DeskProcess OS
Overlay · not the system of recordHolds sit above scoreAsk Desk is deterministic — no modelLocal

GRC / regulatory analyst

NYDFS 500 amendment — MFA on vendors

23 NYCRR 500

Lane · Standard

PriorityP2
Severityhigh
PacketReady
Suggested—

Why this is here

Amendment expands MFA to a class of vendors we treat as low-risk. Inventory is 70% mapped.

  • FeedAmendment effective in 64 days
  • CMDB214 vendors, 64 untagged
  • OpenPagesNo control owner for vendor MFA
Recommended. Monitor until the vendor list is complete. Do not open 200 issues. Open one program obligation.
Which vendors are 'class A' is still being argued by InfoSec vs Legal.

Current: Open

Overlay only. Will POST a label to the write-back URL, never a funds release. IBM OpenPages OPSS-Iss:WorkflowStatus=WATCH on reg-nydfs. Desk is not the system of record.