NYDFS Part 500 and breach notice for insurance agencies

By Tyler Mayberry · Cirlet. Published 2026-10-28. Page updated 2026-10-28.

A summary of public law and regulator guidance for independent agencies, checked October 28, 2026. It is not legal advice. Read the linked source and ask your counsel or the regulator how it applies to your agency.

Licensed New York agents and brokers are covered entities under the Department of Financial Services cybersecurity regulation, 23 NYCRR Part 500. Smaller agencies can qualify for a limited exemption, but they still notify DFS within 72 hours, file by April 15 each year and use multi-factor authentication for remote and privileged access.

The rules at a glance

Who is covered	Any individual or organization operating under, or required to operate under, a DFS license, registration or charter (DFS cybersecurity guidance), which includes licensed agents and brokers.
Limited exemption	Fewer than 20 employees and independent contractors (with affiliates), less than $7,500,000 in gross annual revenue in each of the last three fiscal years, or less than $15,000,000 in year-end total assets. Exempt only from §§ 500.4, 500.5, 500.6, 500.8, 500.10, 500.14(a)(1), (a)(2) and (b), 500.15 and 500.16 (§ 500.19(a)).
Multi-factor authentication	For a limited-exemption entity, required for remote access to its information systems, remote access to third-party applications with nonpublic information, and all privileged accounts (§ 500.12(a)).
Notice to DFS	“As promptly as possible but in no event later than 72 hours after determining that a cybersecurity incident has occurred”, including at a third-party service provider (§ 500.17(a)).
Annual filing	A certification of material compliance or an acknowledgment of noncompliance, submitted electronically by April 15 (§ 500.17(b)).
General breach notice (any business)	Within 30 days after discovery (General Business Law § 899-aa(2)). Notify the Attorney General, the Department of State and the Division of State Police, plus DFS for Part 500 covered entities. Consumer reporting agencies too when more than 5,000 New York residents are notified at one time (§ 899-aa(8)).

NAIC model law: Not the NAIC model. The NAIC shows New York with “other insurance data security provisions”: 23 NYCRR Part 500 (status as of October 8, 2026).

New York agencies’ public email records

In our October 2026 check of 45 New York independent agency website domains, 38 (84%) published one SPF record, 24 (53%) published a DMARC record and 12 (27%) asked receivers to quarantine or reject mail that fails. Public records show what a domain asks of receivers. They do not show whether an agency’s accounts or inboxes are protected.

What to prepare now

Write down who decides that a cybersecurity event has occurred, and who files the notice, with a backup person.
Keep the regulator’s notice route and the deadline above where you can reach them when email is unavailable.
Ask your IT provider for evidence of multi-factor authentication on email and agency systems, and a list of everyone with administrator access.
List the vendors that hold client information and how each will tell you about an incident.

Rehearse losing email access · Prepare for email fraud

New York questions

Does Part 500 apply to a small insurance agency?

Yes, if the agency or agent holds a DFS license. A small agency may qualify for the § 500.19(a) limited exemption, which removes some sections but keeps others, including multi-factor authentication for remote and privileged access, 72-hour incident notice and the April 15 filing.

How fast must a New York agency notify DFS?

No later than 72 hours after determining that a cybersecurity incident occurred at the agency, an affiliate or a third-party service provider (§ 500.17(a)).

How long does a New York business have to notify affected residents?

Within 30 days after discovering the breach, subject to law-enforcement needs (General Business Law § 899-aa(2)).

Sources

Other states: Missouri · Ohio · Texas · California · All state pages