Issued May 21, 2026 as the companion to DFS's frontier-AI letter, this guidance defines a 'heightened cybersecurity threat environment' as one where risks are significantly elevated with a high likelihood of impacting information systems, nonpublic information, or operations — expressly including the arrival of frontier AI models — and lists the measures DFS expects firms to consider in three areas: reducing the attack surface, improving threat detection and readiness, and improving resilience and response. It states it does not alter Part 500 requirements.
| Document | DFS Heightened Threat Environment Guidance (May 2026) — Guidance on Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment |
| Issued by | New York State Department of Financial Services |
| Type | Guidance |
| Status | In force |
| Published | May 21, 2026 |
| Effective | May 21, 2026 |
| Applies to | All DFS-regulated entities subject to 23 NYCRR Part 500 |
| Official source | dfs.ny.gov ↗ |
| Use cases | Cybersecurity · Third-party & vendor AI · AI governance (general) |
What are the key points of DFS Heightened Threat Environment Guidance (May 2026)?
- Reduce the attack surface: fix known exploited vulnerabilities quickly, disable unused ports and protocols, move to phishing-resistant MFA (authenticator apps, hardware tokens), segment networks, and review privileged access and cloud configurations.
- Improve detection and readiness: deploy current intrusion detection and prevention, monitor logs and alert on suspicious activity, act on threat intelligence and indicators of compromise, train staff on social engineering, and engage third-party providers on the heightened risk.
- Improve resilience and response: test backup integrity and recovery, exercise incident-response and business-continuity plans, prepare communications for disruptions, and ensure critical systems can run independently.
- Includes a reminder to keep monitoring financial and virtual-currency transactions for compliance during a disruption.
- Names frontier AI models as a technological development that can trigger a heightened threat environment, tying it to the same-day frontier-AI letter.
- Explicitly does not create new legal requirements or alter Part 500.
What did DFS Heightened Threat Environment Guidance (May 2026) change for banks?
Before May 2026 DFS issued threat-specific advisories (for example the February 6, 2026 vishing advisory) case by case; this guidance gives banks a standing checklist to switch on whenever DFS or the firm declares a heightened threat environment, and pairs it with an explicit AI trigger. Examiners can now ask which of these measures a firm considered and why any were not adopted.
When does a 'heightened cybersecurity threat environment' exist under NYDFS guidance?
When cybersecurity risks are significantly elevated and therefore have a high likelihood of impacting information systems, nonpublic information, or operations — DFS cites geopolitical events and the emergence of frontier AI models as examples.
Is the heightened threat environment guidance binding?
No. It supplements 23 NYCRR Part 500 and states it does not establish new legal obligations, but DFS frames its measures as expectations that inform risk management and will be discussed in examinations.
| Date | Document | Status |
|---|---|---|
| May 21, 2026 | DFS Frontier AI Models Industry Letter (May 2026) — Heightened Cybersecurity Risks Associated with Frontier AI Models | In force |
| Dec 16, 2025 | Asrow Assembly Statement on AI in Insurance (Dec 2025) — Statement by DFS Acting Superintendent Kaitlin Asrow at the NYS Assembly Hearing on the Use of Artificial Intelligence Systems in Insurance Underwriting and Pricing | Final |
| Oct 16, 2024 | DFS AI Cybersecurity Industry Letter (Oct 2024) — Cybersecurity Risks Arising from Artificial Intelligence and Strategies to Combat Related Risks | In force |
| Jul 11, 2024 | Insurance Circular Letter No. 7 (2024) — Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing | In force |
| May 30, 2024 | DFS Virtual Currency Customer Service Guidance (May 2024) — Guidance Regarding Customer Service Requests and Complaints (Virtual Currency Entities) | In force |
| Jan 17, 2024 | DFS Proposed AI Insurance Circular Letter (Jan 2024) — Proposed Insurance Circular Letter on the Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing | Superseded |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →