AegisAI Perspectives · 045
NYDFS Part 500 requires multi-factor authentication for anyone who signs in to a covered entity's systems, cloud email included, since 1 November 2025.
NYDFS Part 500 requires multi-factor authentication for any individual accessing any information system of a covered entity, and since 1 November 2025 that includes cloud email accounts1112. A CISO may approve a written compensating control instead, reviewed at least annually3. AegisAI weighs signals that follow the sign-in, such as new devices and inbox rule changes, because a stolen session token passes MFA2220.
This page covers one section of the rule, 23 NYCRR 500.12, as it applies to mailboxes. The wider set of controls and rules for a financial firm is in email security for financial services: controls and rules. It explains the regulation text and the published guidance; it is not legal advice.
Eight steps take a covered entity from a mailbox inventory to the annual certification.
List every system that holds company email. Microsoft 365 or Google Workspace counts as one of your information systems when it stores, processes or transmits your nonpublic information.
Enforce MFA for every individual who signs in. Each sign-in needs at least two of three factor types: something known, something held, or a biometric14.
Put MFA on the single sign-on login itself. A password alone does not count as MFA, nor does a browser cookie or single sign-on without MFA13.
Close the side doors. NYDFS expects MFA not to be bypassed by legacy logins or direct application access14. In Microsoft 365, a Conditional Access policy that blocks Exchange ActiveSync clients and Other clients does this, started in Report-only17.
Harden push approvals. Turn on number matching and limit push retries. Show the location and IP address in each prompt15.
Set the enforcement date in Google Workspace. Set 2-Step Verification Enforcement to On, or On from a date, and give new users an enrollment period of 1 day to 6 months19.
Record every exception in writing. The CISO may approve in writing a reasonably equivalent or more secure compensating control, reviewed at least annually.
Certify by April 15. The certification covers the prior calendar year and is signed by the highest-ranking executive and the CISO9.
AegisAI account takeover protection, in early access, weighs four signals together for each account: impossible travel, new devices, inbox rule changes, suspicious internal sends. It needs the same API connection as inbound email security, plus audit-log access, and on Microsoft 365 the sign-in reports need Entra ID P1. Each finding comes with recommended steps, and the team acts in Entra ID or Google Workspace. It does not revoke sessions today, so revoking the session and deleting the rule stay with the administrator.
Every individual's sign-in needs MFA under the full rule; the limited exemption narrows the list to three paths. The table sets each mailbox case against both.
| Account or access path | Full rule, 500.12(a) | Limited exemption, 500.12(a)(1) to (3) |
|---|---|---|
| Cloud mailbox holding nonpublic information | MFA for every individual who signs in | MFA for remote access to cloud third-party applications2 |
| Administrator or other privileged account | MFA, as for any individual | MFA for all privileged accounts |
| Service account that prohibits interactive login | The rule names individuals | Carved out of the privileged account line |
| Single sign-on portal in front of email | MFA at the single sign-on login counts | Same, for the listed paths |
| Password only, cookie or legacy protocol client | Does not qualify as MFA | Does not qualify as MFA |
| Mailbox that cannot take a second factor | Written CISO compensating control, reviewed yearly | Same |
The box below runs a mailbox review the way a CISO would before signing the certification.
Illustrative example, figures are fictional. Kestrel Point Agency is a fictional insurance agency licensed in New York, with 210 staff and no limited exemption. Its Microsoft 365 tenant holds 210 user mailboxes, 3 shared mailboxes and 2 scanners that send mail over SMTP AUTH.
The review finds 196 users with MFA enforced, 14 without, and 9 users on push approvals with no number matching. Staff open the 3 shared mailboxes from their own accounts, so the shared mailboxes need no separate sign-in. The 2 scanners cannot take a second factor.
The CISO's fix list: enforce MFA for the 14 users, turn on number matching for the 9, block legacy protocols for everyone else, and approve in writing a compensating control for the scanners. That control limits them to send-only relay to internal addresses from one office IP range, with a review date 12 months out.
In week three, one user signs in from a first-seen device on a hosting network, and a new inbox rule moves mail containing "wire" to an RSS folder. MFA passed. The administrator revokes the session and deletes the rule. The unknown MFA method comes off the account the same hour.
Yes, for every individual who signs in to one. Section 500.12(a) requires MFA for any individual accessing any information system of a covered entity, unless the entity has the limited exemption. NYDFS FAQ 22 answers the cloud email question directly: a mailbox run by a third party is still the covered entity's system when it holds nonpublic information.
