Speed with control
Automate intake, assessment, and monitoring with guardrails that keep your policies in force.
ReportThe 2026 State of TPRMThe 2026 State of TPRM: where programs break and what risk leaders want insteadDownload
NYDFS Part 500 makes your vendors' security your written policy. Coverbase helps you back it up.
New York's cybersecurity regulation, amended in 2023, requires covered financial-services companies to maintain a third-party service provider security policy, and to report incidents, including ones at a vendor, within 72 hours. The §500.11 third-party requirements take full effect November 1, 2025.
CoverbasePart 500 | provider access
Part 500 | provider access
A provider gets new access
System access
Nonpublic data
Policy controls
Agent work
01Read the evidence
02Check the terms
03Route the change
Reassessment prepared
Your policy owner reviews the new exposure.
Who Part 500 applies to
23 NYCRR Part 500, issued by the New York State Department of Financial Services, applies to “covered entities,” meaning institutions licensed or authorized under New York banking, insurance, and financial-services law, with heightened obligations for larger “Class A” companies. The 2023 Second Amendment phased in new requirements through November 2025.
What Part 500 asks of you
- 01
A third-party security policy (§500.11)
Maintain written policies for the due diligence, minimum controls, and contractual terms required of vendors with access to nonpublic information. - 02
Vendor due diligence and reassessment
Assess third-party providers based on the risk they present, and reassess them periodically. - 03
Contractual security terms
Require access controls including MFA, encryption, and breach-notification obligations in vendor contracts. - 04
72-hour incident notice
Notify DFS within 72 hours of a qualifying cybersecurity incident, including one at a third-party provider, with a 24-hour notice for extortion payments.
Stand up your §500.11 program with evidence behind it
A policy on paper isn't enough. Part 500 wants diligence, reassessment, and contract terms to match. Coverbase helps keep all three current.
Vendor diligence, automated
Assess and reassess third-party providers on a schedule, not ad hoc.Required contract terms tracked
Flag whether vendor contracts carry the MFA, encryption, and notification clauses your §500.11 policy requires for that provider.Incident-ready records
Keep vendor facts on hand for the 72-hour DFS clock.Audit-ready documentation
Hold the evidence behind your annual certification of material compliance.
One platform for third-party risk and security
Explain with confidence
AI shows its reasoning for each recommendation, so you can explain your ratings and findings.
Automate with assurance
Adapt controls and workflows as your program and its regulations change.
How we protect your data
These are the practices behind the supplier records and evidence you keep in Coverbase. Read our security and privacy program.
To request our SOC 2 report or report a vulnerability, email security@coverbase.ai.
Independent review
A SOC 2 Type II audit against the AICPA Trust Services Criteria for security, availability, and confidentiality.Testing and remediation
External penetration tests every year, plus vulnerability scans and static and dynamic application security tests, with findings tracked through remediation.Identity and production access
SSO and SAML with Okta, Microsoft Entra, Google, and other identity providers. Multi-factor authentication is required for production access.Data protection
Data encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.Internal accountability
Access logging, quarterly least-privilege reviews, and required employee security and privacy training.
Part 500 provider questions
Apply the written policy to the provider you use.
Do we need identical contract clauses for every provider?
No. The §500.11 requirements name due-diligence guidelines, contractual protections, or both, to the extent applicable. Match the provision to the provider's access and risk.
Did the October 2025 DFS guidance on third-party service providers create new rules?
No. DFS says it clarifies existing requirements and recommends practices without adding obligations.
Does Coverbase certify our Part 500 program?
No. We read evidence and track the provider work against your policy. Your covered entity owns the policy, the incident determination, and any DFS notice.