23 NYCRR 500 + GLBA: The Compliance Overlap for Financial Firms

23 NYCRR Part 500 and GLBA overlap only when a firm holds a New York DFS license and also falls under a GLBA rule, and 15 U.S.C. 6805 decides which GLBA rule that is.

That second half is where most firms go wrong. They treat GLBA as a single rulebook, discover that Part 500 also applies, and assume they are looking at two overlapping cybersecurity regimes. Sometimes they are. Often the two rules they think they hold are not the two they actually hold.

So this is a sorting exercise first. Compliance comes after. Work out which door each rule came through, and the overlap either resolves into something manageable or turns out not to exist.

The underlying controls are the same work either way, which is the managed IT side of this rather than the subject here. What follows is the mapping. It is shorter than you would expect.

GLBA Is Not One Rule. Section 6805 Decides Which One Is Yours

The Gramm-Leach-Bliley Act does not contain a cybersecurity rulebook. It tells other agencies to write one, and then it hands out jurisdiction. That is the whole mechanism.

15 U.S.C. 6805(a) assigns enforcement across the banking agencies, the SEC, the state insurance authorities, and the FTC, each “with respect to financial institutions and other persons subject to their jurisdiction under applicable law.” Four of its paragraphs decide almost every case a small firm in this area runs into.

• Paragraph (5) sends investment advisers registered with the Commission to the SEC, which is why an SEC-registered RIA answers to Regulation S-P.
• Paragraph (6) sends any person engaged in providing insurance to “the applicable State insurance authority of the State in which the person is domiciled.”
• Paragraph (7) is the residual. The FTC gets everyone the other paragraphs did not name, which is how the Safeguards Rule at 16 CFR 314 ends up covering state-registered advisers, mortgage brokers, and a long list of businesses that do not think of themselves as financial institutions at all.
• Paragraphs (1) through (4) route banks, credit unions, broker-dealers, and investment companies to their own regulators.

Read paragraph (6) again if you run an agency. A New York insurance licensee’s GLBA obligations are administered by the New York State insurance authority, which means the Department of Financial Services, and the rule it wrote is 11 NYCRR Part 420, governing nonpublic personal information held “by all licensees of the Insurance Department.”

Note the title number. Part 420 is Title 11. Part 500 is Title 23. Same state, same department administering both, two different titles of the code, and they cover different subject matter. Part 420 is privacy and disclosure. Part 500 is cybersecurity. A firm that has read one has not read the other.

The practical consequence is the correction I make most often on first calls. An insurance agency is generally not under the FTC Safeguards Rule. Section 6805(a)(6) routed it elsewhere before the FTC’s residual paragraph could reach it. Content telling a New York agency to comply with 16 CFR 314 is usually describing somebody else’s obligation. We build to the rule that applies, which is why our work with insurance agencies starts with the licenses rather than with a checklist.

Part 500 Reaches You Through the License, Not the Business You Think You’re In

Part 500 does not care what your firm calls itself. One hook. The hook is a piece of paper from Albany.

23 NYCRR 500.1 defines a covered entity as “any person operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the Financial Services Law, regardless of whether the covered entity is also regulated by other government agencies.”

That last clause is the whole answer to the overlap question, written into the definition. Being regulated by the SEC does not take you out of Part 500. Neither does being regulated by the FTC. DFS anticipated the argument and closed it in the same sentence that opened the door. Read it twice.

It cuts the other way too, and this is the part that surprises advisory firms. If you hold no authorization under those three laws, Part 500 does not reach you at all. A registered investment adviser is registered under the Investment Advisers Act, not the Insurance Law. No DFS license, no Part 500, no matter how much client money sits on your network. That lands badly in both directions.

Which Firms Are Genuinely Under Both

Here is the mapping for the firm types we see across Rockland, Westchester, and Bergen.

Two rows in that table deserve more than a cell.

The mortgage broker line is the cleanest true overlap in New York, and almost nobody writes about it. That firm holds a DFS license, so Part 500 applies in full. None of the earlier paragraphs of section 6805 name it, so the FTC’s residual paragraph catches it and the Safeguards Rule applies too. Two cybersecurity frameworks, two regulators, one small office. Nobody plans for that. The same loan file, sitting in the same document management system, is nonpublic information under a New York regulation and customer information under a federal one at the same moment, with two definitions, two sets of expectations, and two regulators entitled to ask about it.

The last row lands closest to home for the firms we work with, so it gets its own section.

One Office, Two Rulebooks

A great many small advisory practices in this area run a second entity that holds a New York insurance license. Annuities, life, long-term care. The advisory work and the insurance work sit in different legal entities for good reasons that have nothing to do with technology.

They also sit on the same network.

One server or one Microsoft 365 tenant. One email domain, sometimes two that resolve to the same mailboxes. One file share, one backup, one firewall, and one IT provider. One of everything. The entities are separate on paper and identical in every way that matters to a cybersecurity regulation.

So the licensed entity is a Part 500 covered entity and the advisory entity is not, while both run on infrastructure nobody has split. In practice the higher standard governs the equipment, because there is no way to apply an access control policy to half a domain controller. It does not divide. When the agency’s Part 500 program puts multi-factor authentication on every remote access point, the advisory side inherits it the same afternoon, because the firewall, the Microsoft 365 tenant, and the remote desktop gateway have no idea which entity a given user was hired by.

One provision is worth knowing before you conclude you owe two full programs. Section 500.19(b) says an employee, agent, wholly owned subsidiary, representative or designee of a covered entity, who is itself a covered entity, “is exempt from this Part and need not develop its own cybersecurity program to the extent that” it is covered by the other covered entity’s program. Agencies writing under a carrier sometimes sit partly inside that provision. The phrase “to the extent that” is doing real work there, so read it against your actual arrangement rather than assuming it clears the whole obligation.

And check the limited exemption before you scope any of this. Section 500.19(a) exempts a covered entity with fewer than 20 employees and independent contractors including affiliates, or under $7.5 million in gross annual revenue in each of the last three fiscal years, or under $15 million in year-end total assets. Most small agencies qualify on at least one prong. What it buys is narrower than the word exemption suggests, which we covered in our walkthrough of what Part 500 actually requires of a New York agency.

Where the Frameworks Disagree About Your IT Vendor

If you are under two of these, the vendor requirements are where the difference becomes operational, because each framework asks for something slightly different about the same provider.

Three rules, three answers on whether a contract is required. The FTC says yes. The SEC considered it and said no. DFS splits the difference, asking for guidelines addressing due diligence and contractual protections, which is softer than a mandate and harder than nothing.

The practical rule for a firm under more than one is to build to the strictest and document once. A written vendor policy that names your providers, records the due diligence, sets minimum practices, and points at a contract clause satisfies all three, and none of them penalize you for exceeding them. In a five-person agency that list usually runs to about four names, covering the IT provider, the agency management system, the email and file platform, and whoever hosts the website that collects quote requests.

Note also that Part 500’s limited exemption does not touch 500.11. Look at the list in 500.19(a): sections 500.4, 500.5, 500.6, 500.8, 500.10, 500.14(a)(1), (a)(2) and (b), 500.15 and 500.16. Ten places, and the vendor policy is not among them. Check the list. A small agency that qualifies for every prong of the exemption still owes the third-party service provider policy in full.

Which is the part where your IT provider stops being a vendor and becomes a source of evidence. VJNetworks has worked in the Tri-State area for over 20 years, with a 97% client retention rate, and fully managed support starts at $995 a month. When something breaks, someone from my team responds within 15 minutes during business hours. The reason that matters to a compliance conversation is that the response is logged, and a logged response is the kind of thing all three of these frameworks eventually ask you to produce.

Sorting Out Which Rules Are Yours