NYDFS 500 vs. DORA: Comparison for European financial institutions

In March 2017, the NYDFS enacted a Cyber Security Regulation (23 NYCRR Part 500), commonly known as NYDFS 500. The intent was to ensure covered entities establish and maintain strong cyber security practices to protect consumers and the financial system’s stability against the relentless increase in attacks by cyber criminals targeting the financial services sector.

In November 2023, NYDFS amended the regulation, adding substantial new requirements. This update was intended to address changes in the cyber security threat landscape and the increasing sophistication and frequency of attacks.

The amendment was also designed to mitigate common weaknesses, which NYDFS believed to be the root cause of security incidents that affected covered entities over the six years since the original regulation was enacted.

Non-compliance with NYDFS 500 can have severe financial implications. Since 2017, NYDFS has imposed fines on at least 16 covered entities, with an average settlement of $2.2 million. Larger institutions have faced penalties in the $4–5 million range. These figures are a stark reminder of the importance of strict adherence to NYDFS 500.

The following sections meticulously compare each aspect of NYDFS 500 to DORA, identifying areas of overlap, additional requirements in NYDFS 500, and other key differences. This detailed comparison ensures that you, as a financial institution, have all the necessary information to comply with both regulations.

500.2 Cyber Security Program

This section requires covered entities to develop and maintain a cyber security program that includes:

Risk Identification and Assessment
Defensive Infrastructure Implementation
Cyber Security Event Detection, Response, and Recovery
Regulatory Reporting

It also requires larger intuitions—designated ‘Class A Companies’—to conduct independent audits of their programs and to make program documentation available to NYDFS upon request.

In DORA, the ICT Risk Management Framework (RMF) is analogous to the Cyber Security Program in NYDFS 500 and includes the exact requirements as NYDFS 500 except for Regulatory Reporting:

Risk Identification and Assessment [Article 8(2)]
Defensive Infrastructure [Article 7]
Detection [Article 10], and Response and Recovery [Article 11]

Like NYDFS 500, DORA also requires regular audits of the RMF [Article 6(6)], and documentation must be submitted to regulators upon request [Article 6(5)].

500.3 Cyber Security Policy

NYDFS directly specifies 15 areas that policies and procedures must address:

Information security
Data governance, classification, and retention
Asset inventory, device management, and end-of-life management
Access controls, including remote access and identity management
Business continuity and disaster recovery planning and resources
Systems operations and availability concerns
Systems and network security and monitoring
Security awareness and training
Systems and application security, and development and quality assurance
Physical security and environmental controls
Customer data privacy
Vendor and third-party service provider management
Risk assessment
Incident response and notification
Vulnerability management

A senior officer or the governing body must review and approve these policies annually.

DORA also requires covered entities to put policies in place [Article 5(2)(b)] and mentions some specific policies throughout the regulation, but the requirements are less direct and prescriptive. The following maps policies required by NYDFS 500 to those specified by DORA:

Information security [Article 9(4)(a))]
Data governance, classification, and retention [not mentioned]
Asset inventory, device management, and end-of-life management [not mentioned]
Access controls, including remote access and identity management [Article 9(4)(c-d)], Article 15(3(b))]
Business continuity and disaster recovery planning and resources [Business Continuity: Article 11(1)]
Systems operations and availability concerns [not mentioned]
Systems and network security and monitoring [not mentioned]
Security awareness and training [not mentioned]
Systems and application security and development and quality assurance [not mentioned]
Physical security and environmental controls [not mentioned]
Customer data privacy [not mentioned]
Vendor and third-party service provider management [not mentioned]
Risk assessment [not mentioned]
Incident response and notification [Incident classification: Article 24(5)]
Vulnerability management [Patch management: Article 9(4)(f))]

DORA doesn’t explicitly state that the management body must approve policies or that they need to be periodically reviewed, except for the Business Continuity policy [Article 5(2)(e))].

500.4 Cyber Security Governance

NYDFS 500 requires covered entities to designate a qualified CISO. The CISO may be from a third-party service provider or affiliate, but the entity retains compliance responsibility.

The CISO must give an annual report on the cyber security program to the senior governing body, which covers the following:

Security Defenses
Policy and Procedures
Risk Assessment
Program Effectiveness
Cyber security Incidents
Gap Remediation

In the interim, the CISO must also promptly report to the senior governing body on any cyber security issues, security events, or significant changes to the program.

The senior governing body is required to exercise oversight of cyber security risk management and has the following responsibilities:

Possess sufficient understanding of cyber security matters for effective oversight
Direct development and maintenance of the cyber security program
Allocate adequate resources for the program
Regularly review cyber security reports

Unlike NYDFS 500, DORA doesn’t include a specific requirement for annual reporting on the state of the RMF to the management body.

