The amended Part 500 finished phasing in on November 1, 2025 with MFA for every user of every information system and a full asset inventory that records owner, location, classification, support end date and recovery time. What licensees must now have, the reporting clocks, and how each requirement maps to AWS services.
23 NYCRR Part 500 applies to anyone licensed under New York's Banking, Insurance or Financial Services Law, which includes carriers, agencies and many MGAs and producers doing business in the state. The second amendment, adopted in November 2023, phased in over two years. The last requirements took effect on November 1, 2025.
MFA for any individual accessing any of the covered entity's information systems, regardless of location, user type or data. The exception is compensating controls approved in writing by the CISO and reviewed at least annually, or a limited exemption.
An asset inventory that tracks, for each information system, its owner, location, classification or sensitivity, support expiration date and recovery time objective.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Outside New York, many states have adopted a version of the NAIC Insurance Data Security Model Law, which requires an information security program and notice to the commissioner within 72 hours of determining a cybersecurity event. Details vary by state.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
AI in Underwriting and Claims in 2026: The NAIC Bulletin, Colorado, and the EU AI Act's New Dates
Twenty-nine jurisdictions had adopted the NAIC's AI model bulletin by October 2026, Colorado replaced its general AI law in May 2026 while keeping its insurance-specific rules, and the EU moved high-risk obligations, including life and health insurance pricing, to December 2, 2027. What insurers using AI need to be able to show, and how to build it.
Read
Claims and Underwriting Documents on AWS: Textract, Bedrock Data Automation, or an LLM?
First notice of loss forms, medical records, police reports, loss runs, invoices and supplemental applications arrive as PDFs, scans and photos. Three ways to turn them into data on AWS, with current per-page prices, the accuracy you should measure, and the human review loop that keeps it safe.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.