New York Department of Financial Services’ Industry Letter: Foreshadowing Enforcement of Vendor Management?

On October 21, 2025, the New York State Department of Financial Services (NYDFS) issued an industry letter, titled, “Guidance on Managing Risks Related to Third-Party Service Providers,” which clarifies covered entities’ responsibilities when engaging third‑party service providers (TPSPs) that access information systems or nonpublic information (NPI). Although the guidance does not add new rules to the NYDFS Cybersecurity Regulations (23 NYCRR Part 500), it clarifies regulatory requirements with respect to TPSPs, provides suggestions for best practices, and may signal increased regulatory focus on third-party risk management.