NYDFS’s final Part 500 deadline put the asset inventory underneath every other control

The week

For many financial firms in New York, the last week of October 2025 was a countdown. November 1, 2025 was the last phased compliance date in the Second Amendment to the New York Department of Financial Services cybersecurity regulation, known by its legal citation, 23 NYCRR Part 500. The amendment had been finalized in November 2023, with its requirements switched on in stages. This was the final stage, and two requirements took effect.

The first was universal multi-factor authentication, or MFA. MFA means proving who you are in more than one way when you log in: typically something you know, such as a password, plus something you have, such as a phone that receives a code or an app that asks you to approve the login. It is the reason a stolen password alone is often not enough to break into an account. Covered entities had to use MFA for any individual accessing any of their information systems, whether or not the access was remote or privileged, unless they qualified for the rule’s limited exemption for small companies. “Privileged” access means the powerful accounts administrators use to change systems; until then, many firms had focused MFA there and on remote logins from outside the office.

The second requirement was less dramatic and, in practice, harder. Firms needed written policies and procedures for a complete, accurate and documented inventory of information systems. An asset inventory is a reliable list of every system the firm runs or depends on, with key facts about each. The rule named attributes to track, such as owner, location, classification (how sensitive the system or its data is), support expiration date (when the vendor stops fixing it) and recovery time objective (how quickly it must be restored after a failure).

Part 500 applies to entities licensed or chartered by DFS, such as state-chartered banks, insurers and money transmitters. Nationally chartered banks are outside it. For the executives of firms inside it, the week marked the moment when every amended requirement was finally in force, and when the next annual certification, which carries their names, would have to cover all of them.

Suppose the chief executive of a state-chartered bank in New York sits down in early April 2026 with a filing due to the regulator by April 15. It asks her, and her chief information security officer, to certify that the bank materially complied with the state’s cybersecurity rules during the previous year. She knows the bank rolled out multi-factor login. She is less sure what “a complete, accurate and documented inventory of information systems” looks like, or how she would know whether the bank has one. Her signature is about to say that it does.

The November 1, 2025 deadline created exactly that situation. The last week of October 2025 was busy for DFS-regulated firms closing out MFA projects, the visible deadline. The inventory requirement mattered more, because nearly every other obligation in Part 500 assumes the firm knows what it has. The final phase breaks into three parts: universal MFA, the inventory, and the annual certification that ties both to named executives. They are best built in reverse order of attention, inventory first.

New York’s rule and its final phase

Part 500 is New York’s cybersecurity regulation for the financial firms it licenses. It was substantially amended in November 2023. The amendment did not switch everything on at once; it set a series of compliance dates so firms had time to prepare. November 1, 2025 was the last of them.

A few terms recur throughout. A covered entity is a firm the rule applies to: one licensed or chartered by DFS, such as a state-chartered bank, insurer or money transmitter. An information system is, broadly, any collection of technology the firm uses to handle its information: an application, a server, a database, a cloud service, a laptop. The CISO, or chief information security officer, is the executive responsible for cybersecurity. The senior governing body is usually the board of directors or a committee of it.

The two final requirements look technical but are really about knowledge and control. MFA tests whether the firm can be confident, everywhere, that the person logging in is who they claim to be. The inventory tests whether the firm actually knows everything it would need to protect. The annual certification then asks the firm’s most senior executive and its CISO to put their names to the answers.

Universal MFA: the exceptions were the work

By late 2025 most covered entities already used MFA for email, remote access and privileged accounts. The remaining work was the long tail. It included internal applications with their own logins, legacy systems that cannot accept modern authentication, shared workstations in branches and call centers, and third-party portals staff use daily. The main entrance was never the hard part; the side doors were.

The regulation lets the CISO approve, in writing, reasonably equivalent or more secure compensating controls where MFA is not feasible. A compensating control is a different safeguard that achieves a similar level of protection, such as restricting an old system so it can be reached only from one secured network segment. Those approvals must be reviewed at least annually. Examiners will look hardest at this exception process. A firm with a short, documented list, each entry carrying a compensating control and a retirement date, stands in a very different position from one with an informal understanding that some systems are hard.

The deeper design choice is whether MFA is enforced centrally or application by application. An identity provider is a central service that handles logins for many applications at once, so that staff sign in once (single sign-on) and the MFA check happens in one place. Firms that pushed authentication through a single identity provider found the deadline far easier than those retrofitting MFA into each application. That choice also governs how fast a firm can react when an MFA method proves weak. SMS codes and push approvals vulnerable to fatigue attacks can be replaced once, centrally, instead of in dozens of places. A fatigue attack is when a criminal who already has a password triggers login prompts again and again until a tired or confused employee taps “approve” to make them stop.

