Financial services organizations face the most demanding regulatory environment in any industry. NY DFS, GLBA, PCI DSS, SOX, and the new SEC cybersecurity rules demand documented, current, defensible evidence — not policies written in 2022 and a scan from last quarter.
Until recently, the Certification of Material Compliance was the finish line: log into the DFS portal, find your agency icon, check the boxes, done.
That era is over. DFS placed strict third-party due diligence obligations on insurance carriers, and carriers are pushing those obligations downstream to the agencies and aggregators that sell their products. Questionnaires that once asked Yes or No now ask if yes, show us the evidence. A checked box is no longer an answer.
The gap is rarely the control. It is the document that proves the control was there — and that is what fails an examination. PCS turns each DFS requirement into a plain question you can answer, keeps the supporting document behind every answer, and produces the compliance record on the day your carrier, your examiner, or your biggest client asks for it.
23 NYCRR Part 500 · 42 sections · Second Amendment effective 1 November 2023
Most financial services firms are subject to multiple frameworks simultaneously. Pistos maps them all to a single CIS Controls v8.1 anchor — implement one control, satisfy every framework that requires it.
New York Department of Financial Services
The most comprehensive state cybersecurity regulation in the US. Requires a written cybersecurity program, annual penetration testing, CISO designation, board reporting, and annual Certification of Material Compliance. The 2023 amendment expanded requirements significantly — many firms filed certifications that do not reflect the amended requirements.
Gramm-Leach-Bliley Act — FTC / Banking Regulators
Requires financial institutions to develop, implement, and maintain a comprehensive information security program. The 2023 updated Safeguards Rule added specific technical requirements — encryption, MFA, vulnerability assessment, and incident response — that many existing programs do not address.
Payment Card Industry Data Security Standard
Any organization that processes, stores, or transmits payment card data must comply. Version 4.0 introduced customized implementation options and new requirements around targeted risk analysis, authentication, and web-based payment page security that took effect in March 2025.
Sarbanes-Oxley Act — SEC / PCAOB
Public companies must maintain effective internal controls over financial reporting, which PCAOB auditors assess through IT General Controls — access control, change management, computer operations, and security. Deficiencies in IT controls are material weaknesses in financial reporting.
Securities and Exchange Commission — 2023
Public companies must disclose material cybersecurity incidents within four business days and provide annual disclosures about cybersecurity risk management, strategy, and governance. Board-level oversight of cybersecurity risk must be documented and disclosed.
ACH Network — Originating Depository Financial Institutions
ACH originators must maintain a written security framework, conduct annual risk assessments, and provide phishing simulation training for ACH-access staff. ODFI agreements require documented fraud detection standards and workforce competency records.
NY DFS examiners, OCC supervisors, and PCI QSAs ask the same questions in every examination. Pistos is built around producing exactly what they need — before they ask.
Documented annual risk assessment required by NY DFS 500.09 and GLBA.
PCS produces a complete risk assessment report — thirty scored controls with per-control applicability, inherent risk, risk addressed, and a prioritized remediation roadmap.
NY DFS 500.04 requires a qualified CISO responsible for the cybersecurity program.
Aegis provides the designated CISO function with documented responsibilities and board reporting.
Every framework requires documented training for all personnel.
Mathisi produces dated training completion records and phishing simulation results linked to each employee.
NY DFS 500.12 requires MFA for all remote access and privileged accounts.
Skopein reads actual MFA enforcement state — not what the vendor reports, but what is actually configured — and the finding files itself against the control.
NY DFS 500.11 requires third-party service provider security policies.
PCS tracks vendor relationships and assessment status, with the dated evidence attached to each vendor record.
NY DFS requires annual Certification of Material Compliance by April 15.
Aegis prepares the certification, supported by a complete and current PCS evidence record.
Request a briefing and we will map the Pistos platform to your specific NY DFS or GLBA examination requirements.
Request a briefing