Section 500.17 of New York's cybersecurity regulation for financial services requires covered entities to notify the superintendent within 72 hours of determining a cybersecurity incident occurred, to give notice within 24 hours of an extortion payment, and to file an annual certification or acknowledgment by April 15. This is education, not legal advice.
Three different duties in one section
The text of 500.17 covers three separate notices.
Incident notice. Within 72 hours of determining that a cybersecurity incident occurred at the covered entity, an affiliate, or a third party service provider, the entity must notify the superintendent electronically. It must also respond promptly to information requests and keep the superintendent updated on material developments.
Extortion payment. After making an extortion payment connected to a cybersecurity event, the entity must give notice within 24 hours. Within 30 days it must submit a written explanation covering why the payment was necessary, what alternatives were considered, and the diligence performed, including checks for compliance with OFAC rules.
Annual filing. By April 15 each year, the entity files either a certification of material compliance for the prior calendar year or an acknowledgment of noncompliance. An acknowledgment identifies the sections not met, describes the gap, and gives a remediation timeline or confirms remediation is complete. It is signed by the highest ranking executive and the CISO, or the senior officer responsible for the program if there is no CISO. Supporting records are kept for five years.
Determination, not discovery
The incident clock runs from the entity's determination that an incident occurred. That differs from rules that run from first knowledge. It does not give licence to delay the determination. A process that leaves suspected incidents in limbo is hard to defend.
Third parties are in scope
Notice is triggered by incidents at third party service providers too. If a vendor tells you they were breached and your data was involved, your 72 hours can start. That is a reason to require prompt vendor notice in contracts and to keep an inventory of who holds your data.
The payment documentation is an engineering question too
The 30 day explanation asks what alternatives were considered. If you keep tested, offline backups and recovery runbooks, you can show that you evaluated restoring instead of paying. Without them the alternatives section is thin. See also our note on OFAC and ransom payments.
Preparing the annual certification
The certification signatories attest to compliance, so they will ask for evidence. Gather it through the year, not in March: scan results, access reviews, training records, incident exercises. Safeguard's compliance and evidence automation can collect and organise this kind of record, but the attestation itself remains the signers' responsibility.
Quick check
Does a third party incident trigger notice?
The text covers incidents at the covered entity, an affiliate or a third party service provider, once the entity determines the incident occurred.
Who signs the annual filing?
The highest ranking executive and the CISO, or the senior officer responsible for the cybersecurity program if there is no CISO.
Sources
Last reviewed: 19 October 2026.
