A solo New York-licensed P&C producer with 3 employees, $1M in New York gross revenue, and $2M in total assets wants to claim the § 500.19 limited exemption from 23 NYCRR 500. Which statement is correct?

Why this is the answer

Section 500.19(a) provides a limited exemption when the Covered Entity meets all three thresholds: fewer than 20 employees (including independent contractors), less than $7.5M in NY-revenue, and less than $15M in total assets. Even when exempt, the entity must still perform a risk assessment (§ 500.9), implement reasonable cybersecurity policies (§ 500.2-500.3 at a scaled level), oversee third-party service providers (§ 500.11), train personnel (§ 500.14(a)(1) and (3)), maintain access controls (§ 500.7), and comply with breach notice (§ 500.17). A Notice of Exemption (Appendix B) must be filed within 30 days, and the entity must continue to file annual certifications via the DFS portal acknowledging exempt status.