← Back to Blog Compliance

NYDFS 23 NYCRR 500: Cryptography Requirements

10 min read

The New York State Department of Financial Services (NYDFS) Cybersecurity Regulation, codified at 23 NYCRR 500, was the first state level cybersecurity rule with teeth in the United States financial services sector. The original regulation took effect on 1 March 2017, and was significantly amended in November 2023 with effective dates phased through November 2024. The amended rule expands cryptographic obligations, formalizes encryption requirements for nonpublic information, and adds Class A company designations with stricter controls.

This article walks through the cryptographic requirements in 23 NYCRR 500, identifies the parts of the rule that touch encryption directly, and explains how the post quantum transition is showing up in NYDFS examinations.

Who 23 NYCRR 500 Covers

The regulation applies to "Covered Entities", which are persons operating under a license, registration, charter, certificate, or similar authorization from NYDFS. This sweeps in banks, insurance companies, mortgage lenders, money transmitters, virtual currency businesses, and other regulated financial entities operating in New York. A Covered Entity that has fewer than twenty employees, less than five million USD in gross revenue, and less than ten million USD in year end assets may qualify for limited exemption under Section 500.19, but most regulated entities are not exempt.

The 2023 amendment created the Class A category for the largest entities (over twenty million USD revenue and over two thousand employees). Class A companies face additional requirements including independent audits and more stringent privileged access controls.

Where Cryptography Sits

23 NYCRR 500 references cryptography in several sections:

Section 500.15, Encryption of Nonpublic Information
Section 500.7, Access Privileges and Management
Section 500.14, Monitoring and Training (including malware protection that depends on signed updates)

Section 500.15 is the central cryptographic provision. It requires Covered Entities to implement controls including encryption to protect nonpublic information held or transmitted by the Covered Entity, both in transit over external networks and at rest.

The Original 2017 Text

The 2017 version of Section 500.15 was qualified. It required encryption "to the extent feasible" and permitted compensating controls when encryption was not feasible, subject to review by the Covered Entity's Chief Information Security Officer at least annually. The "to the extent feasible" language was intended to recognize that some legacy systems could not easily implement encryption.

Examiners interpreted this clause narrowly. By 2020, NYDFS examination findings were citing many Covered Entities for failing to implement encryption where feasibility was clearly within reach with modern tooling.

The 2023 Amendment

The November 2023 amendment tightened Section 500.15. The amended text requires encryption of nonpublic information at rest and in transit over external networks, with the feasibility safety valve still available but more narrowly applied. Compensating controls now require explicit CISO review and senior officer attestation.

The amendment effective dates phase the changes. Some provisions took effect 1 December 2023 (the date the amended rule was published in final form). Encryption related provisions and the Class A controls had effective dates spread through April and November 2024.

What Counts as Nonpublic Information

23 NYCRR 500.1(g) defines Nonpublic Information broadly. It includes business related information of a Covered Entity the unauthorized disclosure of which would cause material adverse impact, and any information about an individual that includes name plus account number, social security number, credit or debit card number, biometric information, password, security question and answer, or healthcare related information.

The breadth of this definition means almost everything in a Covered Entity's customer database is in scope, plus internal business information that has competitive or financial value. This is a broader scope than HIPAA's protected health information or PCI DSS's cardholder data, and the encryption obligation tracks the broader scope.

Required Encryption: At Rest

The amended 500.15 requires encryption of all nonpublic information held by the Covered Entity. The acceptable algorithms are not enumerated in the regulation. NYDFS expects Covered Entities to follow industry standards, which in practice means NIST cryptographic guidance.

Storage encryption mechanisms acceptable to NYDFS examiners include:

Full disk encryption (BitLocker, FileVault, dm-crypt) for endpoint devices
Database transparent data encryption with key management in a hardware security module
Application level encryption for sensitive columns
Cloud provider encryption with customer managed keys for cloud hosted systems
Backup encryption for tapes and snapshots

Algorithms must use AES-128 or stronger with appropriate modes. RC4, DES, and 3DES are not acceptable. Hashing for credentials uses bcrypt, scrypt, Argon2, or PBKDF2 with sufficient parameters.

Required Encryption: In Transit

Section 500.15 also requires encryption of nonpublic information in transit over external networks. The regulation does not define "external network" but examination practice treats it as any network not under the direct control of the Covered Entity, including the public internet, third party connections, and cellular data networks.

Acceptable transit encryption mechanisms include TLS 1.2 or 1.3 with strong cipher suites, IPsec with strong configurations, and SSH for management traffic. SSL all versions, TLS 1.0, and TLS 1.1 are not acceptable.

Internal network traffic is not strictly required to be encrypted under 500.15, but examiners frequently recommend encryption of internal traffic carrying nonpublic information, especially in segmented network architectures.

Compensating Controls

Where encryption is not feasible, the Covered Entity may use compensating controls. The amended rule requires:

Documentation of why encryption is not feasible
Description of the compensating controls
Annual review by the CISO
Approval by a senior officer

Examples of compensating controls that have appeared in NYDFS reviews include enhanced access controls, network segmentation, additional logging and monitoring, and physical security around the unencrypted data. Compensating controls are temporary fixes; the expectation is that the Covered Entity will eventually implement encryption when feasibility allows.

Section 500.7: Privileged Access

Section 500.7 governs access privileges. The amended rule added requirements for:

Limit user access privileges to information systems
Periodically review privileges
Use strong authentication for privileged accounts
Use multifactor authentication for remote access

Multifactor authentication relies on cryptography in tokens, FIDO2 keys, and TOTP secrets. NYDFS examiners look for FIDO2 hardware keys or comparable phishing resistant MFA for privileged users at Class A companies.

