-state activity.
• - Third-party and supply chain risk, which should be assessed across affiliates, unaffiliated third-party service providers, and other supply-chain dependencies based on the criticality of the service provided, the sensitivity of the data accessed or maintained, the level of system connectivity, and the operational impact of a provider incident.
• - Concentration risk, because vendors or platforms that look low-risk individually can create significant risk when several critical functions depend on the same cloud provider, managed service provider, or software platform. NYDFS expects Covered Entities to identify single points of failure, where one incident or outage could cause entity-wide disruption or data risk.

‍

4. Documentation and traceability

In what is likely the most operationally demanding part of the Guidance, NYDFS advises that Covered Entities must keep documentation sufficient to show how risks were identified, assessed, and addressed. NYDFS describes effective documentation as linking each identified risk to the specific control or compensating measure that addresses it, and documenting the justification whenever management accepts a risk. NYDFS also recommends a risk register or comparable tool to track results, remediation, and changes in residual risk over time.

‍

5. Integration and updates

Risk assessment results must inform the design of, and updates to, policies, procedures, controls, and testing plans. NYDFS gives examples of changes that may be “material” and trigger an off-cycle update, including:

• - major system migrations; 
• - mergers or acquisitions; 
• - significant outsourcing arrangements; 
• - changes in threat actor capabilities;
• - adoption of emerging technologies; and
• - significant developments in cybersecurity technology (including frontier AI models). 

‍

NYDFS adds that entities should also consider an update when critical vulnerabilities are actively exploited or when geopolitical events raise the risk of ideologically motivated attacks.

‍

Practical Impact on Risk Assessment Evaluations

Although NYDFS frames the Guidance as clarification, Covered Entities should treat it as a practical examination benchmark, not as optional reading. Three themes stand out.

‍

- First, the Guidance supplies important details about what is required of risk assessments. The NYDFS Cybersecurity Regulation requires a cybersecurity program “based on” the risk assessment, but the regulation itself does not describe in detail what an adequate assessment looks like. The Guidance supplies that detail. Covered Entities should expect examiners to use the Guidance’s list of common gaps when evaluating compliance.

- Second, risk assessments are clearly more than paperwork; they must drive operational decision-making. NYDFS expects entities to demonstrate how risk assessments drive their controls and risk-acceptance decisions. In practice, examiners are likely to want evidence of decisions, not just a written policy and a report. This echoes the trend we have seen in California privacy enforcement, where regulators judge compliance by how it works in practice rather than by what internal policy paperwork says.  The Guidance’s focus on risks across third-party vendors also underscores the need to connect third-party risk management to the risk assessment.

- Third, AI is now squarely a risk assessment issue. The Guidance follows NYDFS’s two May 21, 2026, industry letters on the heightened cybersecurity threat environment and risks arising from frontier AI models, expressly naming frontier AI developments as a potential material-change trigger that could require an updated risk assessment.

‍

Implications for Fintech and Cross-Border Businesses

The NYDFS Cybersecurity Regulation is not limited to New York-headquartered banks and insurers. Fintech lenders, money transmitters, and virtual currency businesses licensed by NYDFS are Covered Entities wherever they are based. For these businesses, three points deserve particular attention:

‍

• - Affiliates and offshore operations count. The Guidance expressly includes affiliates in third-party risk evaluation. Groups that run technology, development, or support functions through affiliates or vendors in Latin America or elsewhere should make sure those relationships appear in the New York entity’s assessment.
• - Deals trigger reassessment. Mergers and acquisitions are a named example of a potential material change. Acquirers of NYDFS-licensed targets should build a post-closing risk assessment update into integration planning rather than waiting for the next annual cycle.
• - Shared platforms create concentration risk. Early-stage and high-growth companies often run critical functions on a small number of cloud, identity, and custody providers. That efficiency is exactly the single-point-of-failure profile NYDFS now expects entities to identify and document.

‍

Looking Ahead

NYDFS has made clear that it will review risk assessments against this Guidance in examinations and investigations. Covered Entities that treat the assessment as a living decision-making tool will be better positioned for those reviews and for annual certification of compliance. PAG Law’s Data Privacy, Cybersecurity & AI Governance practice advises financial services, fintech, and digital asset companies on compliance with the NYDFS Cybersecurity Regulation, including assistance with risk assessment design and cybersecurity compliance programs, data mapping, documentation and recordkeeping, transaction-related compliance reviews, and cross-border vendor and affiliate arrangements. We are ready to help your team meet regulatory expectations and close any gaps before an examiner finds them.

‍

^{Zachary Soto is a Partner at PAG Law PLLC, where he chairs the Privacy Law, Cybersecurity, and AI Governance practice. He has practiced privacy, cybersecurity, and corporate transactional law for over 16 years and is certified by the International Association of Privacy Professionals as a Certified Information Privacy Professional (CIPP/US) and AI Governance Professional (AIGP).}

‍

^{Disclaimer: This publication is provided by PAG Law PLLC for general informational purposes only and does not constitute legal advice or create an attorney-client relationship between PAG Law and the reader. The content reflects the views of the author as of the date of publication and may not reflect subsequent developments in law, regulation, or policy. Readers should not act or refrain from acting on the basis of any information contained herein without seeking professional legal counsel tailored to their specific circumstances and jurisdiction. PAG Law expressly disclaims all liability with respect to actions taken or not taken based on any or all of the contents of this publication. This material may be considered attorney advertising in some jurisdictions.}

‍