A shared or delegated mailbox is reached through a user's own sign-in, so MFA on that user covers it. The text of 500.12(a) speaks of individuals. For an account no person signs in to, record the decision as a CISO compensating control under 500.12(b).
Every covered entity: any person licensed, registered or chartered under the New York Banking Law, Insurance Law or Financial Services Law5. The definition holds whether or not another government agency also regulates the entity.
A smaller entity can take the limited exemption: fewer than 20 employees and independent contractors, under $7,500,000 in gross annual revenue in each of the last three fiscal years, or under $15,000,000 in year-end total assets6. Such an entity still needs MFA for remote access, cloud applications holding nonpublic information and privileged accounts. A firm covered by the FTC Safeguards Rule instead has its own page: does the FTC Safeguards Rule require multi-factor authentication for email.
Two different factor types at every sign-in. The definition in 500.1(j) lists three factor types (knowledge, possession, inherence) and requires at least two.
The NYDFS FAQs rule out three common shortcuts: a password alone, a browser cookie, or single sign-on without MFA. Single sign-on with MFA at its own login is compliant, and the tokens it passes to downstream apps need no second prompt. Push approvals are allowed when number matching is on and retries are limited.
The rule sets three conditions: the CISO approves in writing, the control is reasonably equivalent or more secure, and it is reviewed at least annually. It names no form, so the record is the evidence.
Write one record per exception. Name the account and why a second factor cannot apply. State the substitute control and how it limits access. Close with the approval date plus the next review date. Keep it with the documents behind the April 15 certification, which must rest on data and documentation sufficient to show material compliance. A gap matters quickly: a material failure to comply for any 24-hour period is a violation10.
The universal MFA rule has applied since 1 November 2025, and no later MFA deadline appears in the text. Section 500.12 took effect on 1 March 2017 and was amended effective 1 November 20238. The amendment gave covered entities two years to meet the new 500.127, which landed on 1 November 2025. NYDFS then published FAQs 18 to 23 on 10 December 2025.
The next fixed date is the annual certification. It is due by April 15 each year and covers the prior calendar year.
Enforcement already reaches email. Healthplex agreed to a $2 million penalty and an independent audit of its MFA controls after failing to enforce MFA once it moved to Microsoft 36516.
Enforce MFA in the identity provider, close every legacy protocol, then guard the session that MFA hands out.
In Microsoft 365, find legacy sign-ins by filtering the Entra sign-in logs on Client App, then block them with Conditional Access. Token Protection accepts only device-bound session tokens, and for native apps it can be enforced on Exchange Online18. In Google Workspace, set the 2-Step Verification enforcement date and track enrollment under Reporting, User Reports, Security. Running both platforms is covered in how to run email security across Google Workspace and Microsoft 365.
MFA guards the sign-in, and the session that follows needs its own watch. A session token is issued after the MFA step, and a campaign replaying stolen tokens reached email accounts at 79 organizations between July and September 2026. In 19 of them the attacker replaced the victim's MFA method within three hours, and inbox rules hid incoming mail21. The full pattern is in how email account takeover works.
Track three numbers each week and keep the exports for the certification file.
MFA for every individual who signs in to a covered entity's email, cloud mailboxes included, since 1 November 2025. Two different factor types are required. The only alternative is a CISO-approved written compensating control, reviewed at least annually.
Only when the single sign-on login itself enforces MFA. Single sign-on without MFA does not qualify. With MFA at that login, downstream apps need no second prompt. Legacy logins must not bypass it, nor direct app access.
Yes, with safeguards. NYDFS warns that push approvals invite MFA fatigue and phishing, and says to enable number matching or challenge-response and limit retries. Prompts should show the location and IP address.
People do. The rule applies to any individual accessing a system, so staff reach a shared mailbox through their own MFA sign-in. For exempt entities, the privileged account line excludes service accounts that prohibit interactive login. Document every other non-interactive account as a CISO decision.
No. The token is issued after the MFA step, so whoever holds it skips MFA. Microsoft 365 Token Protection binds sign-in tokens to the device for Exchange Online native apps, and new MFA methods or inbox rules after sign-in are the trace to watch.
A material failure to comply for any 24-hour period is a violation. Healthplex agreed to a $2 million penalty and an independent audit of its MFA controls after failing to enforce MFA on Microsoft 365.
