New York DFS Urges Annual Cyber Risk Reviews After Major Changes

New York’s Department of Financial Services (DFS) issued guidance on 10 September 2026 setting out its expectations for cybersecurity risk assessments by DFS-regulated entities. The guidance covers the assessments’ scope, frequency and role in shaping cybersecurity programmes. Under the state’s cybersecurity regulation, organisations must review and update their assessments at least annually, and whenever a business or technology change materially alters their cybersecurity risk.

DFS Acting Superintendent Kaitlin Asrow said risk assessments are “the foundation of a strong cybersecurity program”. The department said the document does not create new obligations, but clarifies existing regulatory requirements and highlights practices entities should consider. It addresses governance and oversight, methodology, scope, documentation and the integration of assessment results into security programmes.

DFS recommends reassessing risk around major technology changes, such as system migrations, acquisitions and the introduction of critical systems. Organisations should also examine concentration risk where several critical functions rely on the same cloud provider, managed service provider, software platform or other dependency.

The guidance additionally calls for consideration of how artificial intelligence and other emerging technologies may affect threat exposure, data risks, access controls and third-party dependencies. Entities should use their findings to decide whether controls, policies, monitoring or accepted-risk decisions need updating. The guidance is available through DFS’s Cybersecurity Resource Center. The regulation took effect in March 2017, with an amendment fully effective in November 2025.