Cybersecurity compliance, done for you.
We help small New York financial firms meet the NYDFS cybersecurity regulation — without hiring an IT department. Policies, risk assessment, controls and the annual certification, handled.
Every DFS-regulated firm must file its annual cybersecurity certification for calendar year 2026 — signed by your highest-ranking executive and your CISO.
Built for firms with 5 to 50 people and no in-house IT
If you hold a license from the New York Department of Financial Services, Part 500 applies to you — even if you are small.
The essentials, in plain English
These are the requirements most small firms struggle with. We take care of each one and keep the evidence on file.
Annual certification
File a certification of compliance — or an acknowledgment of noncompliance with a fix-it plan — by April 15 each year.
Risk assessment
A documented review of your risks, updated regularly, that drives your security program.
Written policies
Board- or owner-approved cybersecurity policies covering access, data, vendors, incidents and more.
Multi-factor authentication
MFA for everyone who logs into your systems — required for all firms as of November 1, 2025.
Access control
Only the right people have access to customer data, and access is reviewed periodically.
Vendor management
Policies and due diligence for the outside companies that handle your data.
Security training
Cybersecurity awareness training for all staff, at least once a year.
Incident response
A tested plan — and notice to DFS within 72 hours of a reportable cybersecurity event.
Pick where you are, we handle the rest
Fixed fees, no surprises. Every document cites the Part 500 section it satisfies, so you can show your work to DFS.
Certification Readiness
- Gap assessment against every applicable requirement
- Written risk assessment
- Complete cybersecurity policy pack, tailored to your firm
- Prioritized remediation plan
- Support preparing your April 15 filing
Outsourced CISO
- We serve as your Chief Information Security Officer
- Compliance calendar with reminders — nothing missed
- Annual staff training and policy reviews
- Vendor and access reviews
- Incident support and the 72-hour DFS notice
- Annual certification, every year
Deadline Rush
- For firms starting late in the season
- Fast-tracked assessment and core policies
- Focus on what must be in place to certify
- Honest guidance if an acknowledgment of noncompliance is the right filing
Four steps to a certification you can sign with confidence
Free readiness call
30 minutes. We learn about your firm and tell you whether you may qualify for a limited exemption.
Gap assessment
A guided questionnaire — about an hour of your time. You get a clear report of what is met and what is missing.
Fix and document
We deliver your policies and risk assessment and work with you or your IT provider to close the gaps.
Certify and stay compliant
File by April 15, then stay on track all year with our compliance calendar and reviews.
Common questions
We are a small firm. Does Part 500 really apply to us?
Yes, if you are licensed by DFS. Smaller firms may qualify for a limited exemption based on headcount, New York revenue or total assets. Exempt firms still have to file a notice of exemption, file the annual certification and meet core requirements such as written policies, a risk assessment, access controls and MFA. We work out which requirements apply to you.
Can an outside company act as our CISO?
Yes. Part 500 allows the CISO role to be filled by a third-party service provider. Your firm stays responsible for compliance and names a senior person to oversee the provider — we make that simple.
We already have an IT company. Do we still need you?
Usually, yes — and we work well together. Your IT provider runs your computers; we handle the regulatory side: policies, risk assessment, evidence, training and the certification. We give them a clear list of what to fix.
What if we cannot be fully compliant by April 15?
DFS allows an acknowledgment of noncompliance that identifies the gaps and a plan to fix them. Filing honestly with a remediation plan is far better than certifying something that is not true. We help you decide which filing is right.
Is this legal advice?
No. We provide cybersecurity and compliance services. For legal questions about your obligations, consult your attorney — we are happy to work with them.
Let’s get you ready for April 15
Book a free 30-minute readiness call. No obligation — you will leave knowing exactly where your firm stands.
Email us to book a call [email protected]