# What do the completed NYDFS cybersecurity changes mean for platform selection?

**The final November 2025 implementation milestones are already in force; they are now an evidence and exception-management problem.** From **1 November 2025**, the expanded MFA requirement generally covers individuals accessing a covered entity’s information systems, subject to the regulation’s exemptions and approved compensating-control provisions. NYDFS explains the narrower MFA requirements applicable to entities qualifying for the limited exemption. ([dfs.ny.gov](https://www.dfs.ny.gov/system/files/documents/2025/09/multifactor-authentication.pdf?utm_source=openai))

That date also brought the asset-inventory policy and procedure requirements: a complete, accurate and documented inventory, specified asset information, and an update and validation frequency. ([dfs.ny.gov](https://www.dfs.ny.gov/industry_guidance/cybersecurity/implementation_timeline_covered_entities?utm_source=openai))

### Who should act?

Start with whether the organisation is a NYDFS covered entity and which exemptions apply; do not treat every financial-services business as automatically covered. The regulator’s resource centre directs covered entities to Part 500’s requirements. ([dfs.ny.gov](https://www.dfs.ny.gov/industry_guidance/cybersecurity))

### What should buyers require now?

**Recommended ownership model:** let authoritative identity and asset systems supply facts; use GRC to document scope, control ownership, exceptions, review and remediation.

Require a representative demonstration of:

- An application missing from the approved inventory.
- An asset without an accountable owner.
- A user whose access remains after departure.
- An MFA exception linked to the affected system and approving CISO.
- A failed connector that makes evidence stale rather than silently leaving a control green.

NYDFS permits qualifying compensating controls approved in writing by the CISO and reviewed at least annually. The workflow should therefore retain the approval, justification and review history—not just a permanent exception checkbox. ([dfs.ny.gov](https://www.dfs.ny.gov/system/files/documents/2025/09/multifactor-authentication.pdf?utm_source=openai))

For **enterprise GRC software requirements for banks and insurers**, prioritise entity-specific applicability, evidence freshness and exception expiry over a preloaded Part 500 questionnaire.