Shared and non-human access is the trickiest corner. Branch kiosks, call center workstations used across shifts, and service accounts, accounts that one piece of software uses to log in to another with no human involved, all strain a rule written for individuals. Each needs an explicit treatment: badge-based or proximity authentication for shared stations, and vaulted, rotated credentials for service accounts, with a documented rationale. “Vaulted and rotated” means the passwords are kept in a secure, audited store and changed automatically on a schedule, so no one person knows them and a leaked copy soon goes stale.

The asset inventory: the control under the controls

Part 500’s other requirements depend on an inventory, though the rule rarely says so. Risk assessments need to know what systems exist. Vulnerability management, the routine work of finding and fixing weaknesses, needs a list of assets to scan. Access reviews need a list of systems with users. Business continuity planning needs recovery objectives per system. End-of-life planning needs support dates. Without a single inventory, each program keeps its own partial list, and the lists disagree.

A household insurance claim is a fair comparison. After a burglary, people who kept a list of their valuables, with receipts and photographs, get paid quickly; people who reconstruct it from memory get paid slowly and incompletely. A firm without an asset inventory has to reconstruct the answer to every security decision.

The amended rule asks for policies and procedures that keep the inventory complete and current, with specific attributes for each asset. The difficult attributes are not technical. Owner and classification require business decisions. Recovery time objective requires IT and the business to agree on what matters. Support expiration date requires vendor information many firms never recorded, especially for appliances and embedded software.

Firms that made progress ran the inventory as a product with an owner rather than a spreadsheet refreshed for an audit. They fed it from automated discovery, such as endpoint management (the tools that track company laptops and servers), cloud provider APIs (the interfaces through which cloud services report what is running), identity provider application lists and network scanning. They reconciled that against the configuration management database, the official record IT keeps of its systems. Differences between discovered and recorded assets became a weekly work queue instead of an annual surprise.

Software-as-a-service and vendor-run systems are where inventories most often fall short. Software as a service, or SaaS, means applications the firm rents over the internet rather than runs itself, such as an online HR platform or a document-sharing tool. A firm may not run the infrastructure, but the information system still holds its data and still counts. Expense reports and single sign-on logs are practical ways to find SaaS applications that never went through procurement; a department that pays for a tool on a corporate card leaves a trail even if it never told IT. Vendor contracts should require the attributes the inventory needs, such as hosting location and support dates.

Certification: named people, annual exposure

The Second Amendment also changed the annual filing due by April 15. Covered entities must either certify material compliance, or acknowledge non-compliance, identify the gaps and give a remediation timeline. The filing must be signed by the highest-ranking executive and the CISO, or the senior officer responsible for cybersecurity where there is no CISO.

That made the November 2025 requirements personal. A CEO and CISO certifying in April 2026 were vouching for universal MFA and a maintained inventory from the date those requirements applied. DFS has penalized inaccurate certifications in past enforcement actions. The honest alternative, acknowledging specific gaps with a plan, is explicitly allowed. Where gaps exist it is usually the safer choice, and firms should take counsel’s view on how to document it.

A general counsel should read this part of the rule most closely. A certification is a statement of fact by named individuals to a regulator. If the underlying evidence is thin, the signature does not make it thicker; it moves the risk onto the people signing.

The amended rule also expects the senior governing body to have enough understanding of cybersecurity to oversee it, and the CISO to report to that body at least annually. Those reports are the natural place to show inventory coverage, MFA exceptions by age and remediation progress. A board that has seen the same three figures through the year is in a far better position to support an April certification than one seeing them for the first time.

One urgent Monday at two money transmitters

The value of all this is clearest on an ordinary bad day. Say that on a Monday morning a widely used software vendor announces a serious flaw in one of its products and urges customers to apply a fix at once. Take two New York money transmitters, one with a living inventory and one without.

At the first firm, the security team searches the inventory for the product. Within minutes it has a list: three systems run it, one supports customer payments and two support internal reporting. Each entry names a business owner, a classification and a recovery time objective. The team calls the owner of the payment system, agrees a maintenance window based on the recovery objective already on record, and schedules the internal systems for that evening. Because all three sit behind the firm’s central identity provider, the team also knows that every login to them requires MFA, which narrows how an attacker could reach them in the meantime. By lunchtime the CISO can tell the chief executive exactly what is exposed and when it will be fixed.

