NYDFS Now Needs Two Signatures on the Cybersecurity Certification. Only One Has to Prove It.
November 9, 2026
Ric Hall, CRO— AI-assisted and reviewed prior to publication.
New York's cybersecurity regulation now requires both the CEO and the CISO to personally sign the annual compliance certification, and that signature carries real legal exposure. The rule does not define exactly what makes a CISO "qualified" to sign it, which means the credential and documentation trail behind that person's name has become the evidence regulators and auditors will actually look for.
What exactly changed in New York's certification requirement?
Covered entities under 23 NYCRR Part 500 have filed an annual notice of compliance with the New York Department of Financial Services since 2017. What changed in the 2023 Second Amendment is who has to sign that notice and what the signature now means. The filing, due every April 15, now requires signatures from both the entity's top executive and its CISO, and under Section 500.17(b) the attestation must be backed by data and documentation sufficient to demonstrate material compliance, retained for five years.
That five-year documentation requirement is the part most compliance teams underestimate. Collecting a signature takes an afternoon. Building an evidence file that can survive an examiner's second look, two or three years after the fact, is a different project entirely. Industry counsel covering the amendment has been direct about the shift in stakes: the dual-signature structure creates direct personal regulatory liability for both the CEO and the CISO, not just institutional liability for the company as a whole. If the certification turns out to be wrong, or the file behind it is thin when DFS asks for it, the people who signed it are the ones exposed, not just the entity's legal department.
For a bank, insurer, mortgage servicer, or money transmitter regulated under Part 500, that changes how the CISO hire gets treated internally. It stops being purely an IT staffing decision and becomes a governance decision that the general counsel and the board should have a stake in, because their names or their delegated authority sit behind the signature too.
Who actually counts as a "qualified" CISO under this rule?
The regulation names a role without fully defining the bar for filling it, and that gap is exactly where a procurement decision has to happen. The rule's own text defines the CISO as "a qualified individual responsible for overseeing and implementing a covered entity's cybersecurity program", but it stops short of specifying what makes someone qualified in a way an examiner can check line by line against a personnel file.
Section 500.04 goes a step further on supporting staff, requiring that covered entities utilize qualified cybersecurity personnel of the covered entity, an affiliate, or a third party service provider to manage cybersecurity risks and perform core program functions. That language explicitly allows outsourcing the CISO function to an affiliate or a vendor, which is common at smaller banks, insurers, and money transmitters that cannot justify a full-time CISO salary on their own balance sheet. It also means a virtual CISO contract is itself part of the compliance file, and the qualification of the specific individual named in that contract matters as much as the reputation of the firm supplying them.
This is where a recognized credential stops being a resume line and starts functioning as audit evidence. A current CISM certification maps closely onto what Part 500 actually asks a CISO to do day to day: build and maintain a cybersecurity program, report program status and material risk to the board or senior governing body, and oversee incident response and remediation efforts. When an examiner asks how the entity determined the signing CISO was qualified, "we checked their certification status and continuing education record against the role's duties" is a defensible answer. "We liked their resume" is not, and neither is "the vendor told us their person was qualified" without anything in writing to back it up.
What happens when the documentation behind a certification doesn't hold up
New York has already shown it will pursue penalties when a cybersecurity program does not match what was represented about it. In August 2025, DFS settled with Healthplex, a dental insurance services company, requiring a $2 million penalty tied to cybersecurity program failures uncovered after a 2021 phishing incident exposed personal data belonging to tens of thousands of New York residents. That case did not turn on a CISO qualification dispute specifically, but it illustrates the exact pattern that now applies to the certification filing itself: a program that looked compliant on paper did not hold up once DFS investigated what was actually behind it.
That is the real exposure created by the dual-signature rule. An April filing date is easy to track on a compliance calendar, and coverage of the deadline from Byte Back confirms covered entities have treated it as a fixed annual task for years without much drama. What is new is the personal name now attached to it and the five-year lookback window DFS can apply if a breach or complaint triggers a later review. A CEO signing based on a CISO's representation is exposed if that representation turns out to rest on an unqualified hire or an outsourced vendor with no verifiable credential behind the named individual actually doing the work.
Building the audit file your CISO's signature needs
Compliance and HR teams supporting a Part 500 filing should treat CISO qualification as a documented control, not an assumption baked into the org chart. A practical file should be able to answer, on short notice, who holds the role, what credential and continuing education status back them, and how their daily duties map to the regulation's specific requirements. At minimum, that file should include:
- The named individual's current certification status, issue date, and renewal or continuing professional education record
- A written mapping of that person's actual duties to Section 500.04's program oversight, reporting, and risk management requirements
- For outsourced arrangements, the specific qualified individual named in the vendor contract, not just the vendor firm's name
| Audit file element | What it should show |
|---|---|
| Role assignment | Named individual, title, and reporting line to the board or senior governing body |
| Credential status | Active certification such as CISM, issue date, renewal and CPE status |
| Duty mapping | How daily responsibilities match Section 500.04's program oversight and reporting requirements |
| Vendor CISO contracts | Named qualified individual at the third party, not just the firm's name |
Building that file is also a good occasion to check whether the broader security team's skills match what the regulation expects of the cybersecurity program as a whole, not just the one person signing the certification. Forge University's certification resources overview walks through how CISM's exam domains line up against governance duties like these, which is a useful gap check before your next filing cycle. If your institution's April certification is coming up and the person signing it needs a credential that is current rather than aspirational, you can start training for it now rather than scrambling in March.
The bigger pattern procurement teams should watch
New York regulates thousands of banks, insurers, and other financial entities directly, but Part 500 has a long history of becoming the template other state and federal regulators borrow language from. Vendor risk teams at institutions outside New York's direct jurisdiction are already fielding questions from counterparties who want to know whether their own CISO's qualifications would survive the same scrutiny DFS now applies. A named, certified individual with a documented continuing education record travels well across those conversations. A job title on an org chart does not.
The practical lesson for anyone building or reviewing a compliance program is to stop treating "we have a CISO" as the finish line. The finish line is a file that shows who that person is, what qualifies them, and how their work maps to duties a regulator can check one line at a time. That file is cheap to build before an examination and expensive to reconstruct after one lands on your desk.