What's New? NY DFS Clarifies Expectations for Cybersecurity Risk Assessments

On September 10, 2026, the New York State Department of Financial Services (DFS) issued new guidance clarifying regulatory expectations for cybersecurity risk assessments across regulated entities. While imposing no new legal mandates, the guidance reminds financial institutions to review and update their risk assessments at least annually or whenever material business or technological changes occur. It highlights key operational best practices, including managing third-party cloud dependencies, evaluating emerging artificial intelligence risks, and continuously aligning controls with identified threats.

For more information, see the Gold Book sections on Digital Banking and Risk Assessments.