NYDFS Cybersecurity Regulation (23 NYCRR 500)
New York’s financial regulator imposed detailed cybersecurity obligations and incident reporting requirements on covered entities. Even outside New York, many firms treated it as a de facto baseline because compliance programs don’t scale well state-by-state.
Companies built formal reporting and governance processes to avoid NYDFS penalties.
New York proved a state regulator can set national compliance norms in practice.
RAISE repeats the same playbook: make reporting mandatory, then make it enforceable.
