NYDFS Part 500 Compliance Kit

Part 500 certification is due April 15. Every phase of the Second Amendment has been enforceable since 1 November 2025, the filing carries two personal signatures, and enforcement has reached well past banks — the Healthplex action was against an insurance agent, for no MFA, no retention policy and a late notice.

The centre of this kit is not the filing. It is the decision the filing forces: can you sign a Certification of Material Compliance, or do you owe an Acknowledgment of Noncompliance? A false certification is itself a violation of Part 500, and it is signed personally by the CISO and the highest-ranking executive. That is a decision you want made from evidence in March, not from optimism on 14 April.

01 Applicability & Class A Determination (XLSX) — the covered, limited-exemption and Class A tests, which MFA scope actually applies to you, your computed next filing date, and the recurring calendar.

02 Part 500 Control Crosswalk (XLSX) — 19 section rows against NIST CSF 2.0, ISO 27001:2022, SOC 2 and your ISMS-01 domain, with evidence expected and evidence location per section. You rate each section, and the summary produces the Certification-versus-Acknowledgment recommendation. This is the sheet that turns the April decision into arithmetic.

03 Required Policy Set Index & Gap Check (XLSX) — all sixteen policy areas 500.3 enumerates at (a) through (p), with board-approval tracking and the 12-month check, plus a 15-document procedure checklist. Sixteen, not fourteen: the amended section is longer than most summaries of it.

04 Incident & Extortion Notice Templates (DOCX) — the 72-hour prong test, a clock log, the portal fields pre-drafted, the 24-hour extortion-payment notice, the 30-day written-explanation structure, and how this interacts with your other regimes.

05 Annual Certification Package (DOCX) — which filing you owe, the content of both forms pre-drafted, an 18-folder evidence binder index, and a two-signatory review record. Both forms, because the honest answer is sometimes the Acknowledgment, and a kit that only drafts the certification quietly pushes you toward signing it.

06 Risk Assessment (DOCX + XLSX) — the 500.9 narrative template plus a register with documented criteria, a compensating-control table and an auto summary. 500.9 wants the criteria written down, not just the conclusions.

07 CISO Annual Board Report (PPTX) — seven slides mapped one-to-one onto the six topics 500.4(c) requires in the CISO's written report, plus the filing recommendation and decisions requested. After the certification itself, this is the artefact examiners ask for first.

08 Practitioner Guide (PDF) — where Part 500 stands, coverage, exemptions and Class A, what enforcement has actually punished, the eight questions examiners ask, MFA, asset inventory, governance, the clocks, the April 15 decision, the NAIC look-alike laws, a 90-day build and an FAQ.

Who this is for. NY-licensed banks, insurers, agents, brokers and adjusters, mortgage and fintech licensees, and the MSPs and vCISOs who serve them. The enforcement record says small licensees are squarely in scope, and they are the ones least likely to have any of this written down.

Beyond New York. The NAIC Insurance Data Security Model Law is close enough to Part 500 that the guide covers the look-alikes; if you are licensed in several states, most of this work travels.

Pairs with the TPRM Program Kit for the 500.11 third-party requirements, and the SEC 8-K Item 1.05 Materiality Workbook if you are also a public registrant — one fact base, two different clocks.

Not legal advice. The certification is signed personally, and a false one is its own violation — have counsel review before anyone signs.