On September 10, 2026, the New York State Department of Financial Services (“DFS”) issued an industry letter providing guidance on how to conduct and use the risk assessments mandated by the cybersecurity requirements under 23 NYCRR Part 500 (the “Cybersecurity Regulations”). The letter examines five topics: governance and oversight; methodology for identifying cybersecurity-related risks; scope of assessments; documentation; and integration to ensure risk assessments are impacting future policies, procedures, and controls. This letter sets the standard that examiners will use in future DFS inquiries and likely signals that risk assessments and audits will face rigorous examinations going forward. It is also the seventh cybersecurity-related industry letter DFS has issued since January 2026, signaling continuing risks and clarifications are needed to address cybersecurity concerns.

According to DFS, the letter does not establish any new rules; rather, the guidance is intended to clarify requirements and highlight best practices when designing, conducting, and updating risk assessments. At the same time, the guidance does identify specific gaps that the agency has encountered through its inquiries, including inconsistent methodologies and a failure to account for interconnected risks. The guidance highlights that covered entities should consider material technology changes, third-party risks including dependence on cloud providers, service providers, software, emerging technologies, and risk-informed controls (among other items) as part of their risk assessments.

New York’s risk assessment requirements tap into a growing concern around cybersecurity, especially as AI tools potentially magnify the scale and sophistication of cybersecurity incidents targeting financial institutions. DFS has previously flagged that adopting AI products often requires covered entities to collect and process substantial amounts of nonpublic information (“NPI”), requiring protection of “substantially more data” and creating a more attractive target for cyberattacks.¹ Continued reliance on vendors to build and maintain AI models represents another “critical area of concern.”² The industry letter further notes that updates to risk assessments are required following potential material changes to a covered entity’s cyber risk, which may include major system migrations, mergers and acquisitions, significant outsourcing arrangements, and significant developments in cybersecurity technologies (e.g., frontier AI models). Moreover, the use of AI by threat actors also heightens the risk around deep-fake-driven social engineering and faster exploitation of vulnerabilities, which raises the importance of proper risk assessments. We have provided a summary of the new guidance below, as well as key takeaways for covered entities to consider.

To learn more about the Cybersecurity Regulations and stay up to date on the latest developments in state privacy law, please subscribe to the WilmerHale Privacy and Cybersecurity Law Blog.

Background

The Cybersecurity Regulations apply to covered entities, defined as “any person operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law, regardless of whether the covered entity is also regulated by other government agencies.”³ Part 500 requires covered entities to maintain cybersecurity programs based on their risk assessments, and Section 500.2(a) requires those programs to be designed to protect the confidentiality, integrity, and availability of an entity’s information systems and the NPI stored on them.

The regulation defines “risk assessment” as “the process of identifying, estimating and prioritizing cybersecurity risks to organizational operations, assets, individuals, customers, consumers, other organizations and critical infrastructure, incorporating threat and vulnerability analyses and accounting for mitigations provided by controls planned or in place.”

DFS describes that under current regulations, a risk assessment should inform the design of the entity’s cybersecurity program. It also must be reviewed and updated at least annually, in addition to whenever a change in the entity’s business or technology causes a material change to its cyber risk.

The guidance sets forth specific directives highlighting that written policies and procedures must include:

1. Criteria for evaluating and categorizing identified cybersecurity risks or threats facing the covered entity.
2. Criteria for assessing the confidentiality, integrity, security, and availability of information systems and NPI (including the adequacy of existing controls), and requirements describing how identified risks are addressed by the cybersecurity program.
3. Requirements describing how identified risks are addressed by the cybersecurity program, as based on the risk assessment.

The guidance places a rigorous standard on covered entities to demonstrate how its risk assessment informed cybersecurity controls, compensating controls, and risk acceptance decisions. The expectation is that the backbone of a robust cybersecurity program involves data-driven risk assessments.

DFS is explicit that scale matters

Risk assessments should be tailored to an organization’s size, complexity, unique risks, operations, and assets. For example, an assessment conducted by an individual or small business will often look very different from one performed by a Class A company. Risk assessments should be integrated into the enterprise governance process, based on a definable, rinse-and-repeat methodology. The goal is to assess risks so the organization can make informed decisions about its cybersecurity program.

