The certification is signed
by name. Yours.

Very likely, if you hold any New York financial license. Part 500 applies to Covered Entities — any organization operating under, or required to operate under, a license, registration, charter, permit, or similar authorization under New York's Banking Law, Insurance Law, or Financial Services Law. That sweeps in far more than banks: insurers, agents and brokers, money transmitters, mortgage lenders, trust companies, and credit unions.

If you're licensed by NYDFS, assume Part 500 applies unless you qualify for a narrow exemption — and even most exemptions still require core controls and a filed notice of exemption. Limited small-business exemptions exist based on size, revenue, and data thresholds, but they reduce rather than eliminate obligations. Because enforcement is aggressive and the certification carries personal liability, the safest first step is a clear applicability analysis, not an assumption you're out of scope.

Under the Second Amendment, the annual Certification of Material Compliance must be signed by both a senior officer and the CISO — a dual-signature requirement — and filed by April 15, covering the prior calendar year. This is what makes Part 500 different from most frameworks: it puts named individuals personally on the line. Signing a certification that doesn't reflect reality is a personal attestation to a regulator that pursues enforcement.

If your organization can't certify full material compliance, the regulation provides an alternative — an Acknowledgment of Noncompliance identifying the gaps with a remediation plan and timeline — which is far safer than an inaccurate certification. Covered Entities must also retain the supporting documentation for five years and produce it on request. The certification is only as defensible as the evidence behind it, which is why the work happens all year, not in April.

Part 500 has two fast reporting clocks, both commonly misunderstood. Under Section 500.17(a), you must notify the NYDFS Superintendent no later than 72 hours after determining that a reportable cybersecurity incident occurred — the clock starts at determination, not at the first indicator. A reportable incident includes one requiring notice to another government or supervisory body, one with a reasonable likelihood of materially harming normal operations, or one involving ransomware deployment.

Separately, if you make an extortion or ransomware payment, you must notify NYDFS within 24 hours of the payment and then provide a written explanation within 30 days of why payment was necessary and what alternatives were considered. Because these windows are short and the triggering events are stressful, the only reliable way to meet them is a tested incident response plan with the notification workflows built in and decision-makers rehearsed in advance.

Class A is a heightened tier for the largest Covered Entities. You're Class A if you have at least $20 million in gross annual revenue from New York operations including affiliates, and you also meet one of two thresholds: more than 2,000 employees on average over the last two fiscal years (counting affiliates), or more than $1 billion in gross annual revenue from all operations.

Class A Companies must meet all baseline requirements plus additional ones: independent audits of the program based on risk, an automated method to block commonly used passwords, endpoint detection and response, and a centralized logging or SIEM solution — unless the CISO approves reasonably equivalent or more secure compensating controls in writing, reviewed annually. If you might be Class A, confirming status early matters, because the heightened controls take real time to stand up and all certify on the same April 15 cycle.