Under 23 NYCRR 500, covered entities must implement IAM policies that limit access to information systems only to authorized users. The regulation forces companies to prove their access rights are justified, documented, and continuously monitored. This is not a checkbox. It is a living system that controls who can log in, what they can do, and how long they keep the keys.
IAM under NYDFS Cybersecurity Regulation demands:
- Role-based access with principle of least privilege.
- Ongoing user access reviews and certifications.
- Strong authentication for all privileged accounts.
- Termination or modification of access immediately after role changes or departures.
- Full audit logs detailing access events and system changes.
Section 500.07(b) makes multi-factor authentication a core requirement for any user accessing internal networks from an external network, or for any privileged account. This shrinks the attack surface and closes the gap exploited in credential-theft incidents.