23 NYCRR 500 is a regulation issued by the New York State Department of Financial Services (NYDFS) that establishes cybersecurity requirements for financial services companies operating under NYDFS jurisdiction. The regulation mandates that covered entities develop and maintain a robust cybersecurity program, implement a risk-based cybersecurity policy, conduct regular risk assessments, and establish incident response plans. It also requires the designation of a Chief Information Security Officer (CISO) and imposes specific reporting obligations for cybersecurity events.