--- title: New York State DFS Updated Cybersecurity Rule description: The NYDFS updated its cybersecurity regulations. This article details new requirements for access privileges, password policies, and remote security. image: https://blog.lmttech.com/hubfs/NYSDFS%205-25%20Newsletter%20Graphic%20copy.png --- [![lmt-logo-rgb1 copy](https://blog.lmttech.com/hs-fs/hubfs/lmt-logo-rgb1%20copy.jpg?width=2932&height=1619&name=lmt-logo-rgb1%20copy.jpg "lmt-logo-rgb1 copy")](https://www.lmttech.com) # The LMT Blog ## [New York State DFS Updated Cybersecurity Rule](https://blog.lmttech.com/nysdfs-updated-cybersecurity-rule) ** May 9, 2025 10:26:40 AM / by [Christian Foster](https://blog.lmttech.com/author/christian-foster) The New York State Department of Financial Services (NYDFS) rolled out its latest cybersecurity regulation update on **May 1, 2025**, and it’s one that all covered entities, *including individual licensees*, need to address.   ## **What Has Changed?** Covered entities must implement the following: - **Restrict Access Privileges**: Only grant access on a need-to-know basis, especially for admin and privileged accounts. - **Review and Revoke Unused Access**: Regularly audit user access and immediately disable accounts that are no longer needed. - **Secure Remote Protocols**: Disable or harden any protocols that allow remote control of systems (e.g., RDP, VNC). - **Terminate Access Immediately After Departures**: Ensure that access is shut off as soon as personnel leave. - **Establish a Written Password Policy**: If passwords are used in your environment, you must implement and document a reasonable policy around their creation and management. ** ** ## **What You Need to Do** For optimal security, these measures should already be in place. It's important that you've implemented an internal review of your access controls and password policies, established airtight offboarding workflows, and conducted a thorough audit of your remote access configurations. LMT's 365 Monitoring and Managed Services offer regular user access audits as part of a comprehensive security strategy.   **Stay safe and cautious.** Topics: [Information Security](https://blog.lmttech.com/topic/information-security), [NYSDFS](https://blog.lmttech.com/topic/nysdfs), [DFS](https://blog.lmttech.com/topic/dfs), [Compliance](https://blog.lmttech.com/topic/compliance), [NYS Department of Financial Services](https://blog.lmttech.com/topic/nys-department-of-financial-services) Share on Social: [![Share on facebook](https://7528309.fs1.hubspotusercontent-na1.net/hub/7528309/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/facebook-color.png?width=24&name=facebook-color.png) ](https://www.facebook.com/share.php?u=https%3A%2F%2Fblog.lmttech.com%2Fnysdfs-updated-cybersecurity-rule%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://7528302.fs1.hubspotusercontent-na1.net/hub/7528302/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/linkedin-color.png?width=24&name=linkedin-color.png) ](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fblog.lmttech.com%2Fnysdfs-updated-cybersecurity-rule%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://7528304.fs1.hubspotusercontent-na1.net/hub/7528304/hubfs/raw_assets/public/mV0_d-web-default-modules_hubspot/img/twitter-color.png?width=24&name=twitter-color.png) ](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fblog.lmttech.com%2Fnysdfs-updated-cybersecurity-rule%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fblog.lmttech.com%2Fnysdfs-updated-cybersecurity-rule%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) --- ### Subscribe to Email Updates --- [![New call-to-action](https://no-cache.hubspot.com/cta/default/5032426/8e6ab643-791b-45e2-936c-e1aab416761f.png)](https://cta-redirect.hubspot.com/cta/redirect/5032426/8e6ab643-791b-45e2-936c-e1aab416761f) --- ### Recent