On September 10, 2026, the New York Department of Financial Services issued its Industry Letter on Cybersecurity Risk Assessments to every agency it regulates. It creates no new obligations. It lists what examiners keep finding wrong with the risk assessments agencies already have.We wrote to you because your agency is on that list of regulated entities and because, in our experience, most owners who believe they have a risk assessment are holding something else. The letter below explains what DFS said, what it means for an agency your size, and what to check in your own document.
Preview in browser