CyphrQ
Menu

SOC Regulatory Requirements: What NYDFS, SEC, PCI and HIPAA Demand

What NYDFS, the SEC, PCI DSS, HIPAA and CIRCIA require for monitoring, logging and incident response, and when that means a SOC or MDR.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

11 min read

No US regulation says "you must run a security operations centre". SOC regulatory requirements come instead from rules that demand the work a SOC does. NYDFS Part 500 requires New York's largest financial licensees to run endpoint detection and centralised logging with alerting. PCI DSS requires daily log review and incident responders on call 24/7. The SEC expects a material incident disclosed four business days after the company decides it is material. If you can't watch, decide and report on those clocks, you effectively need a SOC, in-house or bought.

What counts as a SOC, and is it the same as SOC 2?

A security operations centre (SOC) is the team, process and tooling that watches your systems for attacks, investigates alerts and leads the response. Managed detection and response (MDR) is the same job bought as a service: an outside provider monitors your environment and responds, usually around the clock.

Neither is a SOC 2 report, which is an audit of a service organisation's controls and shares only the acronym. For that one, see SOC 2 vs ISO 27001.

Which US regulations set SOC regulatory requirements for monitoring and logging?

Each rule below was read at its source on 25 October 2026. Four are in force. One, CIRCIA, is still a proposal.

NYDFS 23 NYCRR Part 500: the most explicit monitoring rule

Part 500 covers anyone operating under a licence, charter or similar authorisation under New York's Banking Law, Insurance Law or Financial Services Law. The Second Amendment took effect on 1 November 2023. Quotes come from the copy DFS publishes, which DFS labels "not an official version".

  • Detect and respond. The programme must be designed to "detect cybersecurity events" and respond to them (500.2(b)).
  • Watch your users. Controls must "monitor the activity of authorized users and detect unauthorized access or use of, or tampering with, nonpublic information" (500.14(a)(1)).
  • Keep audit trails. Audit trails "designed to detect and respond to cybersecurity events" are kept at least three years; financial transaction records at least five (500.6).
  • Class A tools. A Class A company must implement "an endpoint detection and response solution to monitor anomalous activity, including but not limited to lateral movement" and "a solution that centralizes logging and security event alerting", unless the CISO approves equivalent or stronger controls in writing (500.14(b)).
  • Plan and test. A written incident response plan, covering ransomware, recovery from backups and root cause analysis, tested at least annually (500.16).
  • Report fast. Notice to the superintendent "in no event later than 72 hours after determining" a cybersecurity incident occurred; for an extortion payment, notice within 24 hours and a written explanation within 30 days (500.17).
  • Tell the board. The CISO reports in writing at least annually and must "timely report" material issues (500.4).

A Class A company has at least $20 million in gross annual revenue in each of the last two fiscal years (its own business plus its affiliates' New York business), and either more than 2,000 employees or more than $1 billion in revenue across all affiliates (500.1(d)). The transition rules in 500.22 gave Class A firms 18 months from 1 November 2023 for the 500.14(b) tools, which works out to 1 May 2025.

The limited exemption in 500.19(a) (fewer than 20 employees and contractors, under $7.5 million revenue, or under $15 million assets) lifts 500.6, 500.14 and 500.16, among others. It does not lift the 72-hour notice.

SEC cybersecurity disclosure rules: a clock, not a control list

Per the SEC's announcement of 26 July 2023, Form 8-K Item 1.05 requires disclosure of "any cybersecurity incident they determine to be material", generally due four business days after that determination. Regulation S-K Item 106 requires the Form 10-K to describe "their processes, if any, for assessing, identifying, and managing material risks from cybersecurity threats", plus board oversight and management's role.

The rules don't mandate a SOC. They assume you can find, scope and brief an incident quickly. How the clock compares with other regimes is in our breach notification deadlines guide.

PCI DSS Requirement 10: logging with numbers attached

PCI DSS is a card industry standard, enforced through card brand and acquirer contracts; our PCI DSS 4 guide explains the rest. The Council's v4.0.1 files returned an access error, so the requirement text below comes from its v4.0 Self-Assessment Questionnaire D for Merchants, whose requirements "mirror the requirements in the PCI DSS Requirements and Testing Procedures":

  • Audit logs "enabled and active for all system components and cardholder data" (10.2.1).
  • Security events and critical system logs "reviewed at least once daily" (10.4.1), with automated mechanisms (10.4.1.1).
  • Logs kept "for at least 12 months, with at least the most recent three months immediately available for analysis" (10.5.1).
  • "Failures of critical security control systems are detected, alerted, and addressed promptly" (10.7.2).
  • "Specific personnel are designated to be available on a 24/7 basis to respond to suspected or confirmed security incidents" (12.10.3).

10.4.1.1 and 10.7.2 were best practice until 31 March 2025, then required.

HIPAA Security Rule: audit controls without a schedule

For systems holding electronic protected health information (ePHI), 45 CFR 164.312(b) reads in full: "Implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use electronic protected health information."

It sets no review frequency and no retention period. "Examine" still means someone has to look.

CIRCIA: proposed, not yet in force

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) will require covered critical infrastructure entities to report to CISA. On 25 October 2026, CISA's CIRCIA page said it "continues to work on the final rule", citing "multiple funding lapses". It held four town halls from 15 to 18 June 2026.

The proposed rule (4 April 2024, 89 FR 23644) would require an incident report "no later than 72 hours from the time the entity reasonably believes the incident occurred" and a ransom payment report "within 24 hours". Until a final rule takes effect, organisations "are not required to submit" either.

How do the US SOC requirements compare side by side?

Rule Who it applies to Monitoring and logging duty Reporting clock Log retention
NYDFS 23 NYCRR 500 NY-licensed banking, insurance and financial services entities Monitor authorised users; audit trails to detect and respond; Class A: EDR plus centralised logging and alerting 72 hours after determining an incident occurred; extortion payment 24 hours Audit trails 3 years; financial transaction records 5 years
SEC 8-K Item 1.05, S-K Item 106 SEC registrants (foreign private issuers via Forms 6-K, 20-F) None prescribed; describe risk processes and governance in the 10-K 4 business days after a materiality determination Not set in the SEC release
PCI DSS 4.x, Requirement 10 Entities that store, process or transmit card data, or can affect its security Logs on all in-scope systems; daily automated review; alert on failed security controls; 24/7 responders No hours set; plan must cover notifying payment brands and acquirers (12.10.1) 12 months, latest 3 immediately available
HIPAA 45 CFR 164.312(b) Organisations with systems holding ePHI Record and examine activity Not in 164.312; breach notice is a separate rule not reviewed here Not set in 164.312(b)
CIRCIA (proposed) Covered critical infrastructure entities, once the final rule defines them Not specified on CISA's page Proposed: 72 hours from reasonable belief; ransom payment 24 hours Not specified on CISA's page

The EU counterpart, NIS2, has its own 24-hour early warning; see our NIS2 guide.

When does a business effectively need a SOC or MDR?

Three triggers stand out:

  1. You are a NYDFS Class A company. EDR and centralised alerting are in the rule. Someone has to act on the alerts, and the 72-hour clock runs from determining an incident you first have to see.
  2. You are in PCI DSS scope. Daily automated review plus named 24/7 responders is a monitoring function with on-call cover.
  3. You are an SEC registrant. Four business days after a materiality call leaves little room for an investigation that starts from nothing.

If none apply, a SOC may still be sound risk management, but no rule above forces it.

Build vs buy: should you run an in-house SOC or use MDR?

The rules don't care who does the work, only that it gets done. NYDFS 500.10 allows "qualified cybersecurity personnel of the covered entity, an affiliate or a third-party service provider", and 500.4 lets a third party employ the CISO, but the covered entity must "retain responsibility for compliance". PCI DSS agrees: if a provider fails a requirement it runs for you, "those requirements are also 'not in place' for the entity" (12.8.4).

Question In-house SOC MDR service
24/7 cover You staff every shift; a week is 168 hours Usually included; check the contract
Knowledge of your business Built over time Depends on onboarding
Log ownership and retention You control it Agree who keeps raw logs, and for how long
Regulatory responsibility Yours Still yours; you oversee the provider
Typical fit Large estates with budget and hiring capacity Smaller teams, or larger ones buying out-of-hours cover

A hybrid also works: internal staff own detection rules and regulator decisions, and a provider covers nights and weekends.

