Skip to content
Compliance · NYDFS Part 500

NYDFS Part 500 controls and the receipts that map evidence to them.

Every NYDFS Part 500 control Déjà's control table lists, with the receipt types that map evidence to each. Where none does, the row says so: that control is evidenced outside Déjà. References and titles are from 23 NYCRR Part 500, as amended 1 November 2023.

Every control All frameworks

2 of the 16 NYDFS Part 500 controls listed here have a receipt type that maps evidence to them. The other 14 are evidenced outside Déjà.

01 · Coverage

What a receipt covers, and what is not.

2 of the 16 NYDFS Part 500 controls listed here have a receipt type that maps evidence to them. The other 14 are evidenced outside Déjà.

Sections 500.2 to 500.17, the sections that set requirements. Section 500.1 (definitions) and sections 500.18 to 500.24 set none, and are not listed.

Edition
23 NYCRR Part 500, as amended 1 November 2023
Controls listed
16
A receipt type maps evidence
2
Evidenced outside Déjà
14

A receipt is evidence for a control, never the whole of it: the rest of each control is tested outside Déjà.

02 · Every control

NYDFS Part 500, in the standard's own words.

23 NYCRR Part 500

2 of 16 with a receipt type

  • 500.2Cybersecurity programEvidenced by R1R1-L
  • 500.3Cybersecurity policyEvidenced outside Déjà
  • 500.4Cybersecurity governanceEvidenced outside Déjà
  • 500.5Vulnerability managementEvidenced outside Déjà
  • 500.6Audit trailEvidenced outside Déjà
  • 500.7Access privileges and managementEvidenced outside Déjà
  • 500.8Application securityEvidenced outside Déjà
  • 500.9Risk assessmentEvidenced outside Déjà
  • 500.10Cybersecurity personnel and intelligenceEvidenced outside Déjà
  • 500.11Third-party service provider security policyEvidenced outside Déjà
  • 500.12Multi-factor authenticationEvidenced outside Déjà
  • 500.13Asset management and data retention requirementsEvidenced outside Déjà
  • 500.14Monitoring and trainingEvidenced outside Déjà
  • 500.15Encryption of nonpublic informationEvidenced outside Déjà
  • 500.16Incident response and business continuity managementEvidenced by R1R2
  • 500.17Notices to superintendentEvidenced outside Déjà
03 · The receipt types

The evidence, and what each one is.

The receipt types that map evidence to at least one NYDFS Part 500 control. The fields each one carries in its signed or hashed bytes are listed under receipt types.

  • R1Signed

    Attribution Receipt

    Incident attributed to a causal PR with CCS above threshold.

    Maps evidence to 500.2 and 500.16 · what R1 records

  • R1-LSigned

    Low-Confidence Attribution

    Candidate PRs identified but CCS in the low-confidence range (0.60–0.79).

    Maps evidence to 500.2 · what R1-L records

  • R2Signed

    Resolution Receipt

    An incident marked resolved, with its five gate scores and whether they passed. References its R1.

    Maps evidence to 500.16 · what R2 records

04 · How an auditor checks it

Checked on the auditor's own machine.

An audit engagement opened for NYDFS Part 500 covers the receipt types that map evidence to its controls: R1, R1-L and R2. The auditor gets a token link, sees the receipts in scope, downloads a signed period report and checks it on their own machine with dsr-verifier-cli, against Déjà's published keys.

The period report packs R1 and R1-L. R2 is listed in the auditor's portal and not packed.

Déjà's integrity monitor, every 15 minutes, checks R1 and R2; it does not check R1-L.

How an engagement runs The verifier CLI
05 · Limits

What Déjà does not do for you.

Determine root cause
An attribution receipt (R1) records the change Déjà's scoring tied a failure to, and the score it reached. That is evidence for an investigation, not its finding.
Certify a control
A receipt maps evidence to a control. Whether the control is designed and operating effectively is the auditor's opinion, and the rest of each control is tested outside Déjà.
Attest
Déjà issues no attestation report or audit opinion about your firm. Déjà's own attestation status is on Security & trust.

Déjà supplies a record of what connected systems reported and what changed. It does not determine root cause, file regulatory reports, or discharge any obligation under any regime: those remain with your named accountable individuals.

Walk the list with us, control by control.

Bring your control matrix. We will say which rows a receipt maps evidence to, and which ones it does not.

Talk to us For auditors