NYDFS Part 500

23 NYCRR Part 500 sets cybersecurity requirements for New York financial-services companies; this page maps its audit-trail, retention, incident-notice and event-classification sections to Asqav receipts.

Updated

23 NYCRR Part 500 (promulgated March 1, 2017) applies to entities authorised under the New York Banking Law, Insurance Law, or Financial Services Law, including state-chartered banks, licensed lenders, insurance companies, and licensed money transmitters. Covered Entities operate in scope independently of size when they fall under one of those licences.

Asqav can sign submitted agent-action records with ML-DSA. It hash-chains receipts, anchors them via RFC 3161 timestamps, and retains them for five calendar years for (a)(1) material-financial-transaction records and three calendar years for (a)(2) cybersecurity audit trails when the nydfs_500 regime tag is set on the organisation.

The receipt format is profiled in the IETF Internet-Draft draft-marques-asqav-compliance-receipts, which binds the format to 23 NYCRR Part 500 with calendar-year retention floors (five years for (a)(1), three for (a)(2)) and an incident_class vocabulary covering 500.1(f) Cybersecurity Events and 500.1(g) Cybersecurity Incidents.

Obligations

Section Requirement Asqav binding
500.6(a) Audit trail designed to detect and respond to Cybersecurity Events with a reasonable likelihood of materially harming material operations. Hash-chained, ML-DSA-signed receipts with RFC 3161 anchors. Receipts re-verifiable independently of the producing system.
500.6(b) Retain (a)(1) material-financial-transaction records for not fewer than five calendar years and (a)(2) cybersecurity audit trails for not fewer than three calendar years. Cleanup job enforces the calendar-year floor for the record class when the nydfs_500 regime tag is set (1827-day worst case only when no record date anchors the window).
500.17(a)(1) Notify the Superintendent within 72 hours of determining a Cybersecurity Incident has occurred. incident_class token marks the reportable 500.1(g) subset so downstream notice workflows can fire programmatically. The audit trail preserves the determination and the surrounding chain.
500.1(f), 500.1(g) Distinguish Cybersecurity Events from the reportable Cybersecurity Incident subset. Two canonical tokens: nydfs_cybersecurity_event and nydfs_cybersecurity_incident.

See the docs for the full mapping and the IETF draft for the binding text.

References