DFS’s Sept 10 Risk-Assessment Guidance: Build the Evidence Trail Examiners Will Ask For

On September 10, 2026, the New York State Department of Financial Services published Guidance on How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation. The letter’s first substantive promise is the one owners need to hear: it does not create new obligations. What it does is publish, in examiner-friendly language, the gaps DFS already sees when it reviews Risk Assessments under 23 NYCRR Part 500 — and the documentation trail that separates a living program from a PDF that was last opened for last year’s certification.

This is the Compliance & Audit Assurance read for New York insurance agencies, MGAs, banks, credit unions, virtual-currency businesses, and the MSPs that support them. Focus: evidence. Not another essay on what a risk assessment “is.”

What DFS said that changes your audit prep

Part 500 already required a periodic Risk Assessment that is “sufficient to inform the design of” the cybersecurity program, updated at least annually and whenever a business or technology change causes a material change to cyber risk (§ 500.9). Written policies must include criteria for categorizing risks; assessing the confidentiality, integrity, security, and availability of Information Systems and Nonpublic Information (NPI), including the adequacy of existing controls in the context of identified risks; and describing how identified risks are addressed (§ 500.9(b)).

The September 10 guidance sharpens the exam expectation: DFS expects each Covered Entity to demonstrate how its Risk Assessment informed cybersecurity controls, compensating controls, and risk acceptance decisions. A stand-alone assessment that does not drive § 500.2 program design is the failure mode the letter is aimed at.

DFS lists common gaps it has already observed:

Incomplete asset scope and visibility (inventory, NPI location/flows, TPSPs, cloud, external dependencies).
Weak methodology (no consistent identify/analyze/prioritize cycle; no inherent vs. residual distinction).
Missing evolving and interconnected risks (emerging tech, concentration, single points of failure).
Weak governance and risk treatment (no owners, no documented response decisions, no updates after material change).
Policies and resource decisions that are not demonstrably based on identified cyber risks.

If your “assessment” cannot answer “show me the control that came from this risk row,” you are in that last bullet.

Material change includes frontier AI — and actively exploited vulns

Section 5 of the guidance is the operational hinge for 2026. DFS says Risk Assessments must be reviewed and updated at least annually and when material cyber-risk changes occur. Examples include major migrations, M&A, significant outsourcing, significant developments in cybersecurity technologies (e.g., frontier AI models), changes in threat-actor capability, and emerging-technology adoption. Covered Entities should also consider whether to update after identification or active exploitation of critical hardware/software vulnerabilities or geopolitically driven cyber risk.

That language connects three public DFS products:

The September 10 Risk Assessment guidance itself.
The May 21, 2026 Frontier AI Models advisory — which tells CISOs to review and update risk assessments for frontier-AI risk and to consider accelerated vulnerability management and third-party dependency work.
The May 21, 2026 Heightened Cybersecurity Threat Environment (HCTE) letter — which points to the KEV catalog for internet-exposed known exploited vulnerabilities.

Practical translation for a mid-market NYS covered entity this month: the Citrix NetScaler KEV wave (CVE-2026-88771 / 88772 / 88779 on CISA’s KEV catalog) is exactly the kind of “active exploitation of critical… vulnerabilities” the Risk Assessment guidance says should trigger a refresh — even if your annual RA calendar said “November.”

Legacy stacks: where evidence usually breaks

A common audit failure pattern in mid-sized New York firms:

Asset inventory lives in the MSP’s RMM and never makes it into the RA workbook.
NPI data flows are assumed (“email and the AMS”) without a diagram an examiner can follow.
The RA scores “vendor risk” as medium once, while three critical systems sit on one MSP and one cloud IdP — concentration risk the guidance now calls out by name.
Risk acceptance is a hallway conversation, not a dated senior-officer note.
AI tools appear in help-desk workflows with no RA row, despite DFS calling frontier AI a material-change example.

None of that is fixed by buying a GRC logo. It is fixed by a risk register with traceability columns.

AI GRC inside the Part 500 RA (without theater)

You do not need an ISO 42001 certificate to satisfy DFS’s September letter. You do need the RA to name AI-related cyber risk where it exists: AI-assisted vulnerability discovery by adversaries (Frontier AI advisory), AI-generated code entering production without validation (HCTE / Frontier AI cross-references to secure programming practices), and staff use of consumer AI with NPI. Map each to a control or an explicit acceptance. That is AI governance as Part 500 evidence — which is what NYS examiners can actually ask for.

This week’s examiner-ready checklist

Pull the RA and the control library side by side. For the top ten residual risks, write the control ID or compensating control that addresses each. If you cannot, that is the finding — fix documentation before the exam narrative.
Refresh scope against § 500.13 asset inventory + NPI flows + TPSPs + cloud. DFS’s “incomplete asset scope” gap is the cheapest exam miss to close.
Add a concentration-risk row. One MSP, one IdP, one backup vendor, one internet-facing gateway: document the blast radius.
Open a dated RA update for active KEVs on your edge (or record “not in environment” with evidence). Tie to Frontier AI / HCTE only if you are covered — the update duty is still § 500.9.
Document every risk acceptance with owner, date, residual risk, and next review. Hallway OK is not acceptance.
Brief the Senior Governing Body with material risks from the RA (aligns with § 500.4 CISO reporting expectations the guidance highlights). Three risks, three decisions, one resource ask.
Ask internal audit / your assessor to sample three risk→control links. If they cannot re-perform the link from your files, neither can DFS.

What “done” looks like before certification season

Written RA methodology (likelihood/impact criteria) approved under your § 500.3 policy cycle.
Risk register with owners, inherent/residual scores, control links, and acceptances.
Evidence that the last material change (KEV, new AI tool, new MSP, migration) produced an RA update — not only a patch ticket.
Board/senior packet that quotes RA findings, not vanity metrics.

DFS told you the exam question in advance: show how the assessment shaped what you built. Answer it with a paper trail, not a story.

Sources

NYDFS (Sep 10, 2026): Guidance on How to Conduct and Use Risk Assessments Required by the DFS Cybersecurity Regulation
NYDFS: 23 NYCRR Part 500
NYDFS (May 21, 2026): Heightened Cybersecurity Risks Associated with Frontier AI Models
NYDFS (May 21, 2026): Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment
CISA: Known Exploited Vulnerabilities Catalog