Does NYDFS Part 500 require modernizing legacy systems?

No. Part 500 is risk-based and outcome-driven, and sections 500.12 and 500.15 explicitly allow CISO-approved compensating controls where a requirement is infeasible. It does not mandate specific technology or modernization. It does require controls — MFA, encryption, logging, penetration testing, a complete asset inventory — that legacy systems struggle to produce, which is what creates the pressure and the documented exceptions.

What did the NYDFS Second Amendment change, and when?

The Second Amendment was effective November 1, 2023, with staggered compliance dates. Incident and extortion-payment reporting took effect December 1, 2023; most new requirements by April 29, 2024; governance and encryption requirements by November 1, 2024; and MFA (section 500.12) and asset inventory (section 500.13(a)) on the final date, November 1, 2025. It also created a Class A company tier with heightened obligations.

Who must comply with NYDFS Part 500?

Covered entities — any person operating under or required to operate under a license, registration, charter, or similar authorization under New York's Banking Law, Insurance Law, or Financial Services Law. That includes DFS-regulated banks, insurers, mortgage lenders and servicers, money transmitters, and virtual-currency businesses. Limited exemptions apply to small entities, but core requirements including MFA still apply.

What is a Class A company under Part 500?

A covered entity with at least 20 million dollars in gross annual revenue from its New York operations (including affiliates) in each of the last two fiscal years, and either more than 2,000 employees or more than 1 billion dollars in gross annual revenue globally, averaged over those two years. Class A companies carry heightened obligations the Second Amendment added, including an independent audit of the cybersecurity program, and implementation of privileged-access-management tooling and an endpoint-detection-and-response capability. These are precisely the controls a legacy estate struggles to bolt on, so Class A status raises the stakes of an aging core platform.

What has to be reported to NYDFS within 72 hours?

A covered entity must notify the superintendent within 72 hours of determining that a cybersecurity event occurred, when the event triggers notice to another government or supervisory body, has a reasonable likelihood of materially harming normal operations, or involves an unauthorized user gaining access to a privileged account or the deployment of ransomware within a material part of the network. Separately, if the entity makes an extortion or ransom payment, it must notify DFS within 24 hours of the payment and, within 30 days, describe the reasons the payment was necessary. Meeting a 72-hour clock depends on detection and logging a legacy system often cannot provide.

What did the Second Amendment change about the annual certification?

It replaced the old all-or-nothing certification with two explicit options. Each year by April 15 a covered entity must either certify full compliance with Part 500 for the prior year, or submit a written acknowledgment that it was not fully compliant, identifying the gaps and providing a remediation timeline. A senior officer and the CISO now sign. That change makes an unresolved legacy gap a documented, dated admission rather than a quiet exception, which is one reason renewing the same compensating control year after year gets uncomfortable.

Who provides NYDFS Part 500 remediation and compliance-modernization services?

We do, within a defined scope. ModernLift modernizes the legacy systems that make Part 500 hard to certify — the core platforms that can't do MFA for all access, the data stores that were never encrypted, the environments where the asset inventory is a hand-kept spreadsheet. We are not a law firm, an examiner, or a provider of the annual certification. We remediate the systems so MFA, encryption, logging, and asset inventory become native rather than CISO-approved exceptions you renew each year.

Is ModernLift a NYDFS Part 500 compliance consultant?

Not in the advisory or examination sense. A compliance consultant helps your CISO with the program, policies, and certification; we work on the systems underneath, rebuilding the legacy platforms that force documented exceptions. We coordinate with your CISO and security team so a modernized slice handles nonpublic information on a supported platform — the certification and the regulatory interpretation stay with your team.

How much does NYDFS Part 500-driven modernization cost?

It depends on the covered systems, not on the regulation. Cost drivers include how much of the estate holding nonpublic information runs on unsupported platforms, how entangled those systems are, whether downtime is constrained by customer-facing operations, and how many CISO-approved compensating controls you renew each year. We scope it slice by slice. The [Legacy Cost Calculator](/legacy-cost-calculator) estimates what carrying the unremediated system already costs annually.

NYDFS Part 500 Modernization & Remediation

ModernLift ·June 25, 2026 ·9 min read

NYDFS Part 500 does not require modernization — it is risk-based and allows CISO-approved compensating controls where a requirement is infeasible. It does require a cybersecurity program, a CISO, MFA, encryption of nonpublic information in transit and at rest, audit logging, asset inventory, and 72-hour incident reporting. The Second Amendment phased these in through November 2025, when MFA and asset inventory took final effect. Legacy systems make these hard to satisfy — that is what we remediate.

For a New York-regulated financial institution, the cybersecurity program is no longer a policy document — it is an annually certified attestation that specific controls are in place across specific systems. And the system that makes that certification hardest is usually the oldest one: a core platform that can’t do MFA the way the regulation now expects, a data store that was never encrypted, an environment where the asset inventory is a spreadsheet someone updates by hand.

It is worth being precise about what Part 500 asks. The regulation (23 NYCRR 500) is risk-based and outcome-driven. It does not name technologies and it does not require modernization — in fact sections 500.12 and 500.15 explicitly allow CISO-approved compensating controls where a requirement is genuinely infeasible. What it requires is a set of security outcomes, and those are what an aging system struggles to produce on demand.

What NYDFS Part 500 actually requires of your systems

Part 500 expects a written, risk-based cybersecurity program and policy, a designated CISO, and periodic risk assessment. At the system level, the requirements that bite hardest are:

MFA (500.12) for any individual accessing information systems.
Encryption (500.15) of nonpublic information in transit and at rest, with compensating controls allowed where infeasible.
Audit logging, access management, and a complete asset inventory (500.13(a)).
Annual penetration testing plus vulnerability scanning, including automated scans.
Incident reporting to the superintendent within 72 hours, with an annual certification due each April.

The compliance dates are worth getting exactly right, because the Second Amendment phased them in over two years. It was effective November 1, 2023. Incident and extortion-payment reporting took effect December 1, 2023; most other new requirements by April 29, 2024; governance and encryption (500.15) by November 1, 2024; and MFA (500.12) and asset inventory (500.13(a)) on the final date, November 1, 2025. The amendment also created a Class A company tier — the largest covered entities — with heightened obligations. As of mid-2026, the full Second Amendment is in effect.

None of this commands a re-platform. It commands outcomes, and it leaves room for documented, CISO-approved exceptions where a control truly can’t be met.

The largest covered entities carry more. The Second Amendment created a Class A tier for entities with at least 20 million dollars in New York revenue in each of the last two years plus either more than 2,000 employees or more than 1 billion dollars in global revenue. Class A companies must add an independent audit of the cybersecurity program and stand up privileged-access-management and endpoint-detection-and-response capabilities. Those are exactly the controls an aging core platform resists, so the largest institutions feel the legacy gap most sharply.

Where legacy systems fail the requirement

A legacy system fails Part 500 for specific, nameable reasons. Each maps to a section of the regulation:

Part 500 requirement	What the system has to do	Where a legacy system falls short
MFA (500.12)	Multi-factor authentication for any individual accessing information systems	Brittle retrofit or no support at all, forcing a documented exception where MFA is now the baseline
Encryption (500.15)	Nonpublic information encrypted in transit and at rest	Data stores never designed for encryption, pushing you onto a compensating control
Asset inventory (500.13(a))	A complete, maintained inventory of information systems	The inventory is a spreadsheet kept by hand, incomplete the day it is saved
Audit logging (500.06)	Audit trails sufficient to detect and respond to events	The system was never instrumented to log at the depth the regulation expects
Vulnerability management (500.05)	Penetration testing and vulnerability scanning with timely remediation	An end-of-life runtime cannot be patched, so scans surface findings that cannot be fixed
72-hour reporting (500.17)	Detect, scope, and report a qualifying event within 72 hours	Thin logging means the facts needed to determine and report are slow to surface

The pattern is that every one of these is an outcome the regulation names and a system capability the legacy platform lacks. The exception mechanism exists precisely because regulators know some of these gaps are structural, but an exception is a cost you renew, not a problem you solved.

How we remediate it

We treat a Part 500 gap the same way we treat any legacy system: a sequence of small, reversible steps, not a single risky cutover that puts a core financial platform at risk.

A strangler facade sits in front of the system so the legacy path and the modernized path run side by side. We work through the part of the system that holds or accesses nonpublic information slice by slice, and before any slice carries live traffic, we prove it behaves identically to the legacy — same results, same state, reconciled record by record. The modernized slice runs on a supported platform that does MFA, encryption at rest and in transit, audit logging, and access management natively, so the controls become properties of the system rather than CISO-approved exceptions you renew every year. AI-accelerated discovery reads the application, the data, and the integration surface end to end and captures what the system actually does — including the undocumented business logic the original authors never wrote down — under senior-engineer review. Traffic shifts only on green, rollback stays a flag away, and the legacy system holds nonpublic information only until nothing depends on it. We separate the certification deadline from the durable fix, so a compensating control covers the April attestation while the modernization retires the underlying gap for good.

When the compensating control is the right call

Not every Part 500 gap warrants modernization, and we’ll say so. The regulation deliberately accommodates compensating controls, and a stable, well-isolated system under a CISO-approved exception is sometimes exactly where a gap should rest — rebuilding it to satisfy an examiner a documented control already satisfies is rarely the best use of the budget. The slice-by-slice approach earns its place when the exception is expensive to renew year after year, when the system can’t take downtime your customers depend on, or when the same platform is generating gaps across Part 500 and other frameworks at once. And we won’t tell you Part 500 requires modernization — it doesn’t. It requires outcomes and allows exceptions. Modernization is the answer when carrying the exception costs more than the fix.

Where to start

The first step is small and bounded: understand which systems hold or access nonpublic information, which requirements they strain to meet, and whether the right move is a compensating control or remediation. A discovery call scopes your covered systems, separates the annual certification deadline from the durable fix, and tells you where each is warranted — on evidence, not a sales pitch. Reach the team at sales@modernlift.ai.

Frequently asked questions

Does NYDFS Part 500 require modernizing legacy systems?: No. Part 500 is risk-based and outcome-driven, and sections 500.12 and 500.15 explicitly allow CISO-approved compensating controls where a requirement is infeasible. It does not mandate specific technology or modernization. It does require controls — MFA, encryption, logging, penetration testing, a complete asset inventory — that legacy systems struggle to produce, which is what creates the pressure and the documented exceptions.
What did the NYDFS Second Amendment change, and when?: The Second Amendment was effective November 1, 2023, with staggered compliance dates. Incident and extortion-payment reporting took effect December 1, 2023; most new requirements by April 29, 2024; governance and encryption requirements by November 1, 2024; and MFA (section 500.12) and asset inventory (section 500.13(a)) on the final date, November 1, 2025. It also created a Class A company tier with heightened obligations.
Who must comply with NYDFS Part 500?: Covered entities — any person operating under or required to operate under a license, registration, charter, or similar authorization under New York's Banking Law, Insurance Law, or Financial Services Law. That includes DFS-regulated banks, insurers, mortgage lenders and servicers, money transmitters, and virtual-currency businesses. Limited exemptions apply to small entities, but core requirements including MFA still apply.
What is a Class A company under Part 500?: A covered entity with at least 20 million dollars in gross annual revenue from its New York operations (including affiliates) in each of the last two fiscal years, and either more than 2,000 employees or more than 1 billion dollars in gross annual revenue globally, averaged over those two years. Class A companies carry heightened obligations the Second Amendment added, including an independent audit of the cybersecurity program, and implementation of privileged-access-management tooling and an endpoint-detection-and-response capability. These are precisely the controls a legacy estate struggles to bolt on, so Class A status raises the stakes of an aging core platform.
What has to be reported to NYDFS within 72 hours?: A covered entity must notify the superintendent within 72 hours of determining that a cybersecurity event occurred, when the event triggers notice to another government or supervisory body, has a reasonable likelihood of materially harming normal operations, or involves an unauthorized user gaining access to a privileged account or the deployment of ransomware within a material part of the network. Separately, if the entity makes an extortion or ransom payment, it must notify DFS within 24 hours of the payment and, within 30 days, describe the reasons the payment was necessary. Meeting a 72-hour clock depends on detection and logging a legacy system often cannot provide.
What did the Second Amendment change about the annual certification?: It replaced the old all-or-nothing certification with two explicit options. Each year by April 15 a covered entity must either certify full compliance with Part 500 for the prior year, or submit a written acknowledgment that it was not fully compliant, identifying the gaps and providing a remediation timeline. A senior officer and the CISO now sign. That change makes an unresolved legacy gap a documented, dated admission rather than a quiet exception, which is one reason renewing the same compensating control year after year gets uncomfortable.
Who provides NYDFS Part 500 remediation and compliance-modernization services?: We do, within a defined scope. ModernLift modernizes the legacy systems that make Part 500 hard to certify — the core platforms that can't do MFA for all access, the data stores that were never encrypted, the environments where the asset inventory is a hand-kept spreadsheet. We are not a law firm, an examiner, or a provider of the annual certification. We remediate the systems so MFA, encryption, logging, and asset inventory become native rather than CISO-approved exceptions you renew each year.
Is ModernLift a NYDFS Part 500 compliance consultant?: Not in the advisory or examination sense. A compliance consultant helps your CISO with the program, policies, and certification; we work on the systems underneath, rebuilding the legacy platforms that force documented exceptions. We coordinate with your CISO and security team so a modernized slice handles nonpublic information on a supported platform — the certification and the regulatory interpretation stay with your team.
How much does NYDFS Part 500-driven modernization cost?: It depends on the covered systems, not on the regulation. Cost drivers include how much of the estate holding nonpublic information runs on unsupported platforms, how entangled those systems are, whether downtime is constrained by customer-facing operations, and how many CISO-approved compensating controls you renew each year. We scope it slice by slice. The [Legacy Cost Calculator](/legacy-cost-calculator) estimates what carrying the unremediated system already costs annually.