MFA you can prove. An asset inventory you can defend.
Since November 1, 2025, NYDFS 23 NYCRR Part 500 requires MFA for any individual accessing any information system (500.12) and written policies and procedures for a complete, accurate and documented asset inventory (500.13). CyberRisk One builds the inventory with every required field and links each asset to its risks and controls. We document MFA coverage and exceptions, and implement MFA hands-on in Microsoft 365 with Entra ID and Conditional Access.
- In effect
- November 1, 2025
- Section 500.12
- MFA for any individual, any system
- Section 500.13
- A complete, documented asset inventory
- Applies to
- DFS-regulated covered entities
What NYDFS now requires
Two requirements that expose everything else.
Both sound simple. Both reach into every corner of your environment.
- MFA for everyoneNot just remote access: any individual accessing any of your information systems.
- The exceptions trapPrivileged accounts, legacy apps, service accounts and vendors. Where MFA is infeasible, the CISO may approve a reasonably equivalent or more secure compensating control in writing, reviewed at least annually.
- Inventory with substanceEach asset tracked with its owner, location, classification or sensitivity, support expiration date and recovery time objective.
- Kept currentWritten procedures that define how often the inventory is updated and validated.
- EnforcementDFS has issued consent orders and significant penalties for Part 500 failures.
The requirements
What Part 500 asks for.
We map your environment to the sections that apply, and to the rest of Part 500 where you need it.
500.12 Multi-factor authentication
MFA for any individual accessing any information system. The CISO may approve compensating controls in writing, reviewed at least annually.
500.13 Asset inventory
Written policies and procedures for a complete, accurate and documented asset inventory, including how often it is updated and validated.
500.13 Required fields
Owner, location, classification or sensitivity, support expiration date and recovery time objectives.
500.11 Third parties
Service providers that touch your systems and nonpublic information, assessed and documented.
500.9 Risk assessment
A risk assessment reviewed and updated at least annually, which your inventory should feed.
500.17 Annual filing
A Certification of Material Compliance or Acknowledgment of Noncompliance, due each April 15 and signed by the highest-ranking executive and the CISO. We help you build the evidence behind it.
How we build the asset inventory
Not a spreadsheet. A map of your business.
Our asset inventory comes out of our data governance process, refined over many years. We run structured interviews with the business to learn what systems and data you have, who owns them and what they are worth to you. Then we review the result with IT and fill in the blanks. No software to buy and no agents to deploy, and in our experience it is faster and more complete than starting from a tool.
Thorough
Business and IT, together.
Structured interviews capture what the business actually runs, including the systems IT does not know about, then IT confirms the technical detail.
Linked
Every asset tied to risk and controls.
Each asset records its owner, location, classification or sensitivity, support expiration date and recovery time objective (RTO), then links to its control tier and risk factors.
Fast
No tools to buy.
A refined interview process that produces a complete, defensible inventory without waiting on a software rollout.
How it works
Inventory, classify, protect, prove.
Two requirements, one connected piece of work.
- 01
Structured business interviews
Department by department: what systems and data you use, who owns them and how critical they are.
- 02
IT review
We review the results with IT, fill in the technical blanks and reconcile against what is actually running.
- 03
Classify and set recovery objectives
Classification or sensitivity and recovery time objectives for each asset, in business terms.
- 04
Link to controls
Each asset mapped to its control tier, including where MFA applies and where exceptions need compensating controls.
- 05
Document and close MFA gaps
MFA coverage documented across your information systems, and implemented hands-on in Microsoft 365. Where MFA is infeasible, written compensating controls prepared for CISO approval and annual review.
- Microsoft Entra ID and Conditional Access
- Privileged and service accounts
- Vendor and remote access
- 06
Document and maintain
Written procedures for updating and validating the inventory, and evidence ready for DFS examiners and the April 15 filing.
How we help
Services behind the work.
Runs on one risk language
Scored with your methodology.
Every finding is scored the same way as the rest of your program. Already have a methodology? We use it. If not, we build it with you first, in a single workshop.
How we build a risk methodology →Questions
What people ask us.
When did the NYDFS MFA and asset inventory requirements take effect?
Both took effect on November 1, 2025, as the final phase of the Second Amendment to 23 NYCRR Part 500.
Who has to comply?
Covered entities regulated by the New York Department of Financial Services, including many banks, insurers and other licensed financial services companies. Some small businesses qualify for limited exemptions with narrower MFA requirements.
What does the asset inventory need to include?
Written policies and procedures for a complete, accurate and documented inventory of your information systems, tracking for each asset its owner, location, classification or sensitivity, support expiration date and recovery time objectives, plus how often the inventory is updated and validated.
What if a system cannot support MFA?
Part 500 allows the CISO to approve reasonably equivalent or more secure compensating controls in writing, reviewed at least annually. We help you document and justify each one.
Do we need software to build the asset inventory?
No. Our data governance process uses structured interviews with the business and a review with IT. It produces a thorough, linked inventory without buying or deploying a tool, and you can load the results into any tool you already use.