NYDFS Just Fined a Company for Unqualified Staff, Not Just a Missing Policy
October 12, 2026
Ric Hall, CRO— AI-assisted and reviewed prior to publication.
Regulators used to check whether you had a cybersecurity policy on paper. Now they check whether the people running your program are actually qualified to do the job, and they will fine you specifically for the gap. A 2025 New York Department of Financial Services consent order confirms that unqualified staff is now its own violation, separate from any missing control.
What Does NYDFS Mean by "Qualified Cybersecurity Personnel"?
Section 500.10(a) of New York's cybersecurity regulation requires covered entities to use qualified cybersecurity personnel to manage their programs, not just to designate a titled executive. The regulation's core text is explicit that each covered entity shall designate a qualified individual responsible for overseeing and implementing the cybersecurity program, and that requirement extends to the staff who actually perform the work underneath that individual, not the org chart alone.
That distinction matters because it shifts the compliance question from "do you have a CISO" to "can you show the people doing the work know what they're doing." A named title on a policy document does not satisfy the rule if the analysts, engineers, and managers under that title lack demonstrated qualification for the functions they perform.
What Did the PayPal Enforcement Action Actually Change?
The January 2025 consent order against PayPal shows regulators will cite staff qualification as a distinct finding, not just a footnote to a technical failure. Following its investigation into a 2022 incident that exposed customer tax forms, NYDFS determined that PayPal violated its obligation to use qualified personnel to oversee core cybersecurity functions, alongside separate failures around access controls, resulting in a $2 million civil penalty.
Legal analysis of the order is specific about the charge. One summary of the settlement describes the finding directly: PayPal "did not utilize qualified cybersecurity personnel to oversee and perform core cybersecurity functions, nor did it provide adequate training to its personnel," in violation of Section 500.10(a). That is a personnel finding, cited independently of the multi-factor authentication gap that also contributed to the same incident.
This was not an isolated reading of the rule. Later in 2025, NYDFS imposed a $19 million aggregate penalty against eight auto insurers, and the resulting guidance told firms to confirm the integrity of CISO attestations by validating the maturity of controls behind them, not just accepting the signature. Regulators are treating the certification of compliance as a claim they expect to be able to test against the actual competence of the people who built the program.
The Named CISO Isn't Enough on Its Own
Designating a CISO satisfies one line item, but it does not close the personnel question the regulation actually asks. NYDFS allows a covered entity to use a CISO employed by an affiliate or a third-party service provider, provided the entity retains responsibility for compliance and designates a senior employee to oversee that arrangement. That flexibility is useful for smaller institutions, but it raises the qualification bar rather than lowering it, because examiners now expect the oversight relationship itself to be documented and defensible.
The 2023 amendments raised the personal stakes for whoever signs beneath that structure. The dual-signature certification requirement created direct personal regulatory liability for both the CEO and the CISO, who must now attest to compliance using verifiable data. Signing that certification without evidence that your staff meet the qualification bar is no longer a paperwork risk. It is a liability two named executives carry individually.
For a compliance officer building a defensible file, this means the personnel question has to be answered before the annual certification, not during an examination. Reviewing Forge University's certification resources is a reasonable starting point if you're mapping which credentials correspond to which regulatory expectations across your team, rather than guessing at what an examiner will accept.
How Do You Actually Document That Staff Are Qualified?
Industry certification is the most portable, third-party-verifiable evidence that a specific person meets a defined competency bar, which is exactly what an examiner is trying to test. Regulations rarely name a specific credential, but they consistently ask for evidence of qualification, and a credential from an accredited body is evidence a regulator did not have to take on faith.
For the CISO role specifically, the credentials examiners and industry advisors point to most often overlap heavily. One breakdown of CISO qualifications notes that certifications such as CISSP, CISM, and CRISC are widely recognized and valued in the industry as evidence of the governance, risk, and program management expertise the role requires. CISM in particular is built around the exact domains Section 500.10 cares about: security program development, risk management, and incident management at a leadership level, which is why it shows up repeatedly in CISO hiring criteria rather than purely technical role requirements.
The table below maps the regulatory language to the kind of documented qualification an examiner can actually verify.
| NYDFS Requirement | What Examiners Test For | Documented Qualification |
|---|---|---|
| Section 500.4(a): designated CISO | Named individual with defined authority and reporting line | Executive-level credential (CISM, CISSP) plus board reporting record |
| Section 500.10(a): qualified personnel | Staff performing core functions, not just titles | Role-specific certification tied to actual job function |
| Third-party CISO arrangement | Documented oversight by a senior internal employee | Named internal owner with credentialed background |
| Annual certification signature | Verifiable data behind the CEO/CISO attestation | Audit trail linking staff qualifications to controls tested |
Certification alone will not satisfy an examiner without practical evidence the person applies that knowledge, but it closes the gap between "we have someone in this role" and "we can show this person is qualified for it." If your team needs a structured way to close that gap, you can start training toward the credentials your program actually needs before the next certification cycle, rather than after an examiner asks for it.
What This Means for Hiring and Procurement Decisions
Executives signing the annual certification now have a direct incentive to require documented qualification before they attest to anything. The PayPal and auto insurer actions both show that NYDFS will look past the org chart to the actual competence of the people running the program, and it will fine the entity for the gap even when no breach beyond the original incident occurred. That changes procurement conversations with staffing vendors and vCISO providers, who should be expected to produce named individuals with verifiable credentials, not just a service description.
It also changes internal hiring and promotion decisions. A security manager without CISM, CISSP, or an equivalent credential is not automatically unqualified, but in an examination, credentialed staff give you something concrete to point to when a regulator asks how you know your team can do the job. Building that credential base across a security team, starting with the CISM certification for people in or moving toward program leadership roles, is now a defensible answer to a question regulators are actively asking in enforcement actions, not a hypothetical one.
The compliance calculus has shifted. A policy binder and a job title used to be enough to point to during an exam. Now the file needs to show the specific people behind those titles meet a standard someone outside your organization can verify, and that verification is exactly what a recognized certification exists to provide.