NYDFS Told You What It Finds Wrong in Risk Assessments. Check Yours Against These Five Patterns

On September 10, 2026, the New York State Department of Financial Services issued an industry letter titled "Guidance on How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation." It is addressed to all DFS-regulated entities.

The letter states that the guidance does not create new obligations. It does two other things. It restates what Part 500 already requires of a risk assessment, and it lists the deficiencies DFS says it has found in examinations and investigations.

If you hold a New York license, that second part works as a self-audit.

What Part 500 already requires

The letter collects existing requirements in one place.

Your cybersecurity program must be based on your risk assessment under section 500.2. The assessment must be sufficient to inform the program's design under 500.9(a).

You must review and update it at least annually, and whenever a change in your business or technology causes a material change to your cyber risk.

You must conduct it under written policies and procedures that include three things: criteria for evaluating and categorizing risks; criteria for assessing confidentiality, integrity, security, and availability, including the adequacy of existing controls; and requirements describing how the program addresses identified risks. That is 500.9(b).

You must maintain an accurate and current asset inventory under 500.13(a). The letter calls it the foundational input to the risk assessment.

DFS adds an expectation on top of these. You should be able to demonstrate how your risk assessment informed your controls, compensating controls, and risk acceptance decisions.

The five deficiency patterns

DFS lists these as common gaps that contributed to deficient programs.

1. Incomplete asset scope and visibility

Outdated or incomplete inventories. Not knowing where nonpublic information lives or flows. Leaving out critical business processes, third-party service providers, cloud environments, or other external dependencies.

2. Weak or inconsistent methodology

Not consistently identifying, analyzing, prioritizing, and documenting risks. Not evaluating whether existing controls work. Not separating inherent risk from residual risk.

3. Missing evolving and interconnected risk

Leaving out emerging technologies, changes in the threat environment, interdependencies, concentration risk, and single points of failure.

4. Weak governance and risk treatment

No assigned ownership. Risk response decisions that are not documented. Results that never reach enterprise governance. Assessments that are not updated after a material change.

5. An assessment disconnected from the program

Policies, controls, and resource decisions that cannot be shown to rest on the risks the assessment identified.

What DFS says good looks like

The letter does not require a specific methodology. It names NIST Cybersecurity Framework 2.0, the Cyber Risk Institute Profile v2.2, and ISO 27005 as examples many entities use.

It recommends a defined, repeatable method that estimates likelihood and impact with consistent rating criteria. Inputs should include, where available, threat intelligence, incident trends, vulnerability scans, penetration testing, and findings from audits and prior assessments.

On third parties, it lists four factors: the criticality of the service, the sensitivity of the information involved, the level of connectivity to your systems, and the operational impact if the provider has an incident. It names cloud providers, managed security providers, software vendors, payment processors, and affiliates among the providers to consider.

It asks you to assess concentration risk across vendors and platforms. Vendors that look low risk individually may create significant risk when several critical functions depend on the same infrastructure.

It recommends a risk register or comparable tracking mechanism that records results, remediation, and changes to residual risk over time.

On governance, the letter states that Part 500 does not require formal board approval of risk assessments. It does point to section 500.4(b)(3), which requires the CISO to report material cybersecurity risks to the senior governing body. It also points to 500.4(d), under which the senior governing body oversees the program, including whether management has allocated sufficient resources.

DFS recommends drawing input beyond security. Business units, operations, compliance, and legal should take part, so risks are judged against how the business actually runs.

It also observes that mature programs apply the same risk criteria across third-party risk management, IT operations, and business continuity planning. If your vendor tiers, your IT risk ratings, and your continuity priorities each use a different scale, that is a gap worth closing.

Material change, including AI

The letter gives examples of changes that may count as material: major system migrations, mergers or acquisitions, significant outsourcing arrangements, significant developments in cybersecurity technology such as frontier AI models, changes in threat actor capabilities, and adoption of emerging technologies.

It cross-references DFS's May 21, 2026 industry letters on frontier AI models and on measures to consider in a heightened threat environment.

What to do

Pull your current risk assessment and score it against the five patterns. Assign each gap you find to one pattern.

Reconcile your asset inventory against the scope of your risk assessment. Every in-scope system and data flow should appear in both. Check that the assessment shows where nonpublic information resides and how it flows, not only which systems exist.

Add your third-party service providers to the assessment using the four factors DFS lists. Flag any shared infrastructure that several critical functions depend on.

Build or update a register that links each risk to its control, compensating control, or acceptance decision, with an owner and a date.

Decide whether anything since your last assessment counts as a material change. If your organization adopted AI tools or completed a major migration, document the decision either way.

Confirm that the CISO's report to the senior governing body draws on the assessment's findings, and that the report says whether resources match the risks identified.

SOURCE: New York State Department of Financial Services, Industry Letter, "Guidance on How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation," September 10, 2026. 23 NYCRR Part 500, sections 500.2, 500.4, 500.9, and 500.13, as cited in that letter.

This article is provided for general information and does not constitute legal advice. Regulatory requirements, compliance dates, examiner priorities, and enforcement posture change frequently. Verify current requirements against primary agency sources and your legal counsel before acting on anything described here.