DORA’s only explicitly defined reporting requirements specific to the management body are for senior staff to report at least yearly to the management body on lessons learned from penetration testing [Article 13(5)] and to inform the management body of major ICT-related incidents [Article 17(3(e))].

DORA also requires the RMF to be reviewed at least yearly but doesn’t specify management body involvement [Article 6(5)].

Under DORA, the management body is also ultimately responsible for the RMF [Article 5(2(a))] and has all the responsibilities defined in NYDFS 500 except for regularly reviewing cyber security reports:

Keep up to date with sufficient cyber security knowledge and skills [Article 5(4)]
Define, approve, oversee, and be responsible for RMF implementation [Article 5(2)]
Allocate appropriate budget [Article 5(2(g))]

500.5 Vulnerability Management

NYDFS vulnerability management requirements include:

Perform annual internal and external penetration testing by a qualified internal or external party.
Perform automated scans of systems and manual review of systems not covered by automated scans periodically and after material changes.
Implement a process to stay informed of new security vulnerabilities.
Remediate vulnerabilities in a timely, risk-based manner.

DORA has equivalent requirements for penetration testing but is less specific than NYDFS 500 regarding vulnerability scans and patch management.

About penetration testing:

DORA requires all testing to be performed annually, which includes penetration testing [Article 24(6)].
DORA doesn’t explicitly state whether testing needs to be from an internal or external perspective, while NYDFS 500 requires both.
DORA doesn’t specifically require ‘qualified’ testers for penetration testing.

Please note the above statements relate to Article 25 – Testing of ICT tools and systems, which includes penetration testing. DORA has more stringent requirements for Threat-Led Penetration Testing (TLPT) [Articles 26 & 27], but TLPT involves red teaming, which isn’t explicitly required by NYDFS 500.

For vulnerability scanning, the ‘Testing of ICT Tools and Systems’ article includes ‘vulnerability assessments and scans’ in a list of ‘appropriate tests’ [Article 25(1)]. DORA also requires remediation of vulnerabilities [Article 24(5)]. Still, it doesn’t explicitly state that it must be timely, like NYDFS 500, and doesn’t mention the manual review of unscannable systems as required by NYDFS 500.

Concerning monitoring for new vulnerabilities, the ‘Learning and Evolving’ article states that covered entities must have ‘capabilities and staff to gather information on vulnerabilities and cyber threats’ [Article 13(1)].

500.6 Audit Trail

This section requires covered entities to securely maintain systems that collect audit trails designed to detect and respond to cyber security events and can reconstruct material financial transactions.

The security event audit trails must be retained for three years, and the financial transaction logs must be retained for five years.

DORA doesn’t define requirements specific to collecting and managing audit logs.

500.7 Access Privileges and Management

This section requires covered entities to do the following:

Limit user access (i.e., the principle of least privilege)
Review (recertify) user access
Terminate user access when they leave the organization
Define a password policy
Automatically block common passwords
Implement a privileged access management solution
Restrict the number of privileged accounts
Limit privileged account usage
Monitor privileged access activity
Disable remote access protocols

DORA is much less prescriptive in the access management domain. In comparison with NYDFS 500:

Limiting user access is also a requirement in DORA [Article 9(4(c))].
Reviewing user access isn’t directly mentioned but may be implied in a statement that entities must establish policies, procedures, and controls to ensure a sound administration of access rights [Article 9(4(c))].
Terminating leavers’ access isn’t directly mentioned but can also be implied in the statement above.
DORA doesn’t define any specific requirements for passwords.
DORA doesn’t require entities to implement a privileged access management solution or include specific requirements around privileged accounts.
DORA doesn’t require disabling or restricting the use of remote access protocols.

500.8 Application Security

NYDFS 500 requires entities to ensure secure development practices for in-house developed applications and assess the security of externally developed applications. It also requires the CISO to review the associated procedures, guidelines, and standards at least annually.

Source code reviews are included in DORA’s list of appropriate tests under ‘Testing of ICT tools and systems’ [Article 25(1)], but secure software development isn’t mentioned further.

Concerning externally developed applications, DORA requires that third-party service providers participate and fully cooperate with the entity’s Threat-Led Penetration Testing (TLPT) [Article 30(3)(d)].

500.9 Risk Assessment

NYDFS 500 requires covered entities to conduct risk assessments of information systems at least annually and whenever a change in the business or technology causes a material change to the covered entity’s cyber risk.

The assessment must account for risks particular to the covered entity’s business operations, technological developments, and evolving threats and explain how the identified risks will be addressed.

The assessment must be performed according to written policies and procedures which cover:

Risk evaluation and categorization
Assessment of the confidentiality, integrity, security, and availability of information systems and nonpublic information
Requirements for risk treatment (e.g., mitigate or accept)

DORA also requires risk assessments to be performed annually [Article 8(2)] and following significant changes to information systems or business functions [Article 8(3)].

