← Frameworks / NYDFS 500 / Control Mappings

Machine-readable: JSON API guide

23 NYCRR Part 500 — Cybersecurity Requirements for Financial Services Companies

New York Department of Financial Services mandatory cybersecurity regulation for all DFS-regulated entities including banks, insurers, and financial services companies. 18 sections covering cybersecurity program, policy, CISO, penetration testing, access privileges, application security, risk assessment, third-party service provider security, MFA, data retention, monitoring, incident response, 72-hour notification, and annual compliance certification. Enhanced requirements for Class A companies.

Controls: 137
Total Mappings: 199
Publisher: New York Department of Financial Services (NYDFS) Version: 2023 (amended)
NYDFS 500 → SP 800-53 SP 800-53 → NYDFS 500 Coverage Analysis
AC (10) AT (4) AU (12) CA (6) CM (8) CP (8) IA (5) IR (8) MA (1) MP (4) PE (1) PL (6) PM (17) PS (7) PT (3) RA (7) SA (9) SC (9) SI (7) SR (5)

AC Access Control

Control Name NYDFS 500 References
AC-01 Policy and Procedures
500.3500.7
AC-02 Account Management
500.7
AC-03 Access Enforcement
500.7
AC-04 Information Flow Enforcement
500.18
AC-05 Separation of Duties
500.7
AC-06 Least Privilege
500.6500.7
AC-17 Remote Access
500.6500.7500.12
AC-19 Access Control for Mobile Devices
500.7
AC-20 Use of External Systems
500.7500.11
AC-21 Information Sharing
500.18

AT Awareness and Training

Control Name NYDFS 500 References
AT-01 Policy and Procedures
500.3500.10500.14
AT-02 Literacy Training and Awareness
500.10500.14
AT-03 Role-based Training
500.10500.14
AT-04 Training Records
500.14

AU Audit and Accountability

Control Name NYDFS 500 References
AU-01 Policy and Procedures
500.3
AU-02 Event Logging
500.6
AU-03 Content of Audit Records
500.6
AU-04 Audit Log Storage Capacity
500.6
AU-05 Response to Audit Logging Process Failures
500.6
AU-06 Audit Record Review, Analysis, and Reporting
500.6500.14500.17
AU-07 Audit Record Reduction and Report Generation
500.6
AU-08 Time Stamps
500.6
AU-09 Protection of Audit Information
500.6
AU-11 Audit Record Retention
500.6
AU-12 Audit Record Generation
500.6
AU-13 Monitoring for Information Disclosure
500.14

CA Security Assessment and Authorization

Control Name NYDFS 500 References
CA-01 Policy and Procedures
500.3
CA-02 Control Assessments
500.2500.9
CA-03 Information Exchange
500.11
CA-05 Plan of Action and Milestones
500.2500.9
CA-07 Continuous Monitoring
500.2
CA-08 Penetration Testing
500.5

CM Configuration Management

Control Name NYDFS 500 References
CM-01 Policy and Procedures
500.3
CM-02 Baseline Configuration
500.8
CM-03 Configuration Change Control
500.8
CM-04 Impact Analyses
500.5500.8
CM-06 Configuration Settings
500.5
CM-08 System Component Inventory
500.13
CM-12 Information Location
500.13
CM-13 Data Action Mapping
500.13

CP Contingency Planning

Control Name NYDFS 500 References
CP-01 Policy and Procedures
500.3500.16
CP-02 Contingency Plan
500.2500.16
CP-03 Contingency Training
500.16
CP-04 Contingency Plan Testing
500.16
CP-06 Alternate Storage Site
500.16
CP-07 Alternate Processing Site
500.16
CP-09 System Backup
500.16
CP-10 System Recovery and Reconstitution
500.16

IA Identification and Authentication

Control Name NYDFS 500 References
IA-01 Policy and Procedures
500.3500.7
IA-02 Identification and Authentication (Organizational Users)
500.7500.12
IA-04 Identifier Management
500.7
IA-05 Authenticator Management
500.7500.12
IA-08 Identification and Authentication (Non-organizational Users)
500.12

IR Incident Response

Control Name NYDFS 500 References
IR-01 Policy and Procedures
500.3500.16
IR-02 Incident Response Training
500.16
IR-03 Incident Response Testing
500.16
IR-04 Incident Handling
500.2500.14500.16
IR-05 Incident Monitoring
500.16
IR-06 Incident Reporting
500.16500.17
IR-07 Incident Response Assistance
500.16
IR-08 Incident Response Plan
500.16