At the second firm, the security team sends an email to every department asking whether anyone uses the product. Some reply quickly. Some do not reply at all. Someone remembers that a vendor installed a copy two years ago for a project that may or may not still be running. The team runs a network scan and finds a system nobody recognizes. It has no recorded owner, and nobody knows whether it can be taken offline or what it supports. It also turns out to have its own local login, outside the identity provider, with no second factor. By the end of the day the firm is still not sure it has found everything.

Neither firm did anything unusual that Monday. The difference was made months earlier, in the unglamorous work of recording owners, classifications, support dates and recovery objectives, and of routing logins through one place. The inventory deserves to be built first for this reason, and the regulator’s certification, which asks named executives to vouch for the whole picture, is far easier to sign at the first firm than at the second.

The same pattern repeats for audits, for vendor reviews, for business continuity tests and for decisions about which old systems to retire. In each case the firm with the reliable list starts from facts, and the firm without it starts from a survey.

The business case behind the paperwork

All this could pass for compliance paperwork. The requirements earn their place for more practical reasons.

Stolen passwords remain one of the most common ways into an organization. Universal MFA closes the side doors that attackers look for once the front door is guarded. The inventory, meanwhile, determines how fast a firm can respond to almost any incident. When a vendor announces an urgent flaw in a product, the first question is “do we run it, where and who owns it?” A firm with a living inventory answers in minutes. A firm without one spends days asking around.

There are financial and regulatory stakes too. Enforcement actions bring penalties and remediation costs. And a firm that knows what it runs can retire what it no longer needs, which saves license fees and shrinks the area attackers can target.

How the three requirements prove each other

The three parts connect through evidence. The inventory tells the firm where MFA must apply. The MFA exception list is a subset of the inventory with added risk attributes. The certification rests on evidence from both, so signers should see inventory coverage and exception counts before they sign. A firm that built the inventory first found the other two easier to prove.

Suppose a mid-sized insurer licensed in New York handled the deadline well. Its inventory is owned by a named manager and fed automatically from its device management, cloud accounts and single sign-on system. Every week, a short report lists systems that were discovered but not recorded, or recorded but not discovered, and someone resolves each one. Its MFA exception list has a handful of entries, each with the CISO’s written approval, a compensating control and a date by which the system will be retired or upgraded. Its CISO reports three figures to the board each quarter: inventory coverage, open MFA exceptions and their age, and remediation progress. When April comes, the CEO and CISO review those same figures before signing, and they know what they are attesting to.

The failures run the other way. Some firms treat the inventory as an audit spreadsheet, rebuilt once a year and stale within weeks. Some let MFA exceptions accumulate informally, so that “that old system can’t do MFA” becomes a permanent state with no approval and no end date. SaaS and vendor-run systems get forgotten because the firm does not operate them. MFA methods that are easy to trick, such as push approvals with no extra check, stay in place with no central way to change them. And some executives sign the certification on the strength of reassurance rather than evidence, when acknowledging a specific gap with a plan was available and safer.

What signers should be able to answer before April

1. How complete is our asset inventory, how do we know, and who owns keeping it current?
2. Does it include SaaS applications and vendor-run systems that hold our data, and how do we find the ones nobody told IT about?
3. How many MFA exceptions do we have, how old are they, and does each have a written CISO approval, a compensating control and a retirement date?
4. If one of our MFA methods proved weak tomorrow, how quickly could we replace it everywhere?
5. What evidence will the CEO and CISO see before they sign the April certification, and are we prepared to acknowledge gaps rather than certify past them?

With hindsight

DFS surrounded the deadline with guidance rather than leniency. Days before it, on October 21, 2025, it issued guidance on managing third-party service providers that stressed board and senior management oversight and listed MFA among expected contract terms. Its cybersecurity FAQs address MFA questions such as push-based apps and single sign-on. In September 2026 its guidance on risk assessments described the asset inventory as the foundational input to the risk assessment, close to the argument made here. Taken together, the message to firms was consistent: the regulator expected the requirements to be met, and was explaining how, rather than signaling that it would look the other way.

The April 15, 2026 certification was the first filed after every amended requirement was in force. MFA was always going to be the easier half to evidence, because it is largely binary and testable: a login either demands a second factor or it does not. Inventory completeness is harder to prove, particularly for SaaS applications and systems run by third parties, and it remains the more likely weak point. Proving that a list is complete means proving a negative, that nothing is missing, and that takes ongoing discovery rather than a single snapshot.

The inventory is an operating asset more than a compliance artifact. One designed as an operational system also serves vulnerability management, resilience planning and vendor oversight. It makes incident response faster, renewals cheaper and board reporting more credible. One built only for the filing has to be rebuilt each year, and offers little comfort to the executives whose names sit on the certification. Firms still treating the inventory as a once-a-year exercise have the most to gain from changing course before the next April filing comes round.