Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · new york

Every April 15, someone at your firm signs a statement about MFA and access reviews.

New York's cybersecurity rule has a named signer. Since November 2025, Part 500 expects MFA for anyone reaching any information system, and an asset inventory somebody actually maintains. We do the engineering that makes that certification true.

Talk to an engineer
work in new york6 services
5 local rules covered below
in short·20-second read

In New York we work with banks, insurers, broker-dealers and asset managers on the identity parts of NYDFS 23 NYCRR Part 500.

Day to day that's MFA for every user, privileged access management, access reviews and asset inventories, plus the evidence behind the April 15 filing. Where the SHIELD Act or AI hiring-tool rules touch identity data, we handle that too. We're based in Frisco, Texas and work with New York clients remotely and on site.

Cohash is headquartered in Frisco, Texas. We serve New York firms mostly remotely and fly in for workshops, control walkthroughs with your CISO and cutover weekends. We don't operate a New York office.

Ask an engineer facts checked 2026-10-20 · 7 sources
rules
NYDFS 23 NYCRR Part 500SHIELD Act data security, GBL §899-bbBreach notification, GBL §899-aaNYC Local Law 144, automated employment decision toolsRAISE Act
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
new york by the numbers

What's specific about New York

Each figure comes from a public source, linked on the card.

01 207,400

In 2025 New York City's securities industry employed 207,400 people, the most since tracking began in 2000, the State Comptroller says. It produced 18.8% of gross city product in 2024.

source ↗ 02 $26.3 billion

The Comptroller estimates the securities industry generated $26.3 billion for New York State in fiscal 2025-26, about 20.8% of all state tax collections.

source ↗ 03

The two-year phase-in ended on 1 November 2025. That's when the last tranche of the Part 500 amendments took effect, extending MFA to every user and adding the IT asset inventory duties.

source ↗ 04

New York cut the clock in December 2024. Residents now get breach notice within 30 days of discovery, and if you're DFS-covered you notify the Department of Financial Services too.

source ↗
who and what

Who we work with in New York, and the rules they work under

industries

  1. Banks and broker-dealers

    Trading and operations staff collect entitlements across order management, market data and reconciliation tools faster than quarterly reviews remove them. Under Part 500 the gaps auditors find first are usually privileged accounts with no MFA and service accounts with no owner. We fix those, then make reviews short enough that business owners finish them.

  2. Insurers

    Carriers licensed in New York sit under the same DFS rule as banks, but their access sprawl lives in policy admin, claims and agent portals. Independent agents and third-party administrators are the hard population. We bring them under customer or partner identity with MFA, and separate their access from employee directories.

  3. Asset and wealth managers

    Smaller firms often qualify for limited Part 500 exemptions but still hold client data covered by the SHIELD Act. The practical work is a right-sized program covering MFA everywhere, an asset inventory that is actually maintained, and a vendor access list someone reviews.

regulations

  1. NYDFS 23 NYCRR Part 500 ↗

    Covers DFS-licensed banks, insurers and other financial firms. The amended rule wants MFA for any individual on any information system, with narrow exceptions, plus written asset inventory procedures and limits on privileged access. By 15 April each year you file a certification of compliance or an acknowledgment of noncompliance.

  2. SHIELD Act data security, GBL §899-bb ↗

    Any business holding New York residents' private information must keep reasonable administrative, technical and physical safeguards. Firms already compliant with GLBA, HIPAA or Part 500 are treated as compliant.

  3. Breach notification, GBL §899-aa ↗

    You have 30 days from discovering a breach to notify residents, and only law enforcement can justify a delay. The Attorney General, Department of State and State Police get notice too. So does DFS for Part 500 covered entities.

  4. NYC Local Law 144, automated employment decision tools ↗

    Using an AI tool to screen NYC candidates for hiring or promotion? You need an independent bias audit done within the past year. Publish a summary of the results and tell candidates ahead of time. DCWP enforces it.

  5. RAISE Act (frontier AI developers) ↗

    From 1 January 2027, large developers of frontier models need safety frameworks and must report incidents within 72 hours. Most financial firms deploy models and don't train them, so check vendor contracts more than your own obligations.

services

Most requested in New York

The services clients in New York ask us for most.

you are hereNew York
01What usually breaks the MFA-for-everyone requirement?

Legacy applications that cannot do modern authentication, shared accounts on trading floors, and service accounts that someone marked as users. We inventory every interactive login path, front the old applications with an access gateway or PAM, and document the few CISO-approved compensating controls that remain.

02Can you help us prepare the April 15 certification?

We prepare the technical evidence for the identity and access sections, such as MFA coverage reports, privileged account lists, review records and the asset inventory procedure. The certification itself is signed by your CEO and CISO, and the materiality call belongs to them and counsel.

03We use an AI screening tool for New York hiring. Is that an identity problem?

Partly. Local Law 144 is about bias audits and notice. But the tool also holds candidate data and API keys into your HR system, and that part is ours. We scope that access and keep the integration credentials vaulted and rotated, which helps with your SHIELD Act safeguards too.

new york

More cities in New York

All 82 cities
AlbanyState government & chip research BuffaloHospitals, banking & hydropower
sources 7 sources linked last checked 2026-10-20 content fingerprint 82ca9834
  1. 01Office of the NYS Comptroller, Wall Street profits release (October 2026)osc.ny.gov ↗
  2. 02NYDFS Cybersecurity Resource Centerdfs.ny.gov ↗
  3. 03Hogan Lovells, final Part 500 requirements take effect 1 November 2025hoganlovells.com ↗
  4. 04NY General Business Law §899-aanysenate.gov ↗
  5. 05NY General Business Law §899-bbnysenate.gov ↗
  6. 06NYC DCWP, Automated Employment Decision Toolsnyc.gov ↗
  7. 07Wiley, New York finalizes RAISE Actwiley.law ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it