New York's Department of Financial Services has issued guidance that changes how licensed financial firms should run cybersecurity risk assessments. The guide covers shared vendors, artificial intelligence and quantum computing, and it draws on what the Department saw in past examinations and investigations. The National Law Review reported the guidance on October 29, 2026, and noted it is aimed at financial services entities operating under a Department license (National Law Review).
The operating problem the guidance targets is narrow and familiar: most risk assessments stop at the question of whether a vendor has security measures in place. NYDFS says that is not enough. Companies should weigh how much they rely on the vendor's services, what data the vendor holds or can access, how it connects to the firm's own systems, and what happens if the service stops. For teams that own cybersecurity programs at licensed entities, that turns vendor review from a checkbox into a dependency analysis. Readers following this should also see Cybersecurity Salary: What Moves the Number, Role by Role.
The impact reaches beyond the firms the Department licenses directly. The National Law Review's practice note argues the guidance contains ideas useful to any company building out a risk assessment process, whether or not NYDFS regulates it (National Law Review). Regulators' concerns about how risk assessments are conducted, the note says, are ongoing.
What the guidance asks firms to weigh on vendors
The vendor section is the most operational part. Rather than asking a single yes-or-no question about a provider's controls, the guidance lays out a set of factors. The first is reliance: how much does the firm actually depend on this vendor's services? The others cover the type of data the vendor holds or can reach, the vendor's links to the firm's systems, and the consequences if the service stops working (National Law Review).
That list reads like a failure-impact map. A vendor with strong security can still be a critical dependency if the business cannot operate when it goes down. The guidance effectively asks firms to rank vendors by what breaks, not only by who protects what.
Shared vendors and contagion risk
The guidance also looks at risks from shared vendors and shared systems. The specific concern is spread: the extent to which one failure could propagate to other systems or other parts of the business (National Law Review). For any firm using a common provider across multiple business lines, that question has to be answered before an incident, not during one.
AI and quantum: assess the change, not the deadline
On emerging technology, the guidance takes a different shape. It recommends that companies assess whether AI tools and quantum computing might change the firm's cyber risk. One example the guidance gives: whether AI use and advances in quantum computing might affect how encryption protects data in the future (National Law Review).
Two limits matter here. The guidance does not set a deadline for changing encryption, and it does not name a required replacement. It asks firms to think about whether the threat picture is shifting, not to rip out cryptography on a schedule. That leaves the hard decisions — which systems hold long-lived data, what to migrate, when — with the firms themselves.
For teams tracking AI adoption, this sits alongside the broader governance questions that come with deploying models in regulated environments. Our coverage of AI & Machine Learning follows how enterprises handle those tradeoffs.
Method, scope and documentation
The vendor and emerging-tech items sit inside a larger framework. According to the National Law Review, a related discussion covers governance, oversight, methodologies, scope and documentation, while this article handles vendors and AI and quantum as related items. The guidance as a whole clarifies best practices and gaps for conducting cybersecurity risk assessments, based on the Department's past examinations and investigations (National Law Review).
That provenance is the part worth noting. The guidance is not a thought exercise; it reflects what examiners actually found wanting in assessments they reviewed. Firms that align their methodology with it are aligning with the regulator's own list of observed gaps.
What to do this quarter
The practical read for any risk or security team, licensed or not, is a short list:
- Score vendors by reliance and failure impact, not only by their security posture.
- Map which vendors connect to which internal systems, and what data each can reach.
- Trace how a single shared vendor or system failure could spread across business lines.
- Add AI and quantum as assessment factors: could they change how current encryption protects data?
None of this requires new tooling. It requires the assessment to ask harder questions about dependencies than most do today. The evidence establishes what the guidance covers and what it deliberately leaves open — no encryption deadline, no mandated replacement. The open question is how examiners will weigh these factors in future reviews, and the guidance's own history suggests that answer will come from the examination findings that follow.
