On September 10, the NYDFS issued guidance on how entities subject to its Cybersecurity Regulation, 23 NYCRR Part 500, should conduct and use required cybersecurity risk assessments. The guidance does not create new obligations but clarifies existing requirements and identifies best practices based on common gaps the Department has observed during examinations and investigations.
Under Part 500, covered entities must conduct risk assessments sufficient to inform their cybersecurity programs and must carry out those assessments in accordance with written policies and procedures that include criteria for evaluating and categorizing risks, assessing the adequacy of existing controls, and describing how identified risks are addressed. Risk assessments must be reviewed and updated at least annually and whenever material changes to the entity’s business or technology affect cyber risk. The guidance identifies several areas that covered entities should address:
- Emphasizes governance and oversight. Covered entities must designate a CISO or Senior Officer to oversee the risk assessment process, involve personnel across cybersecurity, business, operations, compliance, and legal functions, and communicate material cybersecurity risks to senior management and, where appropriate, the senior governing body.
- Calls for a defined and repeatable methodology. Risk assessments should incorporate multiple inputs, including threat intelligence, incident trend analysis, vulnerability scans, penetration testing, and audit findings, and should consistently identify, analyze, prioritize, and document cybersecurity risks.The guidance calls for evaluating both external and internal threats and applying consistent rating criteria to ensure results are measurable and comparable over time.
- Addresses scope and interconnected risks. Risk assessments should cover all assets based on a comprehensive asset inventory, including hardware, software, infrastructure, and data.The guidance calls for evaluating emerging risks such as the adoption of artificial intelligence and advances in quantum computing, assessing third-party and supply chain risk based on the criticality of services and sensitivity of information, and identifying concentration risk and single points of failure across shared systems, platforms, and vendors.
- Requires documentation and ongoing updates. Covered entities should maintain documentation linking each identified risk to the specific controls or compensating measures implemented to address it, including justifications for any risk acceptance decisions.The guidance encourages maintaining a risk register or comparable tracking process and notes that risk assessments must be dynamic and responsive to material changes, including system migrations, mergers or acquisitions, significant outsourcing arrangements, and the adoption of emerging technologies such as frontier AI models.
Putting It Into Practice: The guidance builds on NYDFS’s broader focus on cybersecurity governance, including its prior guidance addressing third-party service provider risk (previously discussed here) and heightened cybersecurity risks associated with frontier AI models. Covered entities should review whether their risk assessments reflect their current systems, vendors, business processes, and emerging technology risks and whether they can demonstrate how identified risks informed specific cybersecurity controls, compensating controls, and risk acceptance decisions.