A NYDFS Class A company is a larger covered entity that carries extra duties: independent audits of its cybersecurity program, privileged access management with monitoring, automated blocking of commonly used passwords, an endpoint detection and response solution, and centralized logging with security alerting. The CISO can approve compensating controls in some cases.
This is general information, not legal advice.
Who counts
Section 500.1(d) defines a Class A company as a covered entity with at least 20,000,000 dollars in gross annual revenue in each of the last two fiscal years from its business operations and those in New York of its affiliates, and either over 2,000 employees averaged over two years, counting affiliates wherever located, or over 1,000,000,000 dollars in gross annual revenue in each of those years across the entity and all affiliates. Only affiliates that share systems or cybersecurity resources are counted.
The extra duties
| Section | Duty for Class A companies |
|---|---|
| 500.2(c) | Design and conduct independent audits of the cybersecurity program based on the risk assessment |
| 500.7(c)(1) | Monitor privileged access activity and implement a privileged access management solution |
| 500.7(c)(2) | Automated blocking of commonly used passwords, with CISO approved alternatives if infeasible |
| 500.14(b)(1) | An endpoint detection and response solution to monitor anomalous activity, unless the CISO approves equivalent compensating controls |
| 500.14(b)(2) | A solution that centralizes logging and security event alerting, same CISO option |
What each means for engineering
Independent audit means auditors free to make decisions not influenced by the entity or its owners, managers or employees. Plan for access to evidence and for time to answer questions.
Privileged access management and monitoring touches how developers and operators elevate rights in production, cloud and CI. Time bound elevation and session records are common patterns.
Password blocking applies across accounts on systems the company owns or controls, and wherever feasible to others.
EDR and central logging are infrastructure choices owned by security and platform teams. Application teams feed them by emitting useful logs and by keeping hosts enrolled.
Planning for growth
A mid sized firm approaching the thresholds can prepare early. Set up central logging first, since it also supports the audit trail duty in 500.6. Pilot privileged access controls on the most sensitive systems. Check each year whether thresholds are close.
Mistakes to avoid
Large firms trip over the same points. Tools are bought but not deployed on every system in scope. Logging is central but missing key sources such as CI and cloud control planes. Compensating control approvals are written but never reviewed. And independent audit evidence is assembled late. Measure deployment coverage, list log sources against the inventory, track approvals with dates, and prepare an evidence index early.
Quick check
Who approves compensating controls for Class A duties?
For the password blocking and the 500.14(b) tools, the CISO may approve compensating controls in writing, with the text setting the conditions in each case.
Are all affiliates counted?
Only affiliates that share information systems, cybersecurity resources or part of the cybersecurity program with the covered entity are counted in the Class A calculation.
Sources
- 23 NYCRR 500.1, Definitions
- 23 NYCRR 500.2, Cybersecurity program
- 23 NYCRR 500.7, Access privileges and management
- 23 NYCRR 500.14, Monitoring and training
Last reviewed: 19 October 2026.