MA Maintenance

Control Name NYDFS 500 References
MA-01 Policy and Procedures
500.3

MP Media Protection

Control Name NYDFS 500 References
MP-01 Policy and Procedures
500.3
MP-04 Media Storage
500.15
MP-05 Media Transport
500.15
MP-06 Media Sanitization
500.13

PE Physical and Environmental Protection

Control Name NYDFS 500 References
PE-01 Policy and Procedures
500.3

PL Planning

Control Name NYDFS 500 References
PL-01 Policy and Procedures
500.2500.3500.4
PL-02 System Security and Privacy Plans
500.2500.3500.19
PL-03 System Security Plan Update
500.3
PL-04 Rules of Behavior
500.4
PL-07 Concept of Operations
500.2
PL-08 Security and Privacy Architectures
500.2

PM Program Management

Control Name NYDFS 500 References
PM-01 Information Security Program Plan
500.2500.3500.4500.19
PM-02 Information Security Program Leadership Role
500.2500.4500.10
PM-03 Information Security and Privacy Resources
500.2500.4
PM-04 Plan of Action and Milestones Process
500.2
PM-05 System Inventory
500.3500.13
PM-06 Measures of Performance
500.2
PM-08 Critical Infrastructure Plan
500.9
PM-09 Risk Management Strategy
500.2500.3500.9
PM-11 Mission and Business Process Definition
500.2500.9500.19
PM-13 Security and Privacy Workforce
500.4500.10
PM-14 Testing, Training, and Monitoring
500.2500.14500.16
PM-15 Security and Privacy Groups and Associations
500.10
PM-16 Threat Awareness Program
500.9500.10
PM-26 Complaint Management
500.17
PM-29 Risk Management Program Leadership Roles
500.4
PM-30 Supply Chain Risk Management Strategy
500.11
PM-31 Continuous Monitoring Strategy
500.11

PS Personnel Security

Control Name NYDFS 500 References
PS-01 Policy and Procedures
500.3500.10
PS-02 Position Risk Designation
500.10
PS-03 Personnel Screening
500.10
PS-04 Personnel Termination
500.7
PS-05 Personnel Transfer
500.7
PS-06 Access Agreements
500.10
PS-07 External Personnel Security
500.10500.11

PT Personally Identifiable Information Processing and Transparency

Control Name NYDFS 500 References
PT-01 Policy and Procedures
500.18
PT-03 Personally Identifiable Information Processing Purposes
500.13500.18
PT-04 Consent
500.18

RA Risk Assessment

Control Name NYDFS 500 References
RA-01 Policy and Procedures
500.2500.3500.4500.9
RA-02 Security Categorization
500.9
RA-03 Risk Assessment
500.2500.9
RA-05 Vulnerability Monitoring and Scanning
500.5500.9
RA-06 Technical Surveillance Countermeasures Survey
500.9
RA-07 Risk Response
500.5500.9
RA-09 Criticality Analysis
500.9

SA System and Services Acquisition

Control Name NYDFS 500 References
SA-01 Policy and Procedures
500.3
SA-03 System Development Life Cycle
500.8
SA-04 Acquisition Process
500.8500.11
SA-08 Security and Privacy Engineering Principles
500.8
SA-09 External System Services
500.10500.11
SA-11 Developer Testing and Evaluation
500.5500.8
SA-15 Development Process, Standards, and Tools
500.5500.8
SA-17 Developer Security and Privacy Architecture and Design
500.8
SA-22 Unsupported System Components
500.13

SC System and Communications Protection

Control Name NYDFS 500 References
SC-01 Policy and Procedures
500.3
SC-03 Security Function Isolation
500.8
SC-07 Boundary Protection
500.2500.14
SC-08 Transmission Confidentiality and Integrity
500.15
SC-12 Cryptographic Key Establishment and Management
500.15
SC-13 Cryptographic Protection
500.15
SC-23 Session Authenticity
500.12
SC-28 Protection of Information at Rest
500.15
SC-44 Detonation Chambers
500.14

SI System and Information Integrity

Control Name NYDFS 500 References
SI-01 Policy and Procedures
500.3
SI-02 Flaw Remediation
500.5500.8
SI-03 Malicious Code Protection
500.14
SI-04 System Monitoring
500.2500.6500.14
SI-05 Security Alerts, Advisories, and Directives
500.5500.10
SI-07 Software, Firmware, and Information Integrity
500.8
SI-12 Information Management and Retention
500.13500.18

SR Supply Chain Risk Management

Control Name NYDFS 500 References
SR-01 Policy and Procedures
500.3500.11
SR-02 Supply Chain Risk Management Plan
500.11
SR-03 Supply Chain Controls and Processes
500.11
SR-05 Acquisition Strategies, Tools, and Methods
500.11
SR-06 Supplier Assessments and Reviews
500.11