NYDFS Cybersecurity Regulation (23 NYCRR 500)
2017–presentWhat Happened
New York’s financial regulator imposed detailed cybersecurity obligations and incident reporting requirements on covered entities. Even outside New York, many firms treated it as a de facto baseline because compliance programs don’t scale well state-by-state.
Outcome
Companies built formal reporting and governance processes to avoid NYDFS penalties.
New York proved a state regulator can set national compliance norms in practice.
Why It's Relevant Today
RAISE repeats the same playbook: make reporting mandatory, then make it enforceable.
