.svg){kind=icon}
Newsletter
Stay up to date with our monthly newsletter.
Covering the latest thought leadership, events, and news about identity security
.svg)
What We Do
Partners
© MajorKey 2026
.svg)
Navigating the regulatory landscape of the financial sector has always been challenging, and the evolving standards of the New York Department of Financial Services (NYDFS) are no exception. This blog post explores the NYDFS, the 23 NYCRR Part 500 cybersecurity regulations, and the newly introduced requirement for annual User Access Reviews (UARs) for financial institutions.
The New York Department of Financial Services (NYDFS) is a regulatory agency responsible for supervising and regulating financial services and products in the state of New York. Created in 2017, NYDFS oversees a wide range of financial entities, including:
The NYDFS aims to secure the financial system, protect consumers from financial fraud, and promote economic growth through regulation, enforcement, and policy development.
The 23 NYCRR Part 500 Cybersecurity Regulation is designed to enhance cybersecurity practices among financial institutions under NYDFS jurisdiction. Effective since March 1, 2017, it has undergone multiple amendments.
Recent amendments now mandate annual UARs for all financial institutions under NYDFS jurisdiction. This requirement, part of section 500.7, focuses on access privileges and management:
Many financial institutions face challenges due to self-hosted applications or systems without APIs, making UARs a manual, time-intensive process. This increases the risk of errors, delayed anomaly detection, and reactive incident responses.
Our advisory team offers a complimentary half-day workshop to help you navigate UAR processes or other NYDFS compliance requirements. Contact us to schedule your session.
The amended NYDFS regulations bring stricter requirements for financial institutions operating in New York. While compliance can be complex, our identity consultants specialize in implementing solutions that align with regulatory needs while enhancing identity security programs.
If you’d like to learn more, reach out to our team today!
Learn why modern PAM strategies must extend beyond administrator accounts to include machine identities, cloud entitlements, Just-in-Time access, and Zero Standing Privilege. Dan Ross shares practical guidance for building a scalable privileged access program.
What C-suite leaders need to know about the upcoming Microsoft Entra ID SSPR changes, its operational risks, and how to mitigate them.
Auditors don’t just ask who has access today. Identity governance needs to be reframed as a continuous regulatory defense, not a periodic compliance exercise.
When effective change management is integrated with IGA implementations from the start, organizations reduce resistance, increase alignment, and ensure new identity processes take root in a sustainable, scalable way.
Learn about the challenges created by identity silos, the trade-offs between consolidation and governance, and how organizations can determine the most effective path forward.
The most useful KPIs for app onboarding include percent of applications onboarded, time‑to‑onboard, and realized business value or ROI. These metrics give stakeholders clear visibility into progress and help keep the onboarding program accountable and predictable.
Covering the latest thought leadership, events, and news about identity security