When New York’s Department of Financial Services (DFS) released its landmark cybersecurity regulation — 23 NYCRR 500, commonly known as the NYDFS Cybersecurity Regulation — many organizations focused exclusively on their digital security posture: network protection, encryption, multi-factor authentication, and incident response plans. But a careful reading of the regulation reveals something many compliance officers miss: the requirements for data governance, risk assessment, and information security apply to all nonpublic information — not just data stored on servers or transmitted digitally. For covered entities, New York cybersecurity law document destruction is not optional — it’s an affirmative compliance obligation.
This creates a direct connection between the NYDFS Cybersecurity Regulation and physical document shredding. If your organization holds paper records containing nonpublic information — and virtually every covered entity does — then the regulation’s requirements for data minimization, access controls, and secure disposal apply to those physical records as well as digital ones. This guide explains the connection, identifies which document types are at risk, and outlines what a compliant physical document destruction program looks like for covered entities in New York.
What is the NYDFS Cybersecurity Regulation (23 NYCRR 500)?
The NYDFS Cybersecurity Regulation (23 NYCRR 500) was first enacted in 2017 and significantly updated in 2023, making it one of the most comprehensive financial sector cybersecurity frameworks in the United States. It applies to entities licensed, registered, chartered, or authorized under New York Banking Law, Insurance Law, or Financial Services Law — covering banks, insurance companies, mortgage lenders, money transmitters, and a broad range of other financial services entities operating in New York.
Key requirements under 23 NYCRR 500 that have physical document implications include:
- Risk assessment: Covered entities must conduct periodic risk assessments covering all information systems and the nonpublic information they contain — including paper records
- Data minimization: Entities must limit retention of nonpublic information to only what is necessary for legitimate business purposes
- Access controls: Controls must limit access to nonpublic information to authorized individuals — which extends to physical records storage
- Secure disposal: Nonpublic information that is no longer needed must be securely disposed of in a timely manner
- Vendor management: Covered entities must ensure their service providers also meet appropriate security standards
Visit our compliance page for additional information about how shredding supports your regulatory requirements.
What Counts as Nonpublic Information Under 23 NYCRR 500?
The regulation defines nonpublic information broadly to include business-related information that would have a material adverse impact on the covered entity if disclosed, and personal information that can be used to identify individuals combined with certain sensitive data elements (Social Security numbers, financial account numbers, biometric data, etc.).
In practice, this means physical documents that commonly appear in financial services offices — account statements, loan applications, underwriting files, insurance policy documents, customer correspondence, employee personnel files, audit documents, and internal financial records — are all likely to contain nonpublic information subject to the regulation’s requirements.
The Secure Disposal Requirement for Physical Records
Section 500.13 of 23 NYCRR 500 specifically addresses data retention and disposal. Covered entities must include in their cybersecurity policies and procedures a process for the secure disposal of nonpublic information that is no longer needed for a legitimate business purpose. The regulation does not specify a particular method of disposal, but regulators and compliance professionals broadly agree that for paper records, secure destruction by a certified shredding vendor satisfies this requirement.
A compliant document destruction program for NYDFS purposes should include:
- A documented retention schedule specifying how long different categories of records are retained
- A formal process for identifying records that have passed their retention period
- Secure collection and storage of records pending destruction (locked consoles)
- Destruction by a certified vendor using industrial shredding equipment
- A Certificate of Destruction for each destruction event as audit trail documentation
- Vendor due diligence confirming the shredding company’s own security practices
Third-Party Vendor Requirements and Document Destruction
Section 500.11 of the NYDFS Cybersecurity Regulation requires covered entities to have a written policy governing the security practices of their third-party service providers. This includes vendors who have access to nonpublic information — and a shredding company that handles your physical records containing nonpublic information qualifies as such a vendor.
When evaluating a document shredding vendor for NYDFS compliance purposes, covered entities should verify:
- NAID AAA Certification, which independently verifies the vendor’s security practices
- The vendor’s own written information security policies
- Employee background check procedures
- Chain-of-custody documentation and Certificate of Destruction practices
- Adequate insurance coverage for security incidents
New York Shredding provides NAID-certified services and documentation to support your vendor due diligence requirements. Contact us to discuss your compliance program.
NY SHIELD Act and GLBA: Related Physical Security Requirements
While the NYDFS Cybersecurity Regulation applies specifically to DFS-regulated entities, New York’s broader data security framework — including the NY SHIELD Act — imposes physical safeguard requirements on virtually all businesses that hold New York residents’ private information. The SHIELD Act requires covered businesses to implement reasonable administrative, technical, and physical safeguards for private information, including procedures for secure destruction of paper records.
Federal law adds another layer: the Gramm-Leach-Bliley Act (GLBA) requires financial institutions to implement security programs that include provisions for the proper disposal of customer information in paper form. Together, these frameworks create a consistent mandate for covered entities to implement and document physical document destruction programs. Learn more about compliance requirements on our compliance resources page.
Why New York Businesses Choose New York Shredding
For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give your business the proof it needs for any compliance audit.
Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your office on a shredding schedule that keeps you protected year-round.
Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services.