Case studyFortune 100: 80% less compliance workRead the Story
RiskWatch
NYDFS · 23 NYCRR Part 500 · Post-2023 amendments

Sign the NYDFS certification with the CEO. Without lying.

The 2023 amendments introduced personal liability through CISO + CEO dual-signature certification. $144M+ in DFS fines since 2021 across 27 consent orders. Material-compliance documentation depth examiners now expect, 8 specific document types maintained continuously, dual-signature workflow with the audit trail both signers see, officer-defense documentation captured throughout the year.

  • All 23 NYCRR Part 500 sections (post-2023 amendments)
  • CISO + CEO dual-signature certification with audit-trail-grade evidence
  • 8 examiner document types maintained continuously
  • Material-compliance assessment per section · officer-defense documentation
No credit card · Part 500 + 2023 amendments ship day 1
app.riskwatch.com / nydfs-500
Live · 23 sections
Part 500 · material compliance
0/100
0 vs prior cert
Cybersecurity Program (§500.2)100%
Risk Assessment (§500.9)92%
Third-Party (§500.11)84%
MFA coverage (§500.12)97%
Sections complete
0/23
Cert documents
0 types
Days to April 15
0d
Material gaps
0 open
Top open items · pre-certification gap closure
MFA exemption documentation (§500.12)
0d
Third-party assessment refresh (§500.11)
0d
BCDR test cadence (§500.16)
0d
Access recert review
0d
CISO board report (§500.4)
0d
What it is

What is NYDFS Part 500 compliance software?

§500.17 is the regulator’s nightmare, CISO and CEO sign jointly. RiskWatch makes the materiality assessment defensible per section, captures the dual-signature audit trail both signers see, and produces all 8 of the document types DFS examiners always request. Most teams have 3 of 8 ready when the examiner shows up. Aligned to 23 NYCRR Part 500 , all 23 sections, with officer-defense documentation captured continuously.

Why teams move to RiskWatch

$144M in DFS fines since 2021. 27 consent orders. Personal liability now built in.

The 2023 amendments transformed Part 500 from corporate compliance to personal accountability. CISO + CEO sign the certification jointly; DFS often adds certification-violation charges on top of any other Part 500 violation. Examiners now request 8 specific document types, most teams have 3.

Pain #1

CISO + CEO dual-signature on the certification. Personal liability.

The 2023 Second Amendment requires both CEO and CISO to sign the annual certification, and certification must be based on data and documentation sufficient to demonstrate “material” compliance. Dual-signature workflow with evidence-backed certification, neither signer attests to anything not backed by audit trail.

Pain #2

Examiners ask for 8 specific documents. Most teams have 3.

DFS examiners routinely request: cybersecurity policy, system architecture and data flow diagrams, IR + BCDR plans, risk assessment reports, CISO board reports + governance minutes, training logs + access recertifications, annual cert justifications, third-party assessments. All 8 maintained continuously, examiner-aligned format, audit-trail-grade.

Pain #3

Material compliance qualifier ≠ partial compliance. DFS adds cert violations on top.

The June 2023 amendment added “material” to the certification standard. But DFS often adds certification-violation charges whenever it finds any other Part 500 violation, exposing executives to personal jeopardy. Materiality assessment per section, with the audit trail showing what was material vs immaterial, defensible if DFS challenges the cert.

§500.17 dual-signature certification

Both signers attest. Both face personal liability.

The 2023 amendments require CEO and CISO to sign the annual certification jointly. Each signature carries personal liability for material compliance. Both signers see the same audit trail, materiality assessments per section, supporting evidence for every assertion, and the officer-defense documentation that proves the certification was based on data, not just attestation.

When DFS challenges a certification (which happens, DFS adds certification-violation charges on top of any other Part 500 violation), the audit trail is what defends both officers. The platform captures it continuously throughout the year so April 15 cert is confirmation, not retrospective justification.

§500.17 dual-signature certification
CISO + CEO sign jointly. Personal liability for both.
Step 1·CISO
Reviews material-compliance evidence per §500.17
Step 2·CISO
Signs certification, attests to material compliance
Step 3·CEO
Reviews CISO attestation + executive summary
Step 4·CEO
Co-signs certification, joint personal liability begins
Materiality assessment per section
Material gap· Section significantly out of compliance · cannot certify
Immaterial gap· Documented gap with mitigating controls · acceptable
Material compliance· Defensible evidence of compliance · cert-eligible
Officer-defense documentation capturedBoth signers see the same audit trail
DFS examiner request · 8 document types
What examiners always ask for. Maintained continuously.
1
Cybersecurity Policy + Program
§500.2 / §500.3
Q4 2026
2
System Architecture + Data Flow Diagrams
Network topology + data classification
Q3 2026
3
IR + BCDR Plans
§500.16
Q4 2026
4
Risk Assessment Reports
§500.9
Q3 2026
5
CISO Board Reports + Governance Minutes
§500.4
Q4 2026
6
Training Logs + Access Recertifications
§500.14 + §500.7
Q4 2026
7
Annual Cert Justifications
§500.17, material-compliance evidence
Apr 2026
8
Third-Party Service Provider Assessments
§500.11
Q4 2026
All 8 current · DFS-defensibleMost teams have 3. We maintain all 8.
8 examiner document types

What DFS always asks for. Most teams have 3 of 8.