Key Takeaways

• Review the scope and methodology of risk assessments in light of the guidance.
• Confirm asset inventories are current, including mapping where NPI resides and how it flows.
• Demonstrate how the risk assessment informs cybersecurity controls, compensating controls, and risk acceptance decisions.
• Document the impact of the risk assessment by the Chief Information Security Officer (“CISO”) or other senior officer with ownership over data security to inform cross-functional participation from business, operations, compliance, and legal, and communication of results to senior management or the governing body.

The guidance establishes a clear enforcement lens: The list of common gaps reads as a preview of what examiners will be asking about. This is a key time to review your risk assessments and assessment procedures against the guidance.

Common Gaps Identified

DFS has identified common gaps in risk assessments contributing to deficient cybersecurity programs. This non-exhaustive list of observations includes:

• Failure to account for assets, leading to an incomplete view of risks, asset scope, and visibility, including outdated or incomplete asset inventories; a failure to identify where NPI resides or flows; and the omission of critical business processes, third-party service providers, cloud environments, or other external dependencies.
• Weak or inconsistent methodologies, including failing to consistently identify, analyze, prioritize, and document risks, to evaluate the effectiveness of existing controls, or to distinguish between inherent and residual risk.
• A failure to account for evolving and interconnected risks, including emerging technologies, changes in the threat landscape, interdependencies, concentration risk, and single points of failure.
• Insufficient governance and risk treatment, including failing to assign ownership, document risk response decisions, integrate assessment results into enterprise governance, or update assessments after material changes to the business, technology, or threat environment.
• A failure to inform the cybersecurity program, resulting in policies, controls, and resource decisions that are not demonstrably based on the entity’s identified cyber risks.

Best Practices

To address these gaps, DFS provides an overview of best practices below:

• Ensure the Board Hears About Risk Assessments: Covered entities should ensure a CISO or senior officer oversees the risk assessment process and communicates the results to senior management to inform decisions regarding risk allocations, cybersecurity prevention, and controls.
• Develop Consistent and Repeatable Methodologies that Inform Successful Risk Assessments: DFS suggests that using harmonized criteria promotes consistency in how risks are identified, measured, and prioritized across the organization, supports clearer communication to management and the board, and enables more coordinated and effective risk mitigation efforts.
• Identify the Scope of Risk Assessments: Tailor the scope of risk assessments to each covered entity’s own business model, technology environment, and risk profile. Effective risk assessments should cover all assets, emerging risks, third-party risk, and concentration risk. Assets and factors include hardware, software, infrastructure, human capital, processes, and data such as NPI.
• Evaluate Third-Party Service Providers and Collective Risk: Risk assessments should evaluate cybersecurity risks associated with third-party service providers. The evaluation should consider the sensitivity of the information accessed or maintained, the level of connectivity to the covered entity’s information systems, and the potential operational impact should the provider experience an incident or other disruption. This could include an evaluation of particular providers such as cloud service providers, managed security service providers, software vendors, payment processors, affiliates, and other organizations that support critical business functions. The evaluation should be viewed holistically, ensuring that technologies, platforms, or vendors that present limited risk when evaluated independently do not collectively create significant cyber risk.
• Treat Documentation and Identification as Key to Evaluating Risk: The guidance highlights that documenting identified risks and gaps enables organizations to prioritize remediation efforts, monitor progress over time, and identify patterns or recurring weaknesses across assessment cycles. Documentation should also capture instances where management elects to accept a risk, including the justification for risk acceptance and any residual risk considerations. Such transparency enables supervisory review to understand the reasonableness of the determination and allows internal stakeholders to better evaluate whether cybersecurity risks are managed systematically. The documentation process should include a mechanism, such as a risk register or comparable tracking process, to record the assessment results, monitor remediation activities, and document changes to residual risk over time.
• Integrate and Update Risk Assessments: Covered entities must review and update risk assessments at least annually but also “as reasonably necessary.” At a minimum, entities should be updating risk assessments whenever a change in their business or technology causes “a material change” to their cyber risk. The guidance notes that the standard “as reasonably necessary” includes many different types of events. For example, major system migrations, mergers or acquisitions, significant outsourcing arrangements, or other important developments in cybersecurity technologies (e.g., frontier AI models), changes in threat actor capabilities, or the adoption of emerging technologies may all constitute material changes to a covered entity’s cyber risk.