The breach was silent. One wrong click, one stolen password, and your system is compromised. The New York Department of Financial Services (NYDFS) Cybersecurity Regulation makes sure that doesn’t happen—or at least makes it harder. At the center of its requirements is Multi-Factor Authentication (MFA).
MFA under the NYDFS Cybersecurity Regulation is not optional for covered entities. Section 500.12 requires businesses to use MFA or equivalent controls whenever accessing internal networks from an external location, or for privileged accounts with direct access to nonpublic information. The rule applies to banks, insurance companies, and anyone operating under NYDFS oversight.
The reason is simple: one password is not enough. MFA forces attackers to break more than one barrier. This can mean a hardware token, a mobile push notification, or a biometric factor. The regulation leaves room for “reasonably equivalent” security measures, but MFA remains the default standard.
NYDFS expects implementation to be documented, auditable, and part of the company’s broader cybersecurity program under Section 500.2. Annual certification of compliance is mandatory, and failure can result in enforcement actions, fines, or public orders.