Like NYDFS 500, DORA also directs entities to identify risks relevant to supported business functions and consider the impact of technological developments and new cyber attacks [Article 13(7)].

DORA doesn’t explicitly mention risk assessment procedures. Concerning the elements that NYDFS 500 specifies to be included in these procedures, DORA includes risk classification [Article 18(2)] but doesn’t touch on risk treatment.

500.10 Cyber Security Personnel and Intelligence

This section requires covered entities to have qualified cyber security personnel, give them sufficient training to address security risks, and verify that they maintain current knowledge of cyber security threats and countermeasures.

NYDFS 500 allows covered entities to use qualified personnel from an affiliate or third-party service provider.

DORA doesn’t explicitly require qualified cyber security personnel but mentions that independent auditors must possess sufficient cyber risk knowledge, skills, and expertise [Article 6(6)].

DORA requires Security Awareness Training (SAT) for all employees [Article 13(6)]. Although it doesn’t mention specific or additional training for cyber security personnel, it says the training should have a ‘level of complexity commensurate to the remit of employee functions’.

DORA requires entities to keep up-to-date with the latest cyber risk management processes [Article 13(7)]. Still, it doesn’t include verifying that individual personnel comply with this directive.

Concerning NYDFS 500 allowing the use of qualified third-party personnel to manage cyber security, DORA doesn’t mention this but also doesn’t prohibit it.

500.11 Third-Party Service Provider Security Policy

Regarding third-party risk management, NYDFS requires that covered entities:

Identify (inventory) third parties
Perform third-party risk assessments
Define minimum cyber security practices necessary for third parties to meet
Conduct due diligence
Perform continuous monitoring

The regulation mentions explicitly that due diligence must cover the third party’s access control and encryption practices.

Additionally, entities must ensure that third parties give representations and warranties on their cyber security policies and procedures and are required to give notification if a cyber security event directly impacts the entity’s information systems.

The following NYDFS 500 requirements are also included in DORA:

Third-party Identification [Article 8(5)]
Risk Assessment [Article 28(4(c))]
Due Diligence [Article 28(4)]
Continuous Monitoring [Article 28(6)]

DORA doesn’t explicitly include the following third-party risk management requirements contained in NYDFS 500:

Notification in the event of a security incident
The concept of Minimum Cyber Security Practices
Specific mention that access control and encryption must be covered in due diligence
Representations and warranties on the third party’s cyber security policies and procedures

500.12 Multi-Factor Authentication

NYDFS 500 requires MFA for ‘any individual accessing any information systems of a covered entity’ unless the CISO approves in writing the use of reasonably equivalent or more secure compensating controls.

DORA doesn’t include this requirement.

500.13 Asset Management and Aata Retention Requirements

NYDFS 500 requires covered entities to maintain a complete, accurate, documented asset inventory per written policies and procedures. It also specifies required inventory data fields (owner, location, classification or sensitivity, support expiration date, and recovery time goal).

The inventory must be validated and updated at a defined but non-prescribed frequency.

Additionally, this section requires covered entities to regularly and securely dispose of unnecessary nonpublic information unless its retention is required by law or disposal is impractical due to how the data is maintained.

DORA requires financial entities to identify all information assets [Article 8(4)]. Critical assets must be labeled, but no other required fields are specified. The inventory must be updated periodically following significant changes [Article 8(6)].

DORA doesn’t include any requirements around data disposal.

500.14 Monitoring and Training

This section requires covered entities to:

Monitor user activity to detect unauthorized access or tampering with nonpublic information.
Protect against malicious code, including monitoring and filtering web traffic and emails to block malicious content.
Give annual cyber security awareness training for all personnel that reflects the entity’s risk assessment and covers social engineering.

Additionally, class A companies are required to implement:

An endpoint detection and response (ERD) solution to monitor anomalous activity
A solution that centralizes logging and security event alerting (i.e., SIEM)

DORA doesn’t require user activity monitoring or specifically mention malware or web/email filtering. Like NYDFS, DORA also requires yearly Security Awareness Training [Article 13(6)] but doesn’t specify that it needs to align with the entity’s risk assessment or cover social engineering.

DORA also doesn’t explicitly require the implementation of EDR or SIEM solutions.

500.15 Encryption of Nonpublic Information

Covered entities must have a written policy requiring encryption that meets industry standards for nonpublic information in transit over external networks and at rest.

If a covered entity determines encrypting nonpublic information at rest is impractical, it may use alternative security measures that have been reviewed and approved in writing by the CISO. When exercising this option, the CISO must revalidate the infeasibility of encryption and the effectiveness of the compensating controls annually.

DORA doesn’t require data encryption.

