Reference · Cybersecurity

23 NYCRR 500.13: Asset Management and Data Retention

Asset management and data retention requirements

Last reviewed October 11, 2026

Section 500.13 of the NYDFS cybersecurity regulation, 23 NYCRR Part 500, requires every covered entity to keep a documented inventory of its information systems and to dispose securely of nonpublic personal and health information it no longer needs.23 NYCRR 500 · § 500.13 The section names the fields the inventory tracks, so an examiner can test it field by field. The inventory requirement has applied since 1 November 2025.23 NYCRR 500 · § 500.22(d)(4)

It binds every covered entity, including those with a limited exemption

A covered entity is any person operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation, or similar authorization under the New York Banking Law, Insurance Law, or Financial Services Law, whether or not another government agency also regulates it.23 NYCRR 500 · § 500.1(e)

Part 500's limited exemptions leave 500.13 in place. A small covered entity under 500.19(a) (fewer than 20 employees and independent contractors, less than $7.5 million in gross annual revenue in each of the last three fiscal years, or less than $15 million in year-end total assets, each counted with affiliates as the section specifies) is exempt from a list of sections that does not include 500.13, and so are the entities exempt under 500.19(c) and (d). An employee, agent, representative, designee, or wholly owned subsidiary of a covered entity that is itself a covered entity is exempt from Part 500 to the extent that covered entity's cybersecurity program covers it.23 NYCRR 500 · § 500.19

Keep a documented inventory of every information system

Each covered entity implements written policies and procedures designed to produce and maintain a complete, accurate, and documented asset inventory of its information systems. At a minimum, those policies and procedures include:23 NYCRR 500 · § 500.13(a)

A method to track key information for each asset, including, as applicable, its owner, location, classification or sensitivity, support expiration date, and recovery time objectives.
The frequency required to update and validate the inventory.

The Second Amendment added this requirement and retitled the section, which until then was headed Limitations on data retention.Second Amendment · § 500.13 Covered entities had two years from the amendment's effective date of 1 November 2023 to comply.23 NYCRR 500 · § 500.22(d)(4) An information system is any discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of electronic information,23 NYCRR 500 · § 500.1(i) so an AI tool that processes the entity's data belongs on the inventory alongside its databases.

Dispose of nonpublic personal and health information once it is no longer needed

Each covered entity's cybersecurity program includes policies and procedures for the secure disposal, on a periodic basis, of nonpublic information that is no longer necessary for business operations or other legitimate business purposes.23 NYCRR 500 · § 500.13(b) The duty reaches the categories in 500.1(k)(2) and (3): information that identifies an individual in combination with a Social Security number, a driver's license or non-driver identification number, an account or card number, an access code to a financial account, or biometric records; and health information, other than age or gender, created by or derived from a health care provider or an individual.23 NYCRR 500 · § 500.1(k)

Two exceptions apply: information that law or regulation requires the entity to retain, and information whose targeted disposal is not reasonably feasible because of the way it is maintained.23 NYCRR 500 · § 500.13(b)

The second exception turns on how the information is maintained. Where AI systems copy nonpublic information into prompts, embeddings, caches, or logs, the practical question is whether the entity can locate those copies and dispose of them at all, and the answer depends on how those systems were built.

Inventory the systems that use AI, and dispose of the data they hold

The Department's October 2024 letter on cybersecurity risks arising from AI applies 500.13 to AI directly. The disposal duty covers nonpublic information used for AI purposes. An entity that uses AI, or relies on a product that does, should identify every information system that uses or relies on AI, including those that maintain or rely on AI-enabled products and services, keep an inventory of them, and prioritize mitigations for the systems critical to ongoing operations.NYDFS AI letter · Data Management

The letter asked entities with AI assets to consider applying the inventory requirements to those assets immediately, ahead of the November 2025 deadline.NYDFS AI letter · footnote 34 It imposes no requirements beyond those in Part 500.NYDFS AI letter

