Detailing best practices related to managing third-party service provider risk, the New York State Department of Financial Services (NYDFS) issued guidance in the form of an industry letter at the end of October 2025 (Guidance). Entities subject to NYDFS’s groundbreaking cybersecurity regulation must employ a “proactive, risk-based, and continuously adaptive approach to third-party governance,” according to the Guidance. This article parses the Guidance, with insights from Norton Rose Fulbright partner David Kessler and Clifford Chance partner Celeste Koeleveld, who formerly served as Deputy Superintendent and Special Counsel at the NYDFS. See our two-part series “Amendment to NYDFS Cyber Regulation Brings New Mandates”: Governance Provisions (Dec. 13, 2023), and First Compliance Steps (Jan. 3, 2024).