Although Part 500 requires that a covered entity’s cybersecurity program be “based on” its risk assessment, the regulation does not describe what an adequate risk assessment looks like. In the Second Amendment rulemaking, NYDFS declined to add that detail, removing proposed language that would have required risk assessments to consider the specific circumstances of the covered entity.
Based on its examinations, investigations, and interviews with covered entity personnel, NYDFS identifies in the Industry Letter the risk assessment deficiencies it most commonly encounters and describes the practices it considers effective. Covered entities should expect the Department to measure their risk assessments against the guidance in the Industry Letter.
Key takeaways from the Industry Letter include:
- NYDFS lists, among others, five types of recurring gaps in risk assessments that it has observed during examinations, investigations, and interviews with covered entity personnel: (1) incomplete asset scope and visibility, (2) weak or inconsistent methodologies, (3) failure to account for evolving and interconnected risks, (4) insufficient governance and risk treatment, and (5) failure to account for or inform the cybersecurity program.
- NYDFS expects covered entities to be able to demonstrate how the risk assessment informed control selection, compensating controls, and risk acceptance decisions. Covered entities must maintain documentation linking each identified risk to the specific controls or compensating measures implemented to mitigate it and capturing the justification for any risk acceptance. NYDFS also recommends a risk register or comparable tracking process.
- The asset inventory required by Part 500 should serve as a key input to the risk assessment, and scope should extend to emerging risks such as artificial intelligence (AI), as well as third-party and supply chain risk and cyber interdependencies and concentration risk.
- NYDFS does not require a specific methodology, but states that covered entities should adopt one that is defined, repeatable, and applies consistent likelihood and impact criteria so results are comparable over time. NYDFS also states that “mature cybersecurity programs apply consistent risk criteria across relevant organizational risk management processes,” including third-party risk management, IT operations, and business continuity or disaster recovery planning.
- Risk assessments must be reviewed and updated at least annually and whenever a change in business or technology causes a material change to cyber risk. The Industry Letter explains that potential material changes may include major system migrations, mergers and acquisitions, significant outsourcing arrangements, significant developments in cybersecurity technologies (e.g., frontier AI models), changes in threat actor capabilities, and adoption of emerging technologies. It also lists the identification or active exploitation of critical vulnerabilities, and geopolitical events that could increase ideologically motivated cyberattacks, as additional factors covered entities should consider in deciding whether to update the risk assessment.
- The Industry Letter also cites NYDFS’s May 21, 2026 guidance on measures to consider in a heightened cybersecurity threat environment, which recommends that covered entities take additional protective steps beyond Part 500’s minimum requirements when the threat environment is elevated.
What Part 500 requires
Under Part 500, covered entities must periodically assess the risks to their information systems, and the assessment must be “sufficient to inform the design of” the cybersecurity program. The assessment must be reviewed and updated “as reasonably necessary,” at least annually, and whenever a change in the business or technology causes “a material change” to the covered entity’s cyber risk. It must be documented and carried out under written policies and procedures that set criteria for evaluating and categorizing risks, criteria for assessing the confidentiality, integrity, security, and availability of information systems and nonpublic information (including the adequacy of existing controls), and requirements describing how identified risks will be mitigated or accepted.
The Industry Letter states that NYDFS “expects each Covered Entity to be able to demonstrate how its Risk Assessment informed cybersecurity controls, compensating controls, and risk acceptance decisions.” NYDFS also states that risk assessments should be tailored to the covered entity’s size, complexity, unique risks, operations, and assets. An assessment conducted by an individual or small business “will often look very different from one performed by a Class A Company” (a larger covered entity meeting the size thresholds in Section 500.1(d)), but the goal of enabling informed decisions about the cybersecurity program is the same regardless of size.
