Section 500.11 of NYDFS Part 500 requires written third party service provider policies covering identification and risk assessment of providers, minimum practices, due diligence and periodic reassessment. Engineers can supply the technical half: access controls, encryption, incident notice terms and evidence of the provider's own security work.
This is general information, not legal advice.
What the rule lists
Subsection (a) sets four areas the policy should address, to the extent applicable: identify and risk assess providers, set minimum cybersecurity practices, run due diligence, and reassess periodically based on risk. Subsection (b) asks for guidelines on due diligence or contract terms covering four topics:
- The provider's access controls, including its use of multi-factor authentication under 500.12.
- The provider's use of encryption under 500.15 for data in transit and at rest.
- Notice to you if a cybersecurity event affects your systems or your nonpublic information held by the provider.
- Representations and warranties about the provider's cybersecurity policies and procedures.
A technical review sheet
| Question | Evidence to ask for |
|---|---|
| What data will the vendor see? | Data flow diagram, field list, retention period |
| How do their staff reach it? | Access model, MFA statement, review cadence |
| How is it protected? | Encryption in transit and at rest, key handling |
| How do they test their own software? | Secure development summary, vulnerability handling process |
| What do they build on? | A software bill of materials or a dependency list on request |
| What happens in an incident? | Notice timing in the contract, a named contact |
Treat answers as claims until you see something that backs them. A questionnaire reply is a start. A current report, a test summary or a live walkthrough is stronger.
Reassessment is part of the rule
The phrase "periodic assessment based on the risk they present" means onboarding is not the end. Tie the review interval to how much access the vendor has. A provider that holds customer records gets looked at more often than one that sees only marketing data. Re-run the sheet when the vendor changes hosting, adds an AI feature or has a security event.
The software angle
Many of your providers ship code into your environment, such as SDKs, agents, plugins and build tools. Section 500.8 separately asks for procedures for evaluating externally developed applications you use. Review the vendor relationship and the software it delivers as two linked questions.
Mistakes to avoid
A few patterns weaken vendor reviews. Sending the same long questionnaire to every vendor, regardless of risk, which buries the useful answers. Accepting a certificate or logo as proof without reading its scope. Forgetting subcontractors, who may hold the data in practice. And skipping the exit plan, meaning how data is returned or deleted when the contract ends. Tier vendors by access, read scope statements, ask who else touches the data, and agree a deletion and return process before signing.
Quick check
Does 500.11 require a specific questionnaire?
No. It requires written policies covering the listed areas. The format of your diligence is your choice.
Do contractors count as third party providers?
The rule speaks of third party service providers with access to information systems or nonpublic information. Whether a given contractor fits is a scoping question for your compliance team.
Sources
Last reviewed: 19 October 2026.
