Question 1

What is 'Class A' under Part 500?

Accepted Answer

Class A Companies (the largest Covered Entities — over 2,000 employees or over $1B revenue) face stricter requirements: independent audit, password controls, privileged account management, endpoint detection.

Question 2

When is the annual certification due?

Accepted Answer

April 15 of each year, covering the prior calendar year. Late submission triggers DFS scrutiny.

Question 3

Do startups in BitLicense scope qualify?

Accepted Answer

Yes — virtual currency businesses holding a BitLicense or limited purpose trust charter are Covered Entities.

Question 4

What's the penalty exposure?

Accepted Answer

DFS has imposed multi-million-dollar consent orders for Part 500 violations. The 2023 amendments make penalties more likely for specific failure-to-implement events.

Question 5

Do you work outside a framework engagement?

Accepted Answer

Yes. Penetration testing, network and cloud security, and infrastructure hardening are all standalone services. You don't need a compliance deadline to get more secure; many clients start with the security work and add the framework later.