How this command is triggered — by the user, by Claude, or both
Slash command
/nydfs:assessThe summary Claude sees in its command listing — used to decide when to auto-load this command
# NYDFS Assessment Evaluates organizational readiness for New York Department of Financial Services (NYDFS) 23 NYCRR 500 cybersecurity requirements. ## Arguments - `$1` - Entity type (required: covered-entity, limited-exemption, full-scope) - `$2` - Assessment scope (optional: full, gap-analysis, annual-certification) ## NYDFS 23 NYCRR 500 Overview **Effective Date**: March 1, 2017 (with phased implementation through 2019) **Amended**: November 1, 2023 (significant updates) **Applicability**: Financial services institutions operating in New York State **Annual Certification**: Required...
Evaluates organizational readiness for New York Department of Financial Services (NYDFS) 23 NYCRR 500 cybersecurity requirements.
$1 - Entity type (required: covered-entity, limited-exemption, full-scope)$2 - Assessment scope (optional: full, gap-analysis, annual-certification)Effective Date: March 1, 2017 (with phased implementation through 2019) Amended: November 1, 2023 (significant updates) Applicability: Financial services institutions operating in New York State Annual Certification: Required by April 15th each year
| Type | Description | Requirements | Exemptions |
|---|---|---|---|
| Covered Entity | <10 employees, <$5M revenue, <$10M assets | Full compliance | Limited exemptions available |
| Limited Exemption | Qualifies for certain exemptions | Reduced requirements | Must file exemption notice |
| Full Scope | Does not qualify for exemptions | All 23 sections apply | No exemptions |
Covered Entities Under 23 NYCRR 500:
500.02 - Cybersecurity Program
500.03 - Cybersecurity Policy
500.04 - Chief Information Security Officer (CISO)
500.09 - Risk Assessment
500.06 - Audit Trail
500.07 - Access Privileges
500.11 - Multi-Factor Authentication (MFA)
500.12 - Limitations on Data Retention
500.14 - Training and Monitoring
500.15 - Encryption of Nonpublic Information
500.16 - Incident Response Plan
500.17 - Business Continuity and Disaster Recovery
500.19 - Notices to Superintendent
500.10 - Cybersecurity Personnel and Intelligence
500.11 - Third-Party Service Provider Security Policy
500.05 - Penetration Testing and Vulnerability Assessments
500.08 - Application Security
500.13 - Limitations on Wireless Access
500.18 - Material Changes
500.20 - Exemptions
500.23 - Effective Dates
Expanded Coverage:
Enhanced Requirements:
New Definitions:
CISO Requirements (500.04):
Annual Certification (500.17):
Penetration Testing (500.05):
MFA (500.11):
Incident Response (500.16, 500.19):
Third-Party Risk (500.11):
Encryption (500.15):
Due Date: April 15 (for prior calendar year) Certifier: Board of Directors or Senior Officer Submission: Electronic via NYDFS portal Statement: Compliance with 23 NYCRR 500 Attachments: May include exemptions, explanations
Certification Statement Requires:
# Full assessment for covered entity
/nydfs:assess covered-entity full
# Gap analysis for limited exemption entity
/nydfs:assess limited-exemption gap-analysis
# Annual certification readiness check
/nydfs:assess full-scope annual-certification
npx claudepluginhub rifh2000/claude-grc-engineering. --plugin nydfs/assessAssesses a local repo against a wiki's research and market landscape, producing gap analysis, opportunities, and competitive insights.
/assessAssesses DORA compliance readiness for EU financial entities and ICT providers. Requires scope (full, pillar-specific, entity-type); optional entity classification.
/assessAssesses GLBA compliance readiness for specified scope (full, safeguards, privacy, pretexting) and institution type, producing compliance score and detailed evaluation.
/assessAssesses compliance with NIST 800-53 controls for a specified control family (e.g., AC) or baseline (low, moderate, high), with optional revision (r4 or r5).
/assessAssesses SOC 2 Type I or II audit readiness for specified scope (security, availability, confidentiality, processing integrity, privacy), producing readiness scores, control gaps, evidence requirements, remediation recommendations, and timeline.
/assessAssesses ISMS compliance against ISO 27001:2022 clauses and Annex A controls, producing status reports, gap analysis, Statement of Applicability guidance, and certification readiness.