Section 500.4(b) of NYDFS Part 500 requires the CISO to report in writing at least annually to the senior governing body on six topics: confidentiality and integrity of information, policies and procedures, material risks, program effectiveness, material cybersecurity events, and plans for fixing material inadequacies. Engineering supplies the numbers behind each.
This is general information, not legal advice.
The six topics and engineering inputs
| Topic in 500.4(b) | What engineering can supply |
|---|---|
| Confidentiality of nonpublic information and integrity and security of systems | Access review results, encryption coverage, count of systems with sensitive data |
| Cybersecurity policies and procedures | Status and review dates of standards |
| Material cybersecurity risks | Top open risks from the risk assessment, with owners |
| Overall effectiveness of the program | Trends in vulnerability age, scan coverage, restore test outcomes |
| Material cybersecurity events during the period | Incident summaries and root causes |
| Plans for remediating material inadequacies | Funded and dated remediation items |
The report is written, and subsection (c) adds that the CISO must timely report material issues such as significant events and significant program changes, between annual reports.
What the board is expected to do
Subsection (d) asks the senior governing body to exercise oversight: have enough understanding of cybersecurity matters to do so, which may include advisors; require management to build and maintain the program; regularly receive and review management reports; and confirm management has allocated sufficient resources. The report is the main input to those duties, so clarity matters more than volume.
Making engineering numbers useful
Avoid raw counts without context. Better:
- Age, not just number, for open vulnerabilities, grouped by risk.
- Coverage: share of systems and repositories scanned, and share with a named owner.
- Time: how long fixes take compared with the stated timeline.
- Exceptions: how many are open, how many have expired.
- Tests: what was exercised this year and what failed.
Pair every metric with a sentence on what decision it supports. A chart with no decision is noise.
Show the resource question honestly
The board must confirm that resources are sufficient. If a backlog is aging because the team lacks capacity, say so with data. If tooling gaps block coverage, name them. Engineering credibility rises when the report links needs to risks the board already sees.
Mistakes to avoid
Reports weaken when they list activity instead of outcomes, bury the main risk on page nine, or show only good news. Another problem is metrics that change definition every year, so trends cannot be read. Lead with the top three risks, show plain trends with stable definitions, include what did not go well, and end with decisions the board is being asked to take.
Quick check
Does the CISO have to be an employee?
No. Section 500.4(a) allows the CISO to be employed by the entity, an affiliate or a third party service provider, with the entity retaining responsibility for compliance and designating a senior member to oversee the provider.
How often is the report due?
In writing at least annually, plus timely reports on material issues.
Sources
Last reviewed: 19 October 2026.
