The NYDFS Cybersecurity Regulation makes third-party risk assessment more than a checkbox—it’s law. Section 500.11 requires covered entities to evaluate and manage risks from vendors, suppliers, and contractors. This means identifying how external partners access your systems, what data they handle, and how their security practices align with your own.
Under NYDFS rules, a third-party risk assessment must include clear policies, due diligence, ongoing monitoring, and contractual requirements enforcing minimum cybersecurity standards. It’s not enough to run an initial questionnaire. You need continuous oversight: vulnerability scans, audit rights, and incident response coordination. The regulation stresses that accountability does not end once a contract is signed.
Risk evaluation under NYDFS focuses on three main points. First, data classification—knowing what information a third party can touch. Second, access controls—ensuring strong authentication and least-privilege permissions. Third, resilience—verifying backup, recovery, and breach notification processes meet legal timelines. Fail here, and both the regulator and your customers will lose trust.