“The NYDFS cybersecurity regulation is a set of cybersecurity requirements introduced by the New York Department of Financial Services that businesses in the financial services industry must meet. It requires them to implement a cybersecurity plan and have a comprehensive cybersecurity policy in place, appoint a CISO and have a system for reporting cybersecurity incidents.”
“NYDFS is required by insurance companies, banks, lenders, mortgage companies and other financial institutions operating within New York State. However, companies with fewer than 10 employees that generated less than $5 million in revenue from New York operations in the last three years are exempt from certain requirements.”
“The goal of NYDFS is to safeguard customers while at the same time protect, promote the integrity of information technology systems of regulated industries in the financial industry. This will help ensure the stability and economic development of the financial markets in New York.”
“Any ICT third-party service provider you use falls under DORA if you’re an in-scope financial entity. That means everything touching your technology stack – cloud infrastructure holding your systems, hosting providers running your applications, data centers storing your information, SaaS platforms your teams use daily, software vendors whose code runs your operations, and managed service providers keeping the lights on.”
“DORA’s been in effect since January 17, 2025. That’s not a future deadline – it’s already here.”
“DORA doesn’t just suggest best practices – it mandates specific contractual terms.”
“Absolutely. The right tools can centralize your Register of Information, track whether your contracts cover Article 30 clauses, automate due diligence workflows, and monitor vendors for emerging risks between reviews.”
“Fourth parties are the vendors, suppliers, and subcontractors working for your third parties. One example of a fourth party would be the data analytics platform that your marketing agency uses to generate insights into the success of your marketing campaigns.”
“Fourth-party risk management refers to the process of identifying, assessing, and mitigating risks associated with your fourth parties, meaning the vendors or subcontractors who work with your third parties. Effective fourth-party risk management includes continuous monitoring, robust risk assessment, and ensuring that your third parties share your approach to risk.”
Download this profile and inspect its supporting evidence.