Section 500.17(b) requires an annual filing by April 15, either a certification of material compliance or an acknowledgment of noncompliance. It must be based on data and documentation sufficient to demonstrate that status, and supporting records must be kept for five years. Engineering evidence is collected all year, not in March.
This is general information, not legal advice.
What gets filed and who signs
The rule gives two forms. A certification says the covered entity materially complied with Part 500 during the prior calendar year. An acknowledgment says it did not, identifies the sections affected, describes the nature and extent of the gap, and gives a remediation timeline or confirms remediation is done.
Either one is signed by the highest ranking executive and the CISO. If there is no CISO, the senior officer responsible for the cybersecurity program signs with the executive.
The five year records rule
Section 500.17(b)(3) says the entity must keep, for examination on request, all records, schedules and documentation supporting the filing for five years. That includes the areas, systems and processes that needed material improvement, the remedial work done, and remediation plans and timelines.
Plan for that retention when you pick tools. If a scanner or ticket system keeps only 90 days of history, export what you need.
Evidence map for engineering
| Part 500 area | Evidence that tends to be asked for |
|---|---|
| 500.5 Vulnerability management | Scan schedules and results, penetration test report, remediation tickets with dates |
| 500.7 Access privileges | Annual access review record, offboarding timestamps |
| 500.8 Application security | Secure development standard, annual CISO review sign off, external app assessments |
| 500.12 MFA | System list with sign in method, compensating control approvals |
| 500.13 Asset inventory | Inventory exports with validation dates |
| 500.16 Incident response and BCDR | Plan, annual test records, backup restore test |
The table is a starting point, not a checklist from the regulator. Your own risk assessment decides depth.
Habits that make March easier
- Save evidence on a schedule, for example monthly, into a folder with a dated name.
- Link each finding to a ticket and the ticket to a fix, so the story reads in order.
- Record exceptions with an owner and an expiry date.
- Keep the policy approval and CISO review dates in one place.
If a section was not met, the acknowledgment route exists for exactly that situation. Filing it with a plan is a use of the rule as written, not a failure of the process.
Mistakes to avoid
Teams tend to stumble in the same places. Evidence is gathered in a rush in March and covers only the last few weeks. Dashboards are screenshotted but the underlying data is not saved, so nothing can be re-checked later. Tickets are closed without a link to the fix. And a known gap is left out of the conversation because nobody wants to file an acknowledgment. Keep dated exports, link fixes to findings, and bring gaps to the CISO early, since the rule has a defined route for an honest answer.
Quick check
How long must supporting records be kept?
Five years, for examination and inspection by the department on request, under 500.17(b)(3).
Is the filing a certification by an outside auditor?
No. It is a written certification or acknowledgment submitted by the covered entity and signed by its highest ranking executive and CISO.
Sources
- 23 NYCRR 500.17, Notices to Superintendent
- 23 NYCRR 500.5, Vulnerability management
- 23 NYCRR 500.8, Application security
Last reviewed: 19 October 2026.
