P&CNew Yorkeasy
Under 23 NYCRR 500 (DFS Cybersecurity Regulation), who is a 'Covered Entity' required to implement a cybersecurity program?
AOnly banks chartered by New York that hold over $1 billion in assets
BOnly insurance producers domiciled in New York City
COnly health insurers writing comprehensive medical coverage in New York
Any person or entity operating under or required to operate under a DFS license, registration, charter, certificate, permit, or similar authorization under the Banking Law, Insurance Law, or Financial Services Law
Why this is the answer
Reg 500 (23 NYCRR Part 500), effective 2017 and amended in 2023, applies broadly to all DFS-authorized persons. For P&C purposes that includes admitted insurers, licensed producers, public adjusters, reinsurers, and excess-line brokers (ELANY filers). Limited exemptions in § 500.19 are available for very small entities (fewer than 20 employees, under $7.5M NY revenue, or under $15M total assets — meeting all three thresholds), but exempt entities must still file a Notice of Exemption and meet several core controls. Distractors describe much narrower scopes that the regulation explicitly rejects.
Studying for the New York Property & Casualty exam?
This question comes from our P&C bank. Take a free practice test — no signup.