Two letters this year tell you how DFS will read your risk assessment and what it expects you to do about AI-accelerated exploitation. Neither adds a rule. Both raise the bar for the evidence.
NYDFS issued eight cybersecurity industry letters in 2026 through October. Two matter most. The September 10 risk assessment guidance spells out how DFS expects §500.9 assessments to be built, documented and used, and lists the deficiencies it keeps finding. The May 21 frontier AI advisory warns that AI-accelerated vulnerability discovery is coming and asks entities to update risk assessments, revisit remediation timelines and tighten third-party coordination now. Neither creates new obligations. Both tell you what DFS will accept as evidence that you've met the existing ones.
Our Part 500 overview covers the regulation itself: the Second Amendment's last phase (expanded MFA and the asset inventory) took effect November 1, 2025, and the annual certification is due each April 15. This page covers what DFS added this year.
| Date | Letter |
|---|---|
| Jan 22 | Threat alert: phishing scam impersonating DFS |
| Feb 6 | Advisory: targeted "vishing" attacks |
| Mar 3 | Advisory: heightened cyber threats due to global conflict |
| May 21 | Advisory: heightened cybersecurity risks associated with frontier AI models |
| May 21 | Guidance: measures to consider in a heightened cybersecurity threat environment |
| Aug 11 | Alert: N-central vulnerability affecting some managed service providers |
| Sep 10 | Guidance: how to conduct and use risk assessments required by the Cybersecurity Regulation |
| Oct 22 | Alert: critical PHP vulnerabilities that require immediate patching |
Read in sequence, they're one message: the September guidance lists actively exploited vulnerabilities, threat-actor capability changes and geopolitical events among reasons to revisit a risk assessment. Every alert above is a candidate input.
DFS says it reviews risk assessments in examinations and investigations, and opens with what it has been finding. Paraphrased:
Four points in the remedy stand out.
The method is your choice; consistency isn't. DFS doesn't mandate a methodology. It cites NIST CSF 2.0, the Cyber Risk Institute Profile v2.2 and ISO 27005:2022 as options, but expects defined estimates of likelihood and impact, rating criteria consistent enough to compare results over time, and criteria harmonized across third-party risk, IT operations and business continuity.
Third parties are assessed as a portfolio. Providers are evaluated on service criticality, data sensitivity, connectivity and the operational impact of an incident, and DFS warns that individually low-risk components can create significant risk together. That's a concentration analysis most vendor programs don't run.
Traceability is the test. Each risk should link to the controls or compensating measures that address it; risk acceptance needs a written justification; a risk register should track remediation and residual risk over time. DFS wants the decision trail, not just the conclusion.
The board doesn't approve it, but it hears about it. Part 500 doesn't require board approval of the assessment, the guidance notes, but results should reach senior management and, where appropriate, the board.
The May 21 advisory, addressed to CISOs, is blunt: some frontier AI models could increase the power, scale and speed with which attackers find vulnerabilities and develop exploits, and DFS wants entities to strengthen their posture before those capabilities spread. Drawing on a companion heightened-threat guidance, it recommends:
It also asks entities to consider replacing end-of-life and legacy systems. That's the most expensive sentence in the letter.
The September guidance names developments in cybersecurity technology, with frontier AI models as the example, among changes that can call for a risk assessment update, and cites the May advisory directly. So the examiner's question writes itself: what did your assessment say about AI-accelerated exploitation after May 21, and what changed as a result? "Nothing, and here's why" is defensible if documented. Silence isn't.
In April, DFS announced a $2.25 million penalty against two Delta Dental entities over the 2023 MOVEit incident, citing weak incident response, inadequate data retention controls and late reporting.
The August consent order with Order Express, a licensed money transmitter, was smaller — $250,000 — and more on point. After a 2022 ransomware attack encrypted just over half its servers, DFS found its annual assessment covered operational and IT risk but "failed to consider cybersecurity risks and threats specific to the Company" and didn't evaluate the controls it had, so its program was "not based on an adequate risk assessment" (§§500.9(a) and 500.2(b) of the pre-2023 rule). The company qualified for a limited exemption. It was still a risk assessment case.
The September guidance is, at bottom, a traceability standard: risk to control to evidence to decision. PRISM maps one evidence base across 29 frameworks and 2,623 requirements, NYDFS Part 500 included, and its AI Governance module inventories AI systems and assesses AI-specific threats from MITRE ATLAS. Foundations quantifies the resulting risk in dollars — annual loss expectancy and revenue at risk — with board-ready reporting.
PRISM keeps every Part 500 requirement tied to its evidence and puts your AI systems in the same inventory; Foundations turns the assessment into dollar figures your board can act on.