Going deeper: for security and IT teams

Control mapping. Use the strictest rule as your baseline. For retention, NYDFS 500.6(b) sets three years for detection audit trails and PCI 10.5.1 sets 12 months with three months hot, so one three-year policy on in-scope systems meets both. For collection, NYDFS 500.14(b)(2) "centralizes logging and security event alerting" and PCI 10.3.3, logs "promptly backed up to a secure, central, internal log server(s) or other media that is difficult to modify", point to the same log platform. Class A firms must also "monitor privileged access activity" and run privileged access management (500.7(c)).

What to log. PCI 10.2.1.1 to 10.2.1.7 is a usable minimum anywhere: user access to sensitive data, all administrator actions including interactive use of system accounts, all access to audit logs, invalid logon attempts, account and privilege changes, logging started, stopped or paused, and system-level objects created or deleted. Each event needs user, event type, date and time, success or failure, origin and affected resource (10.2.2).

Protect the evidence. Limit read access (10.3.1), prevent modification (10.3.2) and run change detection on logs (10.3.4). Sync clocks to designated time servers using UTC or International Atomic Time (10.6.2). A 72-hour clock is hard to defend with timestamps that disagree.

Detect the detector failing. 10.7.2 lists systems whose failure must alert: network security controls, IDS/IPS, change detection, anti-malware, physical and logical access controls, audit logging, segmentation controls, log review and automated testing tools. Alert on a source going silent, then record the failure's start, end, cause and fix (10.7.3).

Clock engineering. NYDFS counts from "determining", the SEC from a materiality determination, proposed CIRCIA from "reasonably believes". Name who makes each decision, whether in-house or at the MDR, and log it with a timestamp. Field-level design is in the breach deadlines guide; incident process structure in our ISO/IEC 27035 explainer.

In practice: the SolarWinds disclosure cases. On 22 October 2024 the SEC charged four companies over misleading disclosures about intrusions linked to the SolarWinds Orion compromise. Unisys paid a $4 million civil penalty: the SEC said it called cyber risks hypothetical despite two intrusions that exfiltrated gigabytes of data. Avaya paid $1 million after saying the attacker accessed a "limited number" of email messages, when at least 145 files in its cloud file-sharing environment were also accessed. Check Point paid $995,000 and Mimecast $990,000. All four settled without admitting or denying the findings. A disclosure is only as accurate as the scoping behind it, and Avaya's gap was a forensic one.

Ask your MDR provider or your own team:

  • Which PCI DSS requirements do you manage, which do we, which are shared? (12.8.5 requires this in writing.)
  • Who keeps raw logs, in what format, for how long, and do we get them back at contract end?
  • How fast will you tell us about a likely incident, and does that leave time to determine it within 72 hours?
  • Can you supply evidence for the CISO's annual report and the 15 April NYDFS certification?
  • How will we know when one of our log sources stops sending?

What should you check this quarter about SOC coverage?

  • Which rules apply: NYDFS licence and Class A status, SEC registration, PCI scope, ePHI.
  • If Class A: EDR and centralised alerting live, or the CISO's written approval of alternatives on file.
  • Log retention set to the strictest rule you are under.
  • Named 24/7 incident responders, with backups, if in PCI scope.
  • Who decides an incident has occurred, and who decides materiality, rehearsed.
  • If you use MDR: responsibility matrix and notification times in the contract.

Learn more

More rules behind security and data are in our Compliance & Regulation section.

Key takeaways

  • No US rule says "run a SOC", but NYDFS, PCI DSS and the SEC require monitoring, response and reporting that a SOC or MDR provides.
  • NYDFS Class A companies need EDR plus centralised logging and alerting, or CISO-approved equivalents; incidents go to DFS within 72 hours of determination.
  • PCI DSS requires daily automated log review, 12 months of logs and incident responders available 24/7.
  • HIPAA sets audit controls with no schedule or retention period, and CIRCIA's reporting deadlines were still proposals on 25 October 2026.
  • MDR is allowed under NYDFS and PCI DSS, but compliance responsibility stays with you.

Sources