What changed in NYDFS guidance in September 2026?

On 10 September 2026, NYDFS issued guidance on cybersecurity risk assessments under Part 500. It states that it does not create new obligations and emphasizes meaningful assessment of the business's risk and its connection to decisions; the underlying assessment requirements include annual review and updates for material changes. NYDFS guidance.

Coverage depends on the regulated entity and applicable exceptions, not simply having customers in New York. The NYDFS resource center is the starting point for the rule and implementation materials.

What to do now: ask whether the assessment covers the real asset, data, cloud and supplier environment. Trace a high-priority finding to an owner, a funded treatment or a documented acceptance decision. Ensure a material acquisition, new service or significant technology change reaches the assessment owner.

Ask a supplier: show how your assessment changes a decision. A generic maturity score, with no clear scope or evidence, is weak support for an accountable executive.