NYDFS Sets Out What a Part 500 Risk Assessment Has to Contain
DFS’s September 10, 2026 industry letter on 23 NYCRR 500.9 — what examiners expect a cybersecurity risk assessment to contain, and why it matters before the April 15 certification.
Read
Advisory for organizations that answer to someone.
Sosa & Arvelo is a management consulting firm that works where the stakes are public and the record matters — multi-billion-dollar regulatory proceedings, government agency finance and operations, cybersecurity and compliance programs, and the financial infrastructure that boards, funders, and examiners rely on.
Complex Regulatory
Support
Support
Proceedings with multi-billion-dollar implications, including utility rate cases
$2B
Public retirement portfolio administered by a partner before the firm
50+
Years of combined experience across government finance, regulation, and cybersecurity
4
Offices — Florida, Puerto Rico, New York, and Washington, DC. English and Spanish.
Where we work
Range, and the depth to go with it.
Our work spans regulated industry, government, and the nonprofit sector. What the engagements have in common is not an industry — it is that somebody else will eventually read the file: a regulator, an auditor, a board, a court, a funder.
Energy & Utilities
Regulatory proceedings with multi-billion-dollar implications, restructuring and oversight matters, and critical-infrastructure and OT security.
Explore
Government & Public Sector
Agency finance and operations, public retirement systems, municipal financial management, federal funds administration, and the transformation programs that have to finish under public scrutiny.
Explore
Financial Services & Commercial
Examination readiness, internal controls and financial reporting, enterprise risk, cybersecurity programs and annual certification, vendor risk, and incident response designed by someone who has handled the evidence.
How we help
Nonprofits & Faith-Based
Federal grant compliance, tax-exempt status before the IRS and Hacienda, fund accounting, annual filings, and controls that work with the team you actually have.
How we helpCore services
What we do
01
Cyber & Innovation
Security programs, privacy compliance, and modernization for organizations that cannot afford to fail an examination.
- Security strategy & architecture
- Cyber risk management
- Privacy compliance
02
Financial Advisory
Fund accounting, federal financial management, and cost recovery that keeps funders confident and files defensible.
- Fund accounting & reporting
- Federal financial management
- Cost allocation & recovery
03
Risk & Compliance
Enterprise risk, regulatory compliance, third-party risk, and internal controls built to be tested — not filed.
- Regulatory compliance
- Third-party risk management
- Internal control design & testing
04
Strategy & Operations
Planning, program and project management, and transformations that finish — with the constraints in the first draft.
- Strategic planning & execution
- Program & project management
- Energy sector transformation
Insights
What changed, and what it requires.
National Emergency Declared to Secure the U.S. Bulk-Power System
Executive Order 14421 declares a national emergency over foreign-produced grid equipment, prohibits covered transactions initiated after August 26, 2026, and puts the Department of Energy on a 120-day rulemaking clock.
Read
FinCEN Permanently Ends BOI Reporting for U.S. Companies
On August 11, 2026, FinCEN issued a final rule that permanently removes the requirement for U.S. companies and U.S. persons to report beneficial ownership information under the Corporate Transparency Act.
Read
The firm
A state cybercrime unit. A municipality’s finances. A $2 billion public pension.
Before Sosa & Arvelo, our partners ran them. Between them they have run the financial operation of one of Puerto Rico’s largest municipalities, served as deputy administrator of a government retirement system managing roughly $2 billion, directed a state cybercrime investigative unit, and distributed federal and state grant funding to nonprofit organizations.
Most of that experience was accumulated inside the institutions that write and enforce the rules organizations now live under — which is why the work concentrates where it does.
Say what it actually requires.
Regulations are written to be defensible, not clear. Translating them is most of the job.
Small teams, real controls.
Most organizations cannot staff a textbook control environment. Controls that ignore that are theater.
Tell you when it isn’t us.
We are a small firm with a defined range. When something falls outside it, we say so — and we usually know who is more likely to be right for it.
Next step
Tell us what you’re facing.
A 30-minute conversation, no charge, no obligation. We will tell you whether an assessment is the right next step, whether we are the right firm — and if we are not, who is more likely to be.