LEADERSHIP PROGRAMME
NYDFS Cybersecurity Training for Executives and Senior Management
Risk-based cybersecurity awareness for financial-services leaders: social engineering, CISO reporting, nonpublic information and incident decisions.
New York Cybersecurity Regulation, 23 NYCRR Part 500, §500.14(a)(3)
BlueTeam Academy
After this course, learners will…
What learners can do
- Challenge CISO reports using business risk, remediation evidence and clear ownership.
- Verify high-impact requests and assess access or supplier exceptions affecting nonpublic information.
- Coordinate response and recovery decisions and recognise when specialist notification review is needed.
Benefits for your company
- Senior management can turn risk reporting into prioritised decisions and documented follow-up.
- Executive teams can support incident coordination without treating course completion as regulatory certification.
INSIDE THE COURSE
6 modules. Decisions you can practise.
6 lessons2 h · estimated study
Each module includes a practical role-specific scenario, a decision check and a written reflection. Complete the modules before taking the final scenario assessment.
Explore the outline. Open a section to see the lessons and topics inside.
6 lessons shown
01Part 500 scope and leadership responsibilities
6 slides
Connect personnel training and governing-body oversight to the entity’s applicable requirements.
Link to this lesson02Social engineering and executive impersonation
6 slides
Apply independent verification to payment, access and sensitive-data requests.
Link to this lesson03Risk assessment, investment and CISO challenge
6 slides
Evaluate CISO reporting and prioritise remediation using risk and supporting evidence.
Link to this lesson04Nonpublic information, access and providers
6 slides
Challenge access exceptions and supplier safeguards for information and systems.
Link to this lesson05Incident decisions and operational resilience
6 slides
Coordinate response, recovery and regulatory-notification assessment without waiting for certainty.
Link to this lesson06Annual learning and defensible evidence
6 slides
Build a risk-informed training cycle and distinguish course completion from regulatory certification.
Link to this lessonNo lessons match your search. Try another topic or clear the search.
12 scenario questions · 80% pass mark
Allow approximately 30 minutes for the final assessment and review.
WHO THIS IS FOR
Practical decisions in your regulatory context.
Executives and senior managers of NYDFS-covered entities, subject to their applicable Part 500 requirements and exemptions.
New York Cybersecurity Regulation, 23 NYCRR Part 500, §500.14(a)(3)
Section 500.14(a)(3) requires at least annual cybersecurity awareness training for all personnel, including social engineering, updated for the entity’s risk assessment. This leadership programme supports that wider obligation; it does not replace workforce training. Section 500.4(d) separately addresses senior governing-body oversight. Check applicable exemptions.
LEARNING THAT LEAVES A RECORD
Practise, assess and document completion.
Apply the decisions
Work through role-relevant situations, explain your reasoning and connect the learning to your company’s procedures. Progress is saved as you complete each module.
Keep named evidence
After the module checks, written exercises and a passing assessment, receive a named certificate showing the course version and result. Administrators can export company completion reports and individual certificates.
This course is available in English only. Written responses are retained, not independently graded. Duration and the pass mark are Academy choices, not statutory thresholds. Completion is not accreditation or proof of organisational regulatory compliance.
Primary sources
Programme version: nydfs-executive-v2 · Content reviewed 14 October 2026
AI
Practical AI use, with human judgement.
This course includes role-specific ways to use approved AI assistance, relevant AI threats and failure cases, and checks for evidence, data handling and human approval. Optional prompts use fictional information; an AI account is not required.
AI examples are practical learning activities. They do not add statutory training requirements or replace your organisation’s policies, qualified advice or accountable decisions.