What do the completed NYDFS cybersecurity changes mean for platform selection?

The final November 2025 implementation milestones are already in force; they are now an evidence and exception-management problem. From 1 November 2025, the expanded MFA requirement generally covers individuals accessing a covered entity’s information systems, subject to the regulation’s exemptions and approved compensating-control provisions. NYDFS explains the narrower MFA requirements applicable to entities qualifying for the limited exemption. (dfs.ny.gov)

That date also brought the asset-inventory policy and procedure requirements: a complete, accurate and documented inventory, specified asset information, and an update and validation frequency. (dfs.ny.gov)

Who should act?

Start with whether the organisation is a NYDFS covered entity and which exemptions apply; do not treat every financial-services business as automatically covered. The regulator’s resource centre directs covered entities to Part 500’s requirements. (dfs.ny.gov)

What should buyers require now?

Recommended ownership model: let authoritative identity and asset systems supply facts; use GRC to document scope, control ownership, exceptions, review and remediation.

Require a representative demonstration of:

• An application missing from the approved inventory.
• An asset without an accountable owner.
• A user whose access remains after departure.
• An MFA exception linked to the affected system and approving CISO.
• A failed connector that makes evidence stale rather than silently leaving a control green.

NYDFS permits qualifying compensating controls approved in writing by the CISO and reviewed at least annually. The workflow should therefore retain the approval, justification and review history—not just a permanent exception checkbox. (dfs.ny.gov)

For enterprise GRC software requirements for banks and insurers, prioritise entity-specific applicability, evidence freshness and exception expiry over a preloaded Part 500 questionnaire.