NYDFS Cybersecurity Regulation: penetration testing and the evidence it leaves
Part 500 is the one regulation on this list that names penetration testing. Section 500.5 requires it at least annually, from inside and outside your systems' boundaries, by a qualified party, and then requires what most testing programmes stop short of: a monitoring process for new vulnerabilities and timely remediation prioritised by risk. The annual test is the easy half. Showing that remediation happened, and held, is the half examiners ask about. Read with Section 500.3, which asks for the written policy the programme runs under, the whole of it can be met as one system: the policy, the automated and manual testing, the monitoring, the remediation and the evidence.
When it applies.
- 01Original regulation in effectmilestone
- 02Amended regulation in effectin-force
- 03Annual certification dueThe date that matters
JurisdictionNew York State. Entities licensed, registered or chartered under New York Banking, Insurance or Financial Services Law, wherever they operate.
In scope, and out.
- Covered entities, meaning anyone operating under a licence, registration, charter, certificate, permit, accreditation or similar authorisation under the Banking Law, the Insurance Law or the Financial Services Law.
- Section 500.5 applies to every covered entity, with the limited exemptions in Section 500.19. The largest firms, Class A companies, carry further duties elsewhere in Part 500.
- Third-party service providers are reached through Section 500.11, which requires covered entities to assess them.
What it asks of you
Section 500.5 reads like a testing programme. Each covered entity must have written vulnerability-management policies consistent with its risk assessment, and under them: penetration testing at least annually, from both inside and outside the information systems’ boundaries, by a qualified internal or external party; automated scans, and a manual review of what the scans cannot cover, at a frequency the risk assessment sets and promptly after material system changes; a monitoring process so that the entity learns of new vulnerabilities promptly; and timely remediation, with priority given according to risk. Section 500.17 adds the clock, 72 hours to notify the Superintendent of certain incidents, and the annual certification due each 15 April.
Most programmes satisfy the first requirement and stop. The ones examiners question are the last two: how do you learn of new vulnerabilities between annual tests, and can you show that the remediation you certified actually happened and held.
One programme, end to end
Part 500 is written as a list, but Section 500.3 and Section 500.5 describe one thing: a policy, the programme that runs under it, and the evidence that the programme ran. Firms that treat them separately end up with a policy written by one party, scans bought from another, an annual test from a third, and a remediation record kept in a spreadsheet by whoever is left. Examiners notice the seams.
We can take the whole of it. The policy and procedures, written with you around a continuous exposure-management programme, so that what the policy promises is what actually runs. Under (a)(2), both halves of the requirement from one programme: Incenter’s automated testing of the information systems, continuously and after material change, and a senior’s manual review of what the automation cannot reach. Under (b), the monitoring process is the same continuous testing. Under (a)(1), the annual test, inside and out, from a CREST-accredited team. Under (c), the risk-ranked remediation and the re-test. One record, with the dates, that the certification can rest on.
What the evidence looks like
We map the report to Section 500.5 subsection by subsection, because that is how an examiner reads it. Under (a)(1), the annual test with its scope, dates, named testers and proven findings. Under (a)(2) and (b), the continuous testing record and the manual review of what the automation could not reach. Under (c), the risk ranking, the remediation of each finding with its date, and the re-test that showed it held, together with the items deliberately deferred and the reasons. The whole of it sits behind the annual certification so that the signature on 15 April rests on something.
The obligations testing can answer.
- Section 500.3, including (n) vulnerability management
Written cybersecurity policies and procedures, based on the risk assessment and approved at least annually by a senior officer or the senior governing body, covering the areas the section lists, vulnerability management among them.
We help write the vulnerability-management policy around a continuous exposure-management programme, so the policy describes what actually runs, and the testing produces the policy's own evidence.
Program review - Section 500.5, opening paragraph
Written policies and procedures for vulnerability management, consistent with the risk assessment and designed to maintain the effectiveness of the cybersecurity programme.
The same policy, one level down: the procedures name the annual test, the continuous testing, the manual review and the remediation cadence, and each engagement's report is their evidence.
Program review - Section 500.5(a)(1)
Penetration testing of the information systems from both inside and outside their boundaries, at least annually, by a qualified internal or external party.
The annual test, external and internal, by a CREST-accredited team that names its testers, with every finding proven by exploitation.
Penetration testing - Section 500.5(a)(2)
Automated scans of the information systems, and a manual review of systems not covered by the scans, at a frequency determined by the risk assessment and promptly after any material system change.
Both halves in one programme. Incenter runs the automated testing of the information systems continuously, a senior carries out the manual review of what the automation cannot reach, and a material change to the surface triggers a re-run. The record shows which was which.
Incenter - Section 500.5(b)
A monitoring process that keeps the entity promptly informed of new security vulnerabilities.
Continuous testing is that process for the surface it covers, and its findings arrive with proof rather than as a feed of identifiers.
Incenter - Section 500.5(c)
Timely remediation of vulnerabilities, giving priority to them based on the risk they pose to the entity.
The ranking by what would breach you, the closure sprint for the critical findings, and the re-test that shows "remediated" is true.
Closure sprint - Section 500.17
Notice to the Superintendent of certain cybersecurity incidents within 72 hours, and an annual certification of material compliance, or an acknowledgement of non-compliance, by 15 April.
For Section 500.5, the report and the re-test record are what the certification rests on.
Every engagement
The record you can hand over.
- The report mapped to Section 500.5 subsection by subsection, so an examiner finds each requirement's evidence where they expect it.
- Re-test evidence for each remediation, with dates.
- The risk-ranked remediation list, including the items deliberately deferred and the reasons.
- A one-page summary written for an examination.
NYDFS Part 500, answered plainly.
Can one programme cover Section 500.3, Section 500.5 and the certification?
Yes, if the policy is written around the programme rather than beside it. We help draft the vulnerability-management policy and procedures, Incenter runs the automated scans and the monitoring, our seniors run the manual review and the