| Audience | Verified position | Recommended platform requirement |
|---|---|---|
| NYDFS-covered entities | The 10 September 2026 risk-assessment guidance clarifies requirements and good practices; DFS explicitly says it creates no new obligations. It discusses repeatable methodologies and consistent likelihood-and-impact criteria. (dfs.ny.gov) | Preserve assessment methodology versions, scoring rationale, supporting inputs and approval history. |
| Banks and credit unions | The September interagency third-party guidance remains a proposal, with comments due 16 November 2026. (govinfo.gov) | Make risk-tiering and monitoring workflows configurable; retain the rationale for differentiated treatment. |
| Healthcare organisations | HHS’s official Security Rule proposal page continues to describe the measure as proposed and states that the current Security Rule remains in effect during rulemaking. No new final-rule deadline is established by that page. (hhs.gov) | Separate existing obligations from proposed changes in the obligations register; require compliance review before activating new mappings. |
Sources cited on this page
- dfs.ny.gov ↗www.dfs.ny.gov
- govinfo.gov ↗www.govinfo.gov
- hhs.gov ↗www.hhs.gov