500.16 Incident Response and Business Continuity Management

Entities must have an Incident Response Plan designed to allow prompt response and recovery. Plan content must include:

Goals of the plan
Process for responding to incidents
Roles and responsibilities and decision-making authority;
Internal and external communications plan
Identification of remediation requirements
Documentation and reporting
Backup recovery processes
Root cause analysis
Updating of incident response plans as necessary

Entities must also have a Business Continuity and Disaster Recovery (BCDR) Plan designed to ensure the availability and functionality of systems and services in the event of a cybersecurity-related disruption.

At a minimum, the BCDR plan must identify:

Dependencies like documents, data, facilities, infrastructure, services, personnel, and competencies are essential to the continued operations of the covered entity’s business.
Personnel responsible for implementing each aspect of the BCDR plan.
Third parties necessary for the continued operations of the covered entity’s information systems.

And include:

A plan to communicate with essential persons in the event of a cybersecurity-related disruption to the covered entity’s operations, including employees, counterparties, regulatory authorities, third-party service providers, disaster recovery specialists, the senior governing body, and any other persons essential to the recovery of documentation and data and the resumption of operations.
Procedures for the timely recovery of critical data and information systems and to resume operations as soon as reasonably possible following a cybersecurity-related disruption to normal business activities.
Procedures for backing up or copying, with sufficient frequency, information essential to the covered entity’s operations and storing such information offsite.

In addition to maintaining these plans, entities must:

Ensure that current copies of the IR and BCDR plans are available to all employees during a cyber security event necessary for plan execution.
Give training to all employees responsible for implementing the plans.
Perform annual tests of IR and BCDR plans with all staff and management critical to the response and revise the plan as necessary.
Perform annual tests of the ability to restore critical data and information systems from backups.
Maintain backups necessary to restore material operations and ensure these backups are protected from unauthorized alterations or destruction.

DORA covers the above NYDFS 500 requirements as follows:

Incident Response Plan [Article 17(3(f))]

Goals (not mentioned)
Process (not specifically mentioned, but implied that this would be included in the IR Plan)
Roles and responsibilities [Article 17(3(c))]
Communications plan [Article 17(3(d))]
Remediation requirements (not mentioned)
Documentation and reporting (not mentioned)
Backup recovery processes (not mentioned in the context of IR Planning)
Root cause analysis [Article 17(2)]
Updating of incident response plans [Article 13(3)]

BCDR Plan [Article 11(2)]

Essential dependencies [Article 11(5)]
Personnel (not mentioned)
Third parties (not mentioned)
Communication plan (not mentioned)
Recovery procedures [Article 12(1(b))]
Backup procedures [Article 12(1(a))]

Other requirements include:

Copies of plans available during an incident (not mentioned)
IR and BCDR Plan Training (not mentioned)
Annual test of IR Plan (not mentioned)
Annual test of BCDR Plan [Article 11(6(a))]
Annual test of backup and recovery procedures [Article 12(2)]
Maintain secure backups [Article 12(1) and Article 12(3)]

500.17 Notices to Superintendent

NYDFS 500 includes the following requirements to submit notifications to the regulator:

Notice of cyber security incident:

Notify NYDFS within 72 hours of determining a cyber security incident at the covered entity, its affiliates, or a third-party service provider.
Promptly respond to NYS DFS requests for information about the incident.
Update NYDFS on any new information or material changes regarding the incident.

Notice of compliance (signed by the CEO and CISO):

Annual certification that the entity complied with the regulation during the prior calendar year or acknowledgment that the entity did not comply with the description of the gaps and timeline for remediation.
Retain for NYDFS examination documentation supporting the certification or details of remediation plans for five years.

Extortion payments (e.g., ransomware):

Within 24 hours, notify NYDFS that an extortion payment was made.
Within 30 days, explain reasons payment was necessary and diligence performed to find alternatives.

Under DORA, financial entities must report major cyber security incidents [Article 19(1)]. Like NYDFS 500, this includes an initial notification followed by updates on changes and new information [Article 19(4)].

Time limits for the notifications are yet to be determined [Article 20(1(a)(ii))].

DORA doesn’t include requirements to certify compliance with the regulation or give justifications for making ransomware payments.

Get in touch for more help with the NYDFS 500

While NYDFS 500 reflects many of the exact security requirements as DORA, the New York regulation is more prescriptive in some areas. Understanding the differences is essential for financial institutions seeking to achieve compliance with both regulations.

DORA generally takes a more principle-based approach, though this will likely change as the supporting Regulatory Technical Standards (RTS) and Implementing Technical Standards (ITS) are published.

WithSecure Consulting hopes the above comparison will help European financial institutions to more easily recognize the similarities and differences between NYDFS 500 and DORA and will be able to use this information to harmonize their efforts for assessing compliance with these regulations.

Thank you for your interest. Please contact us with questions about this article or the NYDFS 500 and DORA regulations. WithSecure Consulting is committed to supporting organizations in meeting regulatory and other cyber security challenges.