The New York Department of Financial Services said OneMain failed to effectively manage user access privileges, improperly managed security policies for software development and failed to conduct due diligence for certain third-party vendors.