The DFS examiner document request is consistent across examinations: cybersecurity policy + program, system architecture diagrams, IR + BCDR plans, risk assessments, CISO board reports, training logs + access recertifications, cert justifications, and third-party assessments. Most NY-licensed FIs have policy + IR + risk assessments, and scramble for the rest the week before the exam.

The platform maintains all 8 continuously in DFS-aligned format. When examiners arrive, you hand them a current pack, not a 90-day-old one with stale dates that triggers follow-up requests.

The dual-signature workflow gave both of us the same audit trail. CEO signed because the evidence was there. CISO signed because there was no surprise gap.
VG
Victor G.
CISO · NY-licensed insurer · 4,200 employees · multi-state
Cert prep time
↓ 60%
vs prior year
Material gaps
0
at cert date
Time-to-deploy
5 weeks
first cycle
Cert Pack · 26 pages
NYDFS Part 500
Dual-Signature Certification + 8-Doc Examiner Pack
PDF + Word + Excel · CEO + CISO defensible

NYDFS Cert + Examiner Pack

Twenty-six page pack covering all 23 sections + dual-signature workflow + materiality assessment template + all 8 DFS examiner document types in DFS-aligned format.

  • Per-section materiality template
  • Dual-signature workflow
  • 8 examiner-doc templates
  • Officer-defense doc guide
Get the pack

Looking for NYDFS ↔ NIST CSF ↔ FFIEC ↔ GLBA crosswalk? Find it on the compliance frameworks hub.

FAQ

Common questions, answered up front.

About NYDFS 23 NYCRR Part 500, the 2023 amendments, dual-signature certification, examiner documentation, and how RiskWatch covers all of them.

What is NYDFS Part 500 compliance software?
NYDFS Part 500 compliance software is a platform that helps NY-licensed financial institutions, insurance companies, mortgage servicers, money transmitters, and other covered entities comply with 23 NYCRR Part 500. The 2023 amendments (effective Nov 1, 2023; full requirements by Dec 31, 2025) added personal liability through CISO + CEO dual-signature certification, expanded third-party service provider oversight, mandatory MFA for everyone, and enhanced incident response. RiskWatch covers all 23 sections, the dual-signature certification workflow, the 8 examiner document types, and cross-mapping to NIST CSF + FFIEC + GLBA.
What changed in the 2023 amendments?
The 2023 Second Amendment added personal liability through CISO + CEO dual-signature certification (both must sign per §500.17). It introduced 'material compliance' as the certification standard and expanded third-party service provider oversight (§500.11). It made MFA mandatory for everyone accessing covered systems unless the CISO grants a written exemption. December 31, 2025 was the deadline for full implementation; April 15, 2026 was the first certification date under the amended rules.
What 8 document types do DFS examiners request?
DFS examiners routinely request: (1) cybersecurity policy + program documentation, (2) system architecture and data flow diagrams, (3) incident response + BCDR plans, (4) risk assessment reports, (5) CISO board reports + governance minutes, (6) training logs + access recertification records, (7) annual certification justifications + materiality assessments, (8) third-party service provider assessments + policies. RiskWatch maintains all 8 continuously in examiner-aligned format.
How does the dual-signature certification work?
The 2023 amendments require both CEO and CISO to sign the annual certification of compliance with Part 500. Both signers attest to material compliance, and the certification must be 'based on data and documentation sufficient to demonstrate' that compliance. RiskWatch's dual-signature workflow gives both signers visibility into the same audit trail, materiality assessments per section, and the supporting evidence for every assertion. Personal liability for both signers is real; the workflow is designed to give them the documentation they'd need to defend the cert if DFS challenges it.
Is there a free trial?
Yes. The 30-day free trial includes full access, all 23 sections, dual-signature certification workflow, examiner-document templates, MFA coverage tracker, third-party oversight workflow, and cross-mapping to NIST CSF/FFIEC/GLBA.
Ready for April 15?

Build your certification pack this week.

Start a 30-day free trial, all 23 Part 500 sections, dual-signature certification workflow, examiner document templates, MFA tracker, third-party oversight, and cross-mapping. No credit card required.

No credit card required · 30-day free trial · Cancel anytime

Request a Demo