NYDFS is using all tools at its disposal to address gaps in MFA coverage at covered entities, including through guidance, examinations, and enforcement. Since the Cybersecurity Regulation went into effect in 2017, according to NYDFS, MFA weaknesses have been "the most common cybersecurity gap exploited" at financial services companies. From January 2020 to July 2021, NYDFS found that more than 18.3 million consumers were impacted by cyber incidents reported to the Department in which Covered Entities experienced MFA failures. While MFA–or reasonably equivalent or more secure compensating controls–have been consistently required by NYDFS since the inception of 23 NYCRR 500, in the last year the Department resolved two enforcement actions against companies that were required to implement MFA but had not done so. The Department has also announced that it is increasing its review of MFA during the examinations cycle.