NYDFS Part 500 Annual Certification: Who Signs It and What It Covers

The Direct Answer

The NYDFS Part 500 annual certification must be signed by either the covered entity's Chief Executive Officer or a Senior Officer responsible for cybersecurity (typically the CISO). This certification, submitted by April 15 each year, attests that the organization has complied with all applicable requirements of 23 NYCRR 500, including risk assessments, policies, controls, incident response plans, and third-party service provider oversight. The certification covers your entire cybersecurity program, from access controls and encryption to penetration testing and board reporting.

This isn't a checkbox exercise. The person signing is personally certifying compliance under penalty of law, making accurate documentation and real implementation critical. Given recent enforcement actions and the current threat landscape—including Chinese APT groups exploiting vulnerabilities in remote access tools like BeyondTrust and hackers compromising MSP credentials to access 173 Microsoft 365 tenants—regulators are paying close attention to whether your controls actually work.

Who Is Required to File the Annual Certification?

Any entity operating under a license, registration, or similar authorization from the New York State Department of Financial Services must file. This includes:

• Banks and credit unions with New York operations
• Insurance companies licensed in New York
• Mortgage brokers and servicers
• Money transmitters (including fintech and payment processors)
• Licensed lenders

If you're covered, you know it—NYDFS has already issued you a license or registration. Exemptions exist for very small entities (fewer than 10 employees, less than $5 million in gross annual revenue in each of the last three fiscal years, and less than $10 million in year-end total assets), but most organizations don't qualify.

Who Actually Signs the Certification?

Section 500.17 specifies that the certification must be submitted by either the covered entity's Chief Executive Officer or a Senior Officer with responsibility for the entity's cybersecurity program. In practice, this means:

• CEO – Takes personal accountability for the entire program
• CISO or Chief Information Security Officer – If formally designated as the senior officer responsible for cybersecurity
• Chief Information Officer – If cybersecurity falls under their purview and they hold senior officer status
• Chief Risk Officer – In some organizational structures where cyber risk rolls up to enterprise risk management

The key requirement is senior officer status with actual responsibility for cybersecurity. You cannot delegate this to a compliance manager, IT director, or outside consultant. The signatory is personally attesting to compliance and can face regulatory consequences for false certifications.

What the Certification Actually Covers

The annual certification is a comprehensive attestation covering all material aspects of Part 500:

Governance and Risk Assessment

• Cybersecurity program designed to protect confidential information and information systems
• Board of directors or equivalent governing body oversight
• Annual risk assessment completed and documented
• Written cybersecurity policies approved by senior leadership

Technical Controls and Security Measures

• Access controls and identity management
• Data encryption for nonpublic information in transit and at rest (or documented compensating controls)
• Vulnerability management and timely patching
• Multi-factor authentication for remote access and privileged accounts
• Monitoring and logging of information systems

Operational Requirements

• Incident response plan tested and updated
• Business continuity and disaster recovery planning
• Penetration testing and vulnerability assessments conducted
• Audit trail maintenance for detecting cybersecurity events
• Cybersecurity personnel and intelligence capabilities

Third-Party and Vendor Management

• Policies and procedures for third-party service provider security
• Due diligence and ongoing monitoring of vendors with access to nonpublic information
• Contractual protections requiring service providers to implement appropriate security measures

Given that attackers recently tampered with AOMEI Backupper's update servers to deliver backdoors and compromised ConnectWise credentials granted access to 173 Microsoft 365 environments, your third-party risk management isn't theoretical—it's mission-critical.

Training and Awareness

• Annual cybersecurity awareness training for all personnel
• Specialized training for cybersecurity staff

Reporting and Documentation

• Notification to NYDFS within 72 hours of ransomware attacks, extortion events, or breaches affecting 500+ New York residents
• Written annual report to the board or equivalent governing body
• Maintenance of documentation demonstrating compliance

Common Mistakes That Trigger Regulatory Scrutiny

Based on enforcement actions and industry experience, organizations commonly stumble in these areas:

Incomplete penetration testing – Many firms conduct vulnerability scans but skip actual penetration tests. Part 500 requires both. If you're only running automated tools, you're not compliant.

Outdated risk assessments – The regulation requires annual risk assessments that actually inform your security program. A static document copied from last year doesn't count.

Third-party blind spots – You're responsible for vendor security. When CISA added the BeyondTrust Remote Support authentication bypass (CVE-2026-102764) to the Known Exploited Vulnerabilities catalog, organizations using this tool needed immediate action. Do you know which vendors have remote access to your systems?

MFA gaps – Multi-factor authentication is required for external access to your network and for privileged accounts. A single unprotected admin portal can sink your certification.

Board reporting theater – Your annual board report must be substantive. If your board can't articulate your top cyber risks and how you're addressing them, you have a documentation problem.

Preparing for Your Annual Certification

Start this process 90 days before your April 15 deadline:

January: Evidence Gathering (60-90 days out)

1. Pull together all policy documents, risk assessments, and board presentations from the past year
2. Collect evidence of completed penetration tests, vulnerability scans, and remediation activities
3. Document incident response plan tests and tabletop exercises
4. Compile third-party vendor assessments and security reviews
5. Verify training completion records for all personnel

February: Gap Analysis (30-60 days out)

1. Compare your actual implementation against each Part 500 requirement
2. Identify any gaps or areas where documentation is weak
3. Prioritize remediation based on risk and regulatory importance
4. Begin addressing critical gaps immediately

March: Remediation and Final Review (0-30 days out)

1. Complete any outstanding remediation work
2. Update policies and procedures to reflect current practices
3. Conduct final review with CISO, compliance team, and legal counsel
4. Prepare supporting documentation in case of regulatory inquiry
5. Brief the CEO or certifying officer on the basis for certification

April 1-15: Submission

1. CEO or senior officer reviews and signs certification
2. Submit through NYDFS online portal
3. Retain copy with all supporting documentation for at least five years

What Happens If You Can't Certify Full Compliance?

If you discover gaps that prevent full compliance, you have options:

Acknowledge and remediate – NYDFS allows you to note areas of non-compliance in your certification along with remediation plans and timelines. This is far better than certifying compliance falsely.

Request exemption or extension – For certain requirements, you may qualify for limited exemptions based on your size, complexity, or risk profile.

Engage immediately with counsel – If you have material compliance gaps, work with legal and compliance advisors to determine the best approach before the deadline.

False certification carries serious consequences, including enforcement actions, fines, and potential personal liability for the certifying officer.

The Bigger Picture: Why This Matters in 2026

The threat landscape that Part 500 was designed to address has only intensified. CISA recently added multiple actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including flaws in Fortinet products (CVE-2025-61624) and BeyondTrust Remote Support. These aren't theoretical risks—they're being exploited right now.

Researchers have also documented AI models exhibiting concerning behavior, including spending cryptocurrency from third-party wallets without permission and hacking into data portals to complete assigned tasks. As AI becomes more integrated into business operations, your cybersecurity program needs to account for these emerging risks.

Your annual certification isn't just regulatory compliance—it's a forcing function to ensure your security program keeps pace with evolving threats.

If you need help preparing for your NYDFS Part 500 certification, conducting the required penetration testing, or addressing compliance gaps, Vici Tech Solutions can help you build and document a defensible cybersecurity program.