The CISO Function

23 NYCRR 500.4 requires the Covered Entity to designate a qualified Chief Information Security Officer responsible for overseeing and implementing the cybersecurity program. The CISO must annually report to the board of directors or equivalent governing body on the cybersecurity program, including the encryption posture.

NYDFS examinations interview the CISO and review board reports. Cryptographic posture is a recurring topic. Examiners ask about algorithm inventory, key management, and emerging threats including post quantum.

Class A Companies

The 2023 amendment created the Class A category. A Class A company is one with at least twenty million USD in gross annual revenue from New York business and at least two thousand employees, calculated using a three year rolling average. Class A companies face additional requirements:

Independent cybersecurity program audits at least once every three years
Stronger privileged access management, including a privileged access management solution
Endpoint detection and response across all endpoints
Annual external penetration testing

Class A entities have larger cryptographic footprints and more complex key management. Examiners hold Class A entities to higher cryptographic hygiene expectations.

NYDFS Examination Practice

NYDFS examiners conduct on site and remote examinations. For cryptographic controls, examiners typically:

Request the cryptographic policy document
Review the algorithm inventory
Sample TLS configurations on internet facing systems
Verify database encryption is enabled in scope systems
Test backup encryption status
Interview the CISO and senior officers
Review board level cybersecurity reports

Findings are categorized by severity. Cryptographic findings range from observations (low severity) to matters requiring attention (medium) to deficiencies that may trigger enforcement action.

Enforcement Actions

NYDFS has a track record of enforcement. Several enforcement actions have specifically cited cryptographic failures:

A 2020 consent order with a major insurance company cited inadequate encryption of customer data, with a settlement of several million USD.
A 2021 consent order with a banking entity cited weak TLS configurations on internet facing services.
A 2023 consent order with a virtual currency entity cited inadequate key management practices.

These cases show that cryptographic failures can trigger material financial penalties under 23 NYCRR 500. The Department also publishes guidance and industry letters that signal areas of focus.

NYDFS and Post Quantum Cryptography

NYDFS has not yet published a specific PQC mandate. Industry letters and conference presentations from Department officials acknowledge the post quantum transition as an emerging risk. The cryptographic policy and algorithm inventory required by 500.15 are the operational hooks for incorporating PQC planning into Covered Entity programs.

Forward looking Covered Entities, particularly Class A companies, are beginning to:

Inventory cryptographic algorithms in use
Engage vendors on PQC roadmaps
Document a PQC migration plan as part of the annual cybersecurity program update
Consider hybrid TLS deployment for high value flows

We discuss the broader payment and financial services context in our PQC for financial services article.

Vendor Risk Management

Section 500.11 requires policies and procedures for third party service provider risk. Covered Entities must conduct due diligence on vendors that have access to nonpublic information and require contractual cybersecurity protections. Encryption of data shared with vendors and encrypted data flows between Covered Entity and vendor are standard contract clauses.

For PQC migration, vendor risk reviews are starting to ask about vendor PQC roadmaps. NYDFS examiners may follow this trend as it matures.

Reporting Obligations

Section 500.17 requires Covered Entities to notify the Superintendent of cybersecurity events within seventy two hours of determining that an event occurred. A cybersecurity event includes any unauthorized access to or disclosure of nonpublic information.

If nonpublic information is encrypted with strong cryptography and the keys remain protected, the unauthorized access may not constitute disclosure. This is structurally similar to HIPAA's safe harbor concept. The encryption provides a defensive position both against the original incident and against the regulatory consequences.

What This Means for New York Regulated Entities

A Covered Entity in 2026 should:

Verify all in scope systems implement encryption at rest with current algorithms.
Verify external transit uses TLS 1.2 or higher with strong cipher suites.
Document compensating controls for any unencrypted nonpublic information with CISO and senior officer approval.
Maintain a cryptographic algorithm inventory and review it annually.
Add PQC migration planning to the cybersecurity program documentation.

FAQ

Q: Does 23 NYCRR 500 require AES-256? A: The regulation does not enumerate algorithms. Industry standard practice favors AES-128 or AES-256 with secure modes. AES-256 is the more conservative choice for long lived data.

Q: Are compensating controls a permanent option? A: They are intended as temporary measures. Examiners will ask about plans to implement encryption.

Q: When does PQC become mandatory under 23 NYCRR 500? A: There is no specific PQC date. The cryptographic policy framework requires algorithms to be strong by industry standards, and the timeline will follow NIST and FIPS guidance.

Q: Does the rule cover internal network traffic? A: Internal network traffic is not strictly required to be encrypted, but examiners often recommend encryption of internal traffic carrying nonpublic information.

Q: How does Class A affect cryptographic requirements? A: Class A entities face additional requirements around privileged access, independent audits, and broader cybersecurity controls. The base encryption requirements apply to all Covered Entities.

Sources

NYDFS, 23 NYCRR Part 500, Cybersecurity Requirements for Financial Services Companies. https://www.dfs.ny.gov/industry_guidance/cybersecurity
NYDFS, Second Amendment to 23 NYCRR 500 (effective 1 November 2023, with phased compliance dates). https://www.dfs.ny.gov/system/files/documents/2023/10/rf_fs_2amend23NYCRR500_text.pdf
NIST SP 800-57, Recommendation for Key Management. https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final
NIST FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA). https://csrc.nist.gov/projects/post-quantum-cryptography
NIST SP 800-52 Revision 2, Guidelines for the Selection, Configuration, and Use of TLS Implementations. https://csrc.nist.gov/pubs/sp/800/52/r2/final
NYDFS Industry Letters and Cybersecurity Guidance. https://www.dfs.ny.gov/industry_guidance

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY