Insurance agency or mortgage broker? What NYDFS Part 500 now requires — even if you're small

If your business holds a license from the New York Department of Financial Services — insurance agents and brokers, mortgage brokers, lenders and servicers, money transmitters — you're covered by DFS's cybersecurity regulation, 23 NYCRR Part 500, no matter how small you are. Coverage depends on the license, not your headcount.

This is practical guidance, not legal advice. Confirm your obligations with DFS guidance or counsel.

The timeline that just finished

DFS's amended regulation rolled out in phases (DFS implementation timeline):

• November 1, 2024: encryption policy, updated incident response and business continuity/disaster recovery plans, and more.
• May 1, 2025: automated vulnerability scanning, tighter access privileges, and malicious-code and email/web filtering controls.
• November 1, 2025: multi-factor authentication for all users and a written asset inventory.

Covered entities certify compliance to DFS every year by April 15.

“But we have the small-business exemption”

The limited exemption in section 500.19(a) applies if you have fewer than 20 employees and independent contractors (including affiliates), or under $7.5 million in gross annual revenue from New York operations in each of the last three years, or under $15 million in year-end total assets.

It reduces your obligations — it doesn't eliminate them. DFS publishes a checklist for limited-exemption entities, and it still includes core items like MFA for remote access, third-party applications, and privileged accounts, plus an asset inventory. Check that list line by line.

What a small agency usually needs to do

1. Turn on MFA everywhere — Microsoft 365 or Google Workspace, remote access, carrier and lender portals, the agency management system.
2. Build an asset inventory: every computer, phone, server, and cloud system that touches nonpublic information, with owner and location.
3. Encrypt laptops and backups.
4. Write it down: a cybersecurity policy, an incident response plan, and a business continuity plan sized for your agency.
5. Back up and test restores — DFS cares that you can recover, not just that a backup exists.
6. Keep records so your annual certification is backed by evidence.

When to call a tech

We set up MFA, inventories, encryption, backups, and the documentation small agencies need — then keep it current with monitoring so April isn't a scramble. Call and we'll walk through your setup against the DFS checklist.