NYDFS Part 500, including the AI questions examiners now ask.
MFA and asset inventory have been fully enforceable since Nov 1, 2025. NYDFS's May 21, 2026 letter on frontier-AI risk creates no new rules, but it sets out four recommendations a regulated firm should be ready to speak to, and the annual certification is due every April 15.
§500 Gap & Certification Review
- A control-by-control gap against the amended regulation, with §500.12 MFA and §500.13 asset inventory tested, not interviewed
- Your risk assessment (§500.9) reviewed for AI coverage, including AI-enabled social engineering and third-party AI
- A certification-readiness memo for the April 15, 2027 filing, written for the CISO and the senior governing body who sign it
- Option: CISO of record under §500.4 through the Fractional CISO retainer
- Faster remediation of vulnerabilities
- Mapping of third-party dependencies
- Testing and human oversight of AI-generated code
- Operational-resilience testing
The letter adds no new rules. Read our breakdown and the evidence to keep →
Certifications filed. Boards briefed.
NYDFS Part 500 certifications filed or supported.
boards and executive committees reported to.
As of October 2026
Defensible under examination.
“Preparing for an NYDFS examination used to create real friction across our executive team. RedOps rebuilt our cybersecurity program: a fully mapped evidence repository, refreshed risk assessments, and governance aligned to the amended Part 500. We came through our examination with no material findings and no enforcement action.”
“Part 500's 72-hour incident notice and its ransom-payment notice rules left our old incident response plan too slow. RedOps rebuilt our procedures and escalation playbooks, then took our executives through ransomware and synthetic-identity tabletop exercises. Our program is now tested and defensible.”
Clients are identified by role and sector to protect their confidentiality.
Get a straight answer in 20 minutes.
Tell us where you stand: an examination letter, the April 15 certification, a CISO who left, or the AI questions your risk assessment doesn't answer yet. You'll leave the call with a recommended scope, and a written proposal follows within two business days.