The Industry Letter also states that Part 500 does not require formal board or senior management approval of the risk assessment itself, although covered entities should elicit input across functions and communicate results to senior management and, where appropriate, the senior governing body. Relevant functions include “business units, operations, compliance, legal, and other key stakeholders.” Separately, Part 500 requires the written policies and procedures governing the risk assessment to be approved at least annually by a senior officer or the senior governing body.
Common gaps identified by NYDFS in examinations and investigations
In the Industry Letter, NYDFS states that common gaps in risk assessments have contributed to deficient cybersecurity programs and that, in its examinations, investigations, and interviews with covered entity personnel, it has identified common gaps, among others, which it describes as follows:
- Incomplete asset scope and visibility. Outdated or incomplete asset inventories; failure to identify where nonpublic information resides or flows; and omission of critical business processes, third-party service providers, cloud environments, and other external dependencies.
- Weak or inconsistent methodologies. Failure to consistently identify, analyze, prioritize, and document cybersecurity risks; to evaluate the effectiveness of existing controls; or to distinguish between inherent and residual risk.
- Failure to account for evolving and interconnected risks. Failure to consider emerging technologies, changes in the threat landscape, interdependencies, concentration risk, and single points of failure that could materially affect the covered entity’s operations.
- Insufficient governance and risk treatment. Failure to assign ownership, document risk response decisions, integrate risk assessment results into enterprise governance, or update risk assessments after material changes to the business, technology, or threat environment.
- Failure to account for or inform the cybersecurity program. Policies, controls, and resource decisions that are not demonstrably based on the covered entity’s identified cyber risks.
Practical action items to consider
NYDFS states that it reviews risk assessments in examinations and investigations. As a starting point, covered entities may wish to map the current risk assessment, and the written policies and procedures governing it, against the five types of common gaps NYDFS identified in the Industry Letter. Examiners are likely to ask about each gap.
Covered entities may also wish to consider the following steps, among others:
Governance and updates
- Assign responsibility for identifying changes in the business or technology that could cause a material change to cyber risk and for deciding whether an update is required so that the risk assessment is updated when needed rather than only at the annual review.
- Confirm that cross-functional stakeholders participate and that results reach senior management and, where appropriate, the senior governing body. Also consider whether the documentation would support the annual certification of compliance under Section 500.17(b) of Part 500.
Scope and coverage
- Confirm that the asset inventory, which is required under Section 500.13(a) of Part 500, serves as a key input for the assessment and that the assessment reflects where nonpublic information resides and flows, including through cloud environments, affiliates, and third-party service providers, and that third-party risk is evaluated based on the criticality of the services provided, the sensitivity of information accessed or maintained, the level of connectivity to the covered entity’s information systems, and the potential operational impact of a provider incident.
- Expand scope to expressly address concentration risk and single points of failure across shared platforms, cloud providers, and managed service providers, including how an event affecting one dependency could affect other information systems or critical business functions.
- Document consideration of emerging risks, including the organization’s own use of AI, AI-enabled threats, advances in quantum computing that may affect future cryptographic protections, software supply chain attacks, and evolving ransomware techniques, even where the conclusion is that the risk profile is unchanged.
Methodology, documentation, and traceability
- Review methodology documentation to confirm that likelihood and impact criteria are defined, ratings are applied consistently from year to year, inherent and residual risk are distinguished, and the methodology is itself subject to periodic review.
- Establish or refresh a risk register that ties each identified risk to an owner, the specific mitigating or compensating controls, remediation status, and residual risk, and that records the rationale for each risk acceptance decision. Also confirm that cybersecurity policies, procedures, controls, testing plans, and related resource decisions can be traced to the risks identified through the risk assessment and that the mapping of risks to controls extends to internal audit and independent testing functions.
- Harmonize risk-rating criteria across the covered entity’s risk management processes – including third-party risk management, IT operations, and business continuity and disaster recovery planning – to promote consistent identification, measurement, and prioritization of risk.
If you have questions or would like to discuss any issues addressed in this client alert, please contact the authors.