Make the inventory the input to the Risk Assessment

Guidance the Department issued on 10 September 2026 on conducting and using Risk Assessments states that covered entities are required to maintain an accurate and current asset inventory, and that the inventory should serve as the foundational input to the Risk Assessment. The assessment should also consider where nonpublic information resides, how it flows through information systems, who has access to assets, and how they are protected.NYDFS Risk Assessment guidance · Scope and Coverage

Among the common gaps the Department has found in Risk Assessments during examinations and investigations are outdated or incomplete asset inventories and failure to identify where nonpublic information resides or flows. The guidance states that it does not create new obligations.NYDFS Risk Assessment guidance

Control mapping

What a reviewer expects to be able to see.

Obligation	What the system must do	Evidence a reviewer expects
Asset inventory	Maintain a complete, accurate, documented inventory of information systems under written policies and procedures	Inventory export and the policy that governs it
Tracked fields	Track owner, location, classification or sensitivity, support expiration date, and recovery time objective for each asset, as applicable	Field-level completeness report, with the reason for each field marked not applicable
Update and validation	Set and follow a frequency for updating and validating the inventory	Policy stating the frequency, and records of each validation
AI systems	Identify every information system that uses or relies on AI, including AI-enabled products from vendors	Inventory entries for AI systems, with owner and criticality
Disposal policy	Define which nonpublic information is disposed of, when, and by what method	Written retention and disposal policy with defined periods
Disposal execution	Locate and delete nonpublic information wherever it came to rest, including copies held by AI systems	Disposal logs tied to specific records, systems, and dates
Documented exceptions	Record each retention exception with its legal basis, or the reason targeted disposal is not reasonably feasible	Exception register with basis, owner, and review date

Key dates

Timeline, drawn to scale

Section 500.13 since the Second Amendment

Issued or in forceInventory requirement applies

Dates from the Second Amendment and the Department's October 2024 and September 2026 guidance. Status as of October 11, 2026.

1 March 2017Part 500 takes effect, with section 500.13 headed Limitations on data retention.
1 November 2023Second Amendment takes effect, retitling 500.13 Asset management and data retention requirements and adding the asset inventory requirement in 500.13(a).
16 October 2024Department letter on cybersecurity risks arising from AI asks entities to inventory the systems that use or rely on AI.
1 November 2025Asset inventory requirement in 500.13(a) applies.
10 September 2026Department guidance on Risk Assessments names the asset inventory as the foundational input to the Risk Assessment. It states it does not create new obligations.

Sources cited

Common gaps

Where the requirement and operational reality most often diverge.

A retention policy with no disposal capability. A policy stating what is kept and for how long answers half of 500.13(b). The other half is evidence that information was located and deleted on schedule.
AI copies outside the inventory. Nonpublic information copied into prompts, embeddings, caches, and logs often sits outside the inventory and beyond the reach of disposal tooling. The Department's 2024 AI letter brings it within the disposal duty.NYDFS AI letter · Data Management
Blank fields with no explanation. The regulation qualifies the five fields with "as applicable", so a blank needs a reason. An inventory with empty support expiration dates and recovery time objectives and no explanation reads as incomplete.
Over-reliance on the infeasibility exception. The exception covers disposal that is not reasonably feasible given how the information is maintained. Asserting it without a technical rationale invites the follow-up question.
Undocumented exceptions. Where law requires retention, record the basis, owner, and review date for each exception. An unwritten understanding leaves an examiner nothing to review.
An inventory the Risk Assessment never reads. The Department has observed that failing to account for assets in a Risk Assessment gives an incomplete view of risk.NYDFS Risk Assessment guidance · Scope and Coverage An inventory kept by one team and a Risk Assessment written by another, with no link between them, produces exactly that.

In practice

How Meilynx maps to NYDFS 23 NYCRR 500 →

Last reviewed October 11, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.