DFS press release, September 10, 2026
New York DFS Tells Financial Firms: Your Risk Assessment Is the Program
The New York State Department of Financial Services issued guidance spelling out its expectations for risk assessments under its Cybersecurity Regulation, 23 NYCRR Part 500. DFS reminded regulated entities that risk assessments must be reviewed and updated at least annually, and whenever business or technology changes materially alter cyber risk, and it detailed what it looks for: governance and oversight, methodology, scope, documentation, and real integration into the cybersecurity program. The Department specifically flagged reassessment around major technology changes, concentration in a single cloud or service provider, and emerging risks such as AI adoption. DFS noted the guidance clarifies existing obligations rather than adding new ones, and published it alongside a refreshed Cybersecurity Resource Center.
Executives
Your regulator just published its grading rubric. If your risk assessment is a dated document that the security program does not visibly follow, that gap is now the easiest finding a DFS examiner can write. Expect questions about AI adoption and single-provider concentration at board level.
CIO / CISO
Align the assessment calendar to the rule: at least annual, plus event-driven updates for migrations, acquisitions, new critical systems, and material AI deployments. Document methodology and scope decisions, and trace each material risk to a control change, a monitoring change, or a signed acceptance.
Engineers
Feed the assessment real data: asset inventories, third-party dependency maps, and architecture diagrams that match production. When a new system or AI tool goes live, trigger the reassessment workflow as part of the change, not as an afterthought.
Everyone (non-IT)
If you bank or insure in New York, this guidance is part of why your institution keeps asking security questions and updating controls. State regulators are telling firms to prove their security homework is current, and to redo it whenever their technology changes in a big way.