Cybersecurity Awareness Month is an apt time for organizations to assess whether their cybersecurity programs are grounded in thorough, documented risk assessments, an area drawing increased attention from the New York State Department of Financial Services. The agency’s new guidance identifies common deficiencies and details five essential elements of an effective process, including governance and oversight, methodology, scope, documentation, and integration and updates. With insights from partners at Clifford Chance and Mayer Brown, this article examines the guidance and its implications and explains how organizations can use it to strengthen assessments, align controls with identified risks and prepare for regulatory scrutiny. See “How the NYDFS Drives Cybersecurity in the Financial Services Industry” (Jun. 23, 2021).