Posts --- ### Posts by Topic - [Cybersecurity (36)](https://blog.lmttech.com/tag/cybersecurity) - [IT (30)](https://blog.lmttech.com/tag/it) - [Cyber-Security (22)](https://blog.lmttech.com/tag/cyber-security) - [security (14)](https://blog.lmttech.com/tag/security) - [technology (11)](https://blog.lmttech.com/tag/technology) - [Email Compromise (10)](https://blog.lmttech.com/tag/email-compromise) - [Business (9)](https://blog.lmttech.com/tag/business) - [Cybercrime (9)](https://blog.lmttech.com/tag/cybercrime) - [Phishing (9)](https://blog.lmttech.com/tag/phishing) - [Small Business (9)](https://blog.lmttech.com/tag/small-business) - [Cyber Crime (7)](https://blog.lmttech.com/tag/cyber-crime) - [COVID-19 (5)](https://blog.lmttech.com/tag/covid-19) - [Coronavirus (5)](https://blog.lmttech.com/tag/coronavirus) - [Data Privacy (4)](https://blog.lmttech.com/tag/data-privacy) - [Digital Communication (4)](https://blog.lmttech.com/tag/digital-communication) - [Information Security (4)](https://blog.lmttech.com/tag/information-security) - [MFA (4)](https://blog.lmttech.com/tag/mfa) - [Business Continuity (3)](https://blog.lmttech.com/tag/business-continuity) - [Data Protection (3)](https://blog.lmttech.com/tag/data-protection) - [Holidays (3)](https://blog.lmttech.com/tag/holidays) - [Ransomware (3)](https://blog.lmttech.com/tag/ransomware) - [Vendor Email Compromise (3)](https://blog.lmttech.com/tag/vendor-email-compromise) - [#CybersecurityAwarenessMonth (2)](https://blog.lmttech.com/tag/cybersecurityawarenessmonth) - [#cyberinsurance (2)](https://blog.lmttech.com/tag/cyberinsurance) - [Artificial Intelligence (2)](https://blog.lmttech.com/tag/artificial-intelligence) - [Cybersecurity Awareness Month (2)](https://blog.lmttech.com/tag/cybersecurity-awareness-month) - [Disaster Recovery (2)](https://blog.lmttech.com/tag/disaster-recovery) - [Due Diligence (2)](https://blog.lmttech.com/tag/due-diligence) - [Financial Relief (2)](https://blog.lmttech.com/tag/financial-relief) - [ITSupport (2)](https://blog.lmttech.com/tag/itsupport) - [Multifactor Authentication (2)](https://blog.lmttech.com/tag/multifactor-authentication) - [New York Reopens (2)](https://blog.lmttech.com/tag/new-york-reopens) - [Remote workforce returning to the office (2)](https://blog.lmttech.com/tag/remote-workforce-returning-to-the-office) - [Risk Management (2)](https://blog.lmttech.com/tag/risk-management) - [VEC (2)](https://blog.lmttech.com/tag/vec) - [industries (2)](https://blog.lmttech.com/tag/industries) - [#Christmas (1)](https://blog.lmttech.com/tag/christmas) - [#Shopping (1)](https://blog.lmttech.com/tag/shopping) - [2FA (1)](https://blog.lmttech.com/tag/2fa) - [3CX (1)](https://blog.lmttech.com/tag/3cx) - [AI (1)](https://blog.lmttech.com/tag/ai) - [Automation (1)](https://blog.lmttech.com/tag/automation) - [BCDR (1)](https://blog.lmttech.com/tag/bcdr) - [BuildingAStrongerAmerica (1)](https://blog.lmttech.com/tag/buildingastrongeramerica) - [Business Model (1)](https://blog.lmttech.com/tag/business-model) - [Business Security (1)](https://blog.lmttech.com/tag/business-security) - [Business Technology (1)](https://blog.lmttech.com/tag/business-technology) - [CISA (1)](https://blog.lmttech.com/tag/cisa) - [CISSP (1)](https://blog.lmttech.com/tag/cissp) - [Client Experience (1)](https://blog.lmttech.com/tag/client-experience) - [Cloud (1)](https://blog.lmttech.com/tag/cloud) - [Cloud Services (1)](https://blog.lmttech.com/tag/cloud-services) - [Compliance (1)](https://blog.lmttech.com/tag/compliance) - [CriticalInfrastructure (1)](https://blog.lmttech.com/tag/criticalinfrastructure) - [DFS (1)](https://blog.lmttech.com/tag/dfs) - [Data Breach (1)](https://blog.lmttech.com/tag/data-breach) - [Digital Identity (1)](https://blog.lmttech.com/tag/digital-identity) - [Digital Transformation (1)](https://blog.lmttech.com/tag/digital-transformation) - [Document Drafting (1)](https://blog.lmttech.com/tag/document-drafting) - [Endpoint Detection (1)](https://blog.lmttech.com/tag/endpoint-detection) - [Holiday Scams (1)](https://blog.lmttech.com/tag/holiday-scams) - [IT Consulting (1)](https://blog.lmttech.com/tag/it-consulting) - [IT Infrastructure (1)](https://blog.lmttech.com/tag/it-infrastructure) - [Identity Theft (1)](https://blog.lmttech.com/tag/identity-theft) - [Law Firms (1)](https://blog.lmttech.com/tag/law-firms) - [Legal (1)](https://blog.lmttech.com/tag/legal) - [Legal Firm (1)](https://blog.lmttech.com/tag/legal-firm) - [Legal IT (1)](https://blog.lmttech.com/tag/legal-it) - [Legal Tech (1)](https://blog.lmttech.com/tag/legal-tech) - [Legal Trends (1)](https://blog.lmttech.com/tag/legal-trends) - [MSP (1)](https://blog.lmttech.com/tag/msp) - [Managed Service Provider (1)](https://blog.lmttech.com/tag/managed-service-provider) - [Microsoft (1)](https://blog.lmttech.com/tag/microsoft) - [Microsoft End of Life (1)](https://blog.lmttech.com/tag/microsoft-end-of-life) - [NYS Department of Financial Services (1)](https://blog.lmttech.com/tag/nys-department-of-financial-services) - [NYSDFS (1)](https://blog.lmttech.com/tag/nysdfs) - [Network Security (1)](https://blog.lmttech.com/tag/network-security) - [Non-Disclosure Agreement (1)](https://blog.lmttech.com/tag/non-disclosure-agreement) - [Phishing Scams (1)](https://blog.lmttech.com/tag/phishing-scams) - [PrintNightmare (1)](https://blog.lmttech.com/tag/printnightmare) - [Remote Workers (1)](https://blog.lmttech.com/tag/remote-workers) - [Returning to the Office (1)](https://blog.lmttech.com/tag/returning-to-the-office) - [SMB (1)](https://blog.lmttech.com/tag/smb) - [Security Audits (1)](https://blog.lmttech.com/tag/security-audits) - [Silent Starling (1)](https://blog.lmttech.com/tag/silent-starling) - [Smartphone (1)](https://blog.lmttech.com/tag/smartphone) - [Social Engineering (1)](https://blog.lmttech.com/tag/social-engineering) - [Stolen Identity (1)](https://blog.lmttech.com/tag/stolen-identity) - [Tax Season (1)](https://blog.lmttech.com/tag/tax-season) - [Travel (1)](https://blog.lmttech.com/tag/travel) - [Vacation (1)](https://blog.lmttech.com/tag/vacation) - [Windows 7 (1)](https://blog.lmttech.com/tag/windows-7) [See all](https://blog.lmttech.com/nysdfs-updated-cybersecurity-rule#) --- [Tweets by LMTtechnology](https://twitter.com/LMTtechnology?ref_src=twsrc%5Etfw) ## About LMT **LMT Technology Solutions in Rochester, NY delivers managed IT, cybersecurity, cloud computing, risk management, systems integration, VCIO and other business information technology services. We've been a trusted IT partner in Western New York and beyond since 1996.** [Learn More](https://www.lmttech.com/) ## Links ## Contact Us ** (585) 784-7470 ** [support@LMTtech.com](mailto:support@LMTtech.com) ** 800 Linden Avenue Rochester, New York 14625 © Copyright 2026 LMT Technology Solutions. [**](https://blog.lmttech.com/nysdfs-updated-cybersecurity-rule#) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Christian Foster", "url" : "https://blog.lmttech.com/author/christian-foster" }, "dateModified" : "2025-05-09T14:26:40.709Z", "datePublished" : "2025-05-09T14:26:40.000Z", "headline" : "New York State DFS Updated Cybersecurity Rule", "image" : [ "https://blog.lmttech.com/hubfs/NYSDFS%205-25%20Newsletter%20Graphic%20copy.png" ], "mainEntityOfPage" : { "@id" : "https://blog.lmttech.com/nysdfs-updated-cybersecurity-rule", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.lmttech.com/hubfs/lmt-logo-rgbB-1.png" }, "name" : "LMT Technology Solutions" } } ```