Compliance & Privacy · 2026-10-26
NYDFS 500.12 Evidence Pack: The Records Examiners Ask To See
By J. W. Bouckaert
The rule is short and the record is long
Section 500.12(a) of 23 NYCRR Part 500, as amended on 1 November 2023 and fully in force since 1 November 2025, says that "multi-factor authentication shall be utilized for any individual accessing any information systems of a covered entity". The Department's own one-pager restates it without qualification: for any individual, any information system, "regardless of location, type of user, and type of electronic information". Section 500.12(b) allows one alternative: "If the covered entity has a CISO, the CISO may approve in writing the use of reasonably equivalent or more secure compensating controls. Such controls shall be reviewed periodically, but at a minimum annually." A small-business exemption under 500.19(a) narrows the scope to remote access, third-party applications holding nonpublic information, and privileged accounts. Section 500.20(b)(2) makes "the material failure to comply for any 24-hour period" a violation.
Our earlier post on the Second Amendment covered what the rule requires and argued for continuous re-evaluation as the way to meet it. This post is narrower and later. The transition windows have closed. Section 500.22(d)(4) gave covered entities two years from the Second Amendment's effective date of 1 November 2023 to comply with the new requirements of sections 500.12 and 500.13(a), so those requirements have applied since 1 November 2025. Section 500.17(b)(1) requires, by 15 April each year, a certification of material compliance during the prior calendar year, or an acknowledgment of the sections not complied with. The filing due on 15 April 2026 covers 2025, a year in which the new section 500.12 applied only from 1 November. The filing due on 15 April 2027 is the first certification covering a full calendar year under the fully effective rule. The Department has said in its own words what an examiner looks at. The evidence pack below is built from three sources: the regulation's text, the Department's published guidance and training, and the consent orders in which it wrote down what was missing.
The examiner's own list
The Department runs "regular, risk-based examinations that include a focus on cybersecurity", scoped by an entity's prior examination reports, its annual notifications and its reported incidents, alongside the CIBRiQ questionnaire and a Cyber Intelligence Unit that scans from outside. Requests arrive in pre-examination letters; the 2014 letter that introduced cybersecurity to safety-and-soundness examinations asked institutions to "identify and describe the current use of multi-factor authentication for any systems or applications", and the December 2021 MFA guidance said the Department "is also increasing its review of MFA during examinations, with a particular emphasis on probing for the common MFA failures discussed in this Guidance".
The most direct statement is a February 2026 training the Cybersecurity Division gave on MFA. Its slide on supervision lists what the Department considers: "Status and sufficiency of implementation", "Documentation and reasonableness of risk-based determinations", "Governance & Oversight Practices", "Scope of implementation (e.g., has MFA been implemented with third-party platforms?)" and "Risk-based decisions, exceptions, and compensating controls". Its slide on compensating controls lists four considerations: "Documented Risk Justification", "Risk-Aligned Design", "CISO Approval & Ongoing Validation" and "Control Strength". And its slide on common examination themes names five: "Incomplete MFA Coverage", "MFA Implementation in High-Risk Environments", "Authentication & Session Control Gaps", "Limited Monitoring & Detection" and "Privileged Access Exceptions".
The training names those fourteen phrases: five for what supervision considers, four for a compensating control, and five for common examination themes. Each artefact below is the record for one or more of them.
Twelve artefacts
1. The information system inventory, with an MFA status per system. Coverage is the first theme and the first consent-order finding. National Securities did not have MFA "fully implemented for all users" until August 2020 and had one of more than sixty third-party applications still without it when the order was signed in 2021; Carnival had not completed MFA on a subsidiary's Office 365; Healthplex's MFA was "not completely operational" for Office 365 reached from an external browser. The inventory is the 500.13 asset inventory with a column that says, per system, how MFA is enforced and by what, and it has to include cloud email and document hosting, which the FAQs say "are Information Systems that require the use of MFA".
2. The third-party platform list. The training's scope question is specific: "has MFA been implemented with third-party platforms?" The October 2025 guidance on third-party service providers adds that contracts should require TPSP access controls "including multi-factor authentication, that comply with requirements in Sections 500.7 and 500.12", and that the Department reviews the policies addressing TPSP risk during examinations. The artefact is the list of vendor platforms reachable by the entity's people, the MFA enforcement on each, and the contract clause behind it.
3. The factor inventory. Section 500.1(j) defines MFA as two of knowledge, possession and inherence, and the FAQs say that "using only factors from the same category (e.g., a password + PIN) does not qualify". The FAQs also say what a possession factor is: it "commonly involves cryptographic proof of possession, which means the system can mathematically verify that the key or token is real and unique to the user and associated with a specific device"; a "remember this device" cookie is "a session token that can be easily copied" and does not count, and device identifiers without cryptographic proof, unbound software certificates and MDM signals "must be paired with other security controls". The artefact lists every factor type in use, by population, and whether it meets that description.
4. The SSO and bypass analysis. "SSO alone does not meet the requirements of Section 500.12", and the Department "expects Covered Entities to ensure that MFA enforcement is centrally managed, applies consistently to all federated and integrated systems, and cannot be bypassed through legacy logins, direct application access, or API connections that circumvent SSO controls". The 2021 guidance named the specific bypass it kept finding: "Microsoft email services which employ only basic, non-MFA legacy authentication". The artefact is the list of authentication paths into each system, including the ones that do not go through the identity provider, with each one either closed or covered.
5. The exceptions register. "Privileged Access Exceptions" is one of the five themes, and the 2021 guidance is blunt about the pattern: "Exceptions to the MFA requirement should be granted sparingly, tracked, and last only as long as necessary", and it describes "the so-called 'C-Suite exemption,' where a senior member of the company simply refused to use MFA". The register lists every account not under MFA, why, who approved it, when it expires, and the compensating control that covers it in the meantime.
6. The CISO's written compensating-control approvals. Where an exception rests on 500.12(b), the writing is the control. National Securities "did not present sufficient evidence that these controls were approved in writing by the entity's CISO"; Healthplex likewise had "no reasonably equivalent or more secure access controls ... approved in writing by the Company's Chief Information Security Officer". The training's four considerations set the content: a documented risk justification, a design aligned to that risk, the CISO's approval with a plan for ongoing validation, and an assessment of the control's strength. Each approval is dated, and the annual review that 500.12(b) requires is dated too.
7. The privileged account census and its reviews. Section 500.7 requires privileged accounts to be limited in number and function, used only when needed, and reviewed "at a minimum annually", with access terminated promptly on departure. The findings are specific: OneMain's privilege reviews were manual "introducing a high risk of human error", its local administrators "shared accounts", accounts "still used the default password provided by OneMain at the time of user onboarding", and a password "was stored in a folder named 'PASSWORDS'"; Genesis had "a lack of a formal program to periodically recertify user access". The 2021 guidance adds the reason the census matters most: "In every case where cybercriminals escalated privileges during a reported Cybersecurity Event, the privileged account lacked MFA." The artefact is the census, the dated reviews, and the leaver reconciliation.
8. The public-facing system determinations. The FAQs say covered entities "generally will not have to implement MFA for most public websites" but must apply it where a public system "allows unauthenticated access to the Covered Entity's other Information Systems" or "otherwise poses a material cybersecurity risk", and that entities "should document these determinations and related risk factors". PayPal's order, under the pre-amendment rule, found that customer MFA "was optional" and that the Department expected it, along with rate limiting and CAPTCHA, on customer accounts holding nonpublic information. The artefact is the determination per public-facing system, with its reasoning.
9. The enrolment and change controls. The 2021 guidance described incidents in which attackers "exploited MFA 'self-setup' to setup MFA controlled by the cybercriminal", and the May 2026 letter's first recommendation was to "restrict MFA enrollment and changes to authorized processes with strong identity verification", for example IT approval for new authenticator devices. The artefact is the enrolment procedure and the log of authenticator changes with their approvals.
10. The monitoring evidence. "Limited Monitoring & Detection" is a theme in its own right. The artefact is the authentication log retained under 500.6, the alerting on failed and anomalous MFA events, and, per the 2021 guidance, the audit or penetration test results that "include verification of MFA control strength and identification of weaknesses or gaps in MFA as implemented and configured", with material weaknesses reported to the board.
11. The risk assessment linkage. The September 2026 guidance on risk assessments says the Department "expects each Covered Entity to be able to demonstrate how its Risk Assessment informed cybersecurity controls, compensating controls, and risk acceptance decisions", including "records that link each identified cybersecurity risk to the specific controls or compensating measures implemented". For MFA the artefact is the rows of the assessment that name credential theft, phishing and SIM swapping, and the controls in artefacts 3, 5 and 6 that each row points to.
12. The certification file. Section 500.17(b) requires the annual certification, signed by the highest-ranking executive and the CISO, to rest on "data and documentation sufficient to accurately determine and demonstrate such material compliance", kept for five years and produced on request; nothing is filed with it. Four of the six orders above found certifications improper or false because the underlying controls were not what the signature said. The artefact is the file that shows what the two signatories looked at, and the FAQs' warning that several immaterial gaps "in the aggregate" might be material is the reason artefacts 1 through 11 are in it.
The factors the Department has ranked
Section 500.12 "does not mandate the use of any specific type of MFA", and the Department has said what it thinks of each type anyway. The July 2025 one-pager calls SMS "a weaker authentication method as it is susceptible to SIM-swapping and interception", push without number matching "vulnerable to push fatigue attacks", push with number matching "more secure", and hardware tokens "strong protection through physical possession". The FAQs accept push notifications and add that push-based MFA "is not phishing-resistant", recommending number matching, contextual login details and retry limits. The October 2024 letter on AI advised avoiding "authentication via SMS text, voice, or video" in favour of "digital-based certificates and physical security keys". The May 2026 letter recommended phishing-resistant methods "such as authenticator applications with number matching or hardware tokens", while stating that it "does not establish new legal requirements". The 2021 guidance had already said that "text message-based MFA is vulnerable to SIM-swapping".
An entity whose factor inventory shows SMS as a primary possession factor is holding a factor the Department has described, in four documents from December 2021 to May 2026, as the weak one: the December 2021 guidance, the October 2024 letter on AI, the July 2025 one-pager, and the May 2026 letter. The examiner asks what compensating evidence exists that the number was still in the customer's possession when the factor was used. A carrier-state check at authentication reads a SIM swap or a port-out from the carrier's records and logs that reading beside the event. That reading is compensating evidence paired with the factor. The February 2026 training states the possession standard as "cryptographic or technical proof that the user controls a specific device, token, or authenticator at the time of authentication." In the pack the check appears in artefact 3 beside the factor, in artefact 6 where a CISO relies on it as a compensating control, and in artefact 10 as the log line when the carrier state changed.
A sample control narrative for 500.12
A control narrative is the paragraph an examiner reads before the evidence. One shape that answers the training's five considerations:
Multi-factor authentication is enforced for all individuals accessing all information systems of the entity through the central identity provider, which is the sole authentication path for the systems listed in the inventory (artefact 1); legacy authentication, direct application login and API access that would bypass it are disabled, as recorded in the path analysis (artefact 4). Factors in use are a FIDO2 credential or a password with an authenticator application using number matching; SMS is retained for one customer-facing population and is paired with a carrier-state check at each use (artefact 3). Nine accounts are excepted; each is listed with its expiry and the CISO's written approval of the compensating control, last reviewed on the date shown (artefacts 5 and 6). Privileged accounts number forty-one, each under MFA, reviewed quarterly, with the last review and the leaver reconciliation attached (artefact 7). Authenticator enrolment and changes require identity verification and approval, and are logged (artefact 9). Authentication events are retained and alerted on, and the annual penetration test included MFA control strength (artefact 10). The risk assessment rows for credential theft, phishing and SIM swapping point to these controls (artefact 11).
Every number in that paragraph comes from an artefact named in it, and an examiner can compare the paragraph with that record.
Left open
Two things this pack cannot supply. Whether the Department will publish an examination manual for Part 500, as it has not, so that the fourteen phrases become a checklist rather than an inference from a training deck and a run of orders. And how examiners will treat phishing-resistant factors in the certification cycle now beginning, given that every DFS document since 2024 recommends them and none requires them. The DORA register post and the NIS2 evidence post build the same kind of pack for two European regimes; the artefacts overlap far more than the statutes do, which is the argument for keeping one pack and mapping it three ways.