The IT Controls NY Insurance Agencies Need Before Their Next DFS Audit

The controls a New York insurance agency owes under 23 NYCRR Part 500 are only half of a DFS examination, because the regulation also requires documentation proving each one, kept for five years.

Every transitional period in the amended regulation has now closed. The last one expired November 1, 2025. There is no phase-in left to point at.

Which changes the conversation I have with agency owners. For two years the honest answer to “do we have to do this yet” was often “not quite.” That answer is gone.

What follows is the control list itself, section by section, and the artifact that proves each one. If you need the prior question answered first, whether your agency is covered at all and which deadlines apply, that is our walkthrough of who Part 500 covers. This piece assumes you already know you are in scope. It also assumes somebody is running the underlying systems properly, which is the managed IT work we do for insurance agencies rather than the subject here.

The Regulation Asks for Proof, in Writing

Start with the sentence most agencies have never read, because it is the one that turns a checklist into an evidence problem.

Section 500.17(b) says the April 15 certification must be based upon data and documentation sufficient to accurately determine and demonstrate material compliance. Not a belief. Not your provider’s assurance. Documentation.

The same section then tells you how long to keep it. Five years. Every record, schedule, and piece of supporting data behind that certification, held for examination and inspection by the Department on request, including the areas that needed improvement and the remediation plans you wrote for them.

Read those two obligations together and the shape of an examination becomes obvious. Nobody arrives to admire your firewall. They ask what you certified, and then they ask you to show the file behind it. In practice that means working backward from a single signed page to the risk assessment that shaped the program, the policies that came out of the program, the approval record showing a senior officer signed those policies, and the dated artifacts proving each control actually ran during the year you certified.

There is a second path in the same section, and it is underused. If you cannot certify material compliance, you file an acknowledgment instead, naming every section you fell short on and attaching a remediation timeline. An honest acknowledgment is a legitimate filing. Use it. A certification you cannot support is a different thing entirely.

The Limited Exemption Removes Ten Sections, Not Two

Most summaries of the small-agency exemption say it excuses a dedicated CISO and annual penetration testing. That is two items out of ten, and it leaves out the parts that matter most.

Section 500.19(a) exempts a qualifying agency from ten places in the regulation. Ten places.

• 500.4, the CISO requirement.
• 500.5, vulnerability management. That is annual penetration testing and the automated scanning alongside it.
• 500.6, audit trails.
• 500.8, application security.
• 500.10, dedicated cybersecurity personnel.
• 500.14(a)(1), monitoring what authorized users do with nonpublic information, and 500.14(a)(2), the controls that filter web and email traffic for malicious content.
• 500.14(b), endpoint detection and centralized logging.
• 500.15, encryption of nonpublic information in transit and at rest.
• 500.16, the written incident response plan and the business continuity and disaster recovery plan.

Encryption and incident response. Those are the two nobody mentions, and they are the two an agency owner assumes are table stakes.

Worth being precise about what that means. The exemption removes the regulatory obligation. It does not make encrypting client data a bad idea, and it does not mean an agency with no written incident response plan will handle a bad morning well. Your carriers and your own cyber policy will ask about both regardless of what DFS requires of you. An agency that drops encryption and incident response planning because the regulation stopped asking has not reduced its risk by a single percentage point. It has only moved those two items off a compliance list and onto the pile of things nobody owns until somebody asks a hard question about them. The exemption is a floor, not a plan.

What You Still Owe, and What Proves It

Here is the working list. Left column is the section, middle is the control, right is the artifact I would want in the folder before an examiner asks.

Twelve rows. Nine of them are documents rather than technology, which is the part owners find irritating and also the part that gets them through an examination.

One row deserves a closer look, because it is where I see the most confident wrong answers.

The MFA Exception Needs a CISO You Do Not Have

Section 500.12 has two parts. The first sets the scope. For a limited-exemption agency that means multi-factor authentication on remote access to your systems, on remote access to third-party applications from which nonpublic information is reachable, and on all privileged accounts other than service accounts that cannot log in interactively.

The second part is the escape hatch, and it is written narrowly. If the covered entity has a CISO, the CISO may approve in writing the use of reasonably equivalent or more secure compensating controls, reviewed at least annually.

Follow that through. Your agency claimed the limited exemption, which excused you from 500.4, the section that would have required a CISO. So you probably do not have one. And without one, there is nobody the regulation authorizes to approve a compensating control in place of MFA.

Which means the practical answer for most small agencies is that MFA is not negotiable at the three points named above. There is no documented workaround available to you. The exemption you claimed is what closed that door.

Few agency owners have connected those two sections. It matters most for the legacy carrier portal or the old line-of-business application that will not take a second factor, because the instinct is to write a memo explaining the exception. A memo is not what the regulation contemplates. Fix the access path or replace the application. Two roads, not three.

The Filing Most Exempt Agencies Never Made

Qualifying for the limited exemption is not the same as claiming it.

Section 500.19(f) requires a covered entity that qualifies for any exemption under that section to file a Notice of Exemption electronically, in the form on the Department’s website, within 30 days of determining that it is exempt. That is an affirmative filing with a deadline attached to a determination you made internally, possibly years ago. Did anyone file it?

Agencies miss this constantly. They read the thresholds, conclude correctly that they qualify, and then do nothing, because qualifying felt like the end of the task rather than the trigger for a form.

The reverse case has a clock too. If you stop qualifying, which revenue growth or a hiring run will usually cause, section 500.19(h) gives you 180 days from the date you cease to qualify to comply with every applicable requirement of the Part. Not 180 days from when somebody notices. From the date it happened.

So the threshold check is an annual exercise, not a one-time determination. Put it next to the risk assessment review and do both in the same sitting. Same afternoon, once a year.

What DFS Actually Fined a Limited-Exemption Licensee For

The common objection at this point is that the Department has bigger targets than a fifteen-person agency in Rockland. Worth testing against a real consent order rather than a feeling.

On August 5, 2026, DFS settled with Order Express, a licensed money transmitter, for $250,000 over an inadequate cybersecurity risk assessment. The company is not an insurance agency, and the detail that matters here is not its line of business. It qualified for the same limited exemption you may be relying on, under the revenue threshold, and it still qualifies.

The findings were a chain, not a gadget. The risk assessment was not sufficient to inform the design of the cybersecurity program. Because the assessment was deficient, the program built on it could not properly identify and assess risks to nonpublic information. And the written policies addressing systems and network security were not implemented and maintained.

Sections 500.9, 500.2, and 500.3. Every one of them survives the limited exemption, and every one of them is a document.

That is the whole argument for treating the evidence file as the deliverable. If an examiner had walked in and asked only which security tools were installed, the answer might well have been reassuring, which is precisely why the regulation asks a different question and asks for the answer in writing.

Where the File Usually Falls Apart

Four patterns, from actually building these.

The risk assessment is generic. Somebody downloaded a template, filled in the agency name, and never mapped it to the actual agency management system, the carrier portals, the email tenant, or the shared drive where scanned applications and loss runs have been piling up since 2019. 500.9(b) asks for written criteria for evaluating and categorizing risks and for how identified risks get mitigated or accepted. A template has none of that specific to you.

Access reviews get done and not recorded. Somebody genuinely checks who has access to what, agrees it looks right, and closes the tab. No dated artifact, no list of names, nothing to hand an examiner. The work happened and the evidence does not exist. Date everything.

Vendor oversight is a folder of certificates. The Department’s own guidance is direct that relying on a provider’s own certification is not adequate due diligence, and 500.11 asks for your process, not their paperwork. A register with a risk rating and a review date per vendor is the artifact. It earns its place the moment it records what nonpublic information each vendor can actually reach, because that one column is what turns an abstract obligation into a real conversation about whether the agency management system vendor needs standing access to everything or just to the part they were hired to run. We are a vendor to agencies ourselves, and VJNetworks is not a covered entity under Part 500. The obligation to oversee us stays with you.

MFA is confirmed by looking at the wrong screen. Enabled in a policy is not the same as enforced on an account. The export you want lists every user and the state of their second factor, which is a different thing from a screenshot of the toggle.

None of this needs a large budget. We work with agencies of 5 to 60 employees, and for most of them this is a few weeks of assembling and then an annual rhythm. The expensive version is the one that starts six weeks before a filing.

Things Agencies Get Wrong About Part 500

None of this is a technology project, which is the part I would want an owner to take away. It is a filing habit with some engineering attached. That is the whole job. Agencies that keep the file current answer an examination from a folder. The ones that do not spend April trying to reconstruct a year they can no longer remember. The compliance side of this is where our DFS cybersecurity and compliance work sits. And the same nonpublic information sits inside New York’s SHIELD Act requirements, which apply on their own terms and to plenty of agencies that never touch a DFS filing.