Everyone tells me they have a risk assessment.
Almost nobody does.
DFS has written to every regulated business in New York about risk assessments — and listed what keeps going wrong with them. The guide shows what a real one contains, and three questions that tell you whether yours would hold up.
Get the free guide.
Eleven pages, plain English. Sent straight to your inbox.
It is not a scan. It is not a checklist. It is not the report a tool printed out.
A risk assessment is a written document, built on a methodology like NIST: what you have, where client data lives, what could go wrong, who owns it, and what you decided. Dated. Updated when something changes.
What DFS said, inplain English.
No new rule.DFS says so, and so do I. Don't let anyone sell you a deadline off the back of it.
What it does say: the risk assessment isthe first thing they ask for, they keep findingthe same five gaps, and if your team started using AI this year,your last assessment is probably out of date.
Applies to agencies with the limited exemption too. Section 500.9 was never on the exempt list.
Three questions. If any one is a no,you do not have a risk assessment.
Check what you have against these. Five minutes — the same three things DFS keeps flagging.
The guide walks through all three — and what to do when the answer is no.
Every April 15th, the owner signs — personally — certifying material compliance with Part 500.You can't certify what you can't produce.
Everything else in Part 500 — policies, controls, training — is supposed to come from this document. If it's a piece of paper, so is everything built on it, and your signature is on all of it.
“I've been in the room when DFS asks for a risk assessment — and seen what gets handed over. I wrote this guide so you can check yours first.”
Haven't got one at all?We'll build it with you.
The three questions above tell you whether what you have holds up. This is for the owners who already know the answer — the same risk assessment we run for Motiva clients, at no cost while the offer stands.
- Built on a named methodology — written down and repeatable
- An inventory of what you have, and where client data actually lives
- Every risk rated, with an owner and a recorded decision
- Walked through live with Walter — never emailed to you
Find out whether what you have wouldhold up.
Twenty minutes to read. Five minutes to check your own. Free, and I wrote it myself.
Request a conversation with Walter
“Cavallino Risk would not have survived the economic turmoil of the great recession or the disruptive technology that has occurred in the retail insurance marketplace without the support of Motiva.”
Frank CaponiPresident, Cavallino Risk Management“The thing that sets Motiva apart is that they shine through and are there for you when needed.”
William LibardiPresident, Libardi Service Agency“They follow up to make sure the issues were handled to our satisfaction; I have never had a tech company do that.”
Robert StoneManaging Director, Stone Insurance