Compliance and vCISO for regulated New York firms
NYDFS Part 500, the HIPAA Security Rule and the FTC Safeguards Rule ask for many of the same controls but want separate evidence. We keep one set of controls in one register, with a state beside each reference.
Controls in scope, by reference
One control set serves several regimes; a second one adds mapping and reporting on top of the same security work.
| Reference | What it requires, and what the agreement covers | State |
|---|---|---|
| 23 NYCRR 500.9 | A written risk assessment the rest of the program rests on, updated when the business or the threat picture changes. | In scope |
| 23 NYCRR 500.12 | MFA for anyone accessing an information system. Firms under the limited exemption still owe it for remote access to the firm’s systems, for remote access to third-party applications holding nonpublic information, and for privileged accounts. | In scope |
| 23 NYCRR 500.13 | An asset inventory that names an owner and a retirement point for every device and account. | In scope |
| 23 NYCRR 500.17(b) | The compliance certification filing. We assemble the evidence behind it; an officer of your firm signs it. | Advisory |
| 16 CFR 314.4 | The nine elements of the FTC Safeguards Rule, from a named qualified individual to encryption to a written incident response plan. | In scope |
Show 5 more controls
| Reference | What it requires, and what the agreement covers | State |
|---|---|---|
| 45 CFR 164.308–164.312 | HIPAA Security Rule safeguards: risk analysis, access and audit controls, encryption. We read New York’s SHIELD Act alongside it and keep records for the retention period the rule requires. | In scope |
| NIST SP 800-171 Rev 2 | The 110 controls behind CMMC Level 2, kept inside a scoped enclave so the rest of your environment stays outside the assessment boundary. | In scope |
| AICPA TSC, CC series | SOC 2 readiness: scoping, control design and the evidence an auditor will test. A licensed CPA firm issues the opinion after its observation period. | Evidenced |
| 23 NYCRR 500.17(a) | Notice to the superintendent inside the required notice window once a qualifying event has been determined. We assemble the timeline and the technical facts; your counsel makes the determination. | Advisory |
| Insurer questionnaire | Treated like a regulation. EDR coverage, MFA attestation, restore results and training records, kept current between renewals. | Evidenced |
In scope: written into the standard agreement and started at onboarding. Evidenced: we keep the dated record; the decision stays with you. Advisory: we prepare the material and an accountable person at your firm signs it.
What the monthly report answers on a renewal form
A renewal form asks in groups. Each group below says where its answer comes from, including the ones the report cannot answer.
- Identity and accessFrom the record
MFA coverage by account, privileged accounts listed by name, and every exception tied to its account.
- Endpoints and patchingFrom the record
What is on the fleet, what is patched and what is past the end of vendor support.
- Backup and recoveryFrom the record
A restore that was carried out, how long it took, and what was in scope.
- Email authentication and asset inventoryFrom the assessment
We read SPF, DKIM and DMARC and build the inventory during the assessment. Until then, neither of us can answer these from evidence.
- Exercises, training and historyYours to answer
Tabletop exercises, staff training records, revenue and any prior claim are yours to answer. Be wary of a provider offering to answer them for you.
LimitThe monthly report is our own operational work. It is not an audit opinion, a certification or an independent attestation, and no insurer is obliged to accept it.
Who holds what
A named person runs the program
NYDFS Part 500 requires a designated CISO and the FTC Safeguards Rule a qualified individual. Both allow a third party to fill the role while your firm keeps the responsibility. Stedholm can fill it: the policy set, a risk register with acceptances signed by the business, and a written report your leadership can question.
Where our work stops
A SOC 2 opinion comes from a licensed CPA firm, a CMMC Level 2 assessment from a C3PAO and a breach determination from your counsel. We prepare what each of them reads and say where the handoff is.
Get a gap map
The assessment maps the obligations that apply to you against the controls you have, in a register an auditor can read. It lists what is missing, in order, with an effort estimate, and we go through it with you line by line.