The NYDFS Cyber security Regulation (23 NYCRR Part 500) applies to all covered entities meaning “any person operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, the Insurance Law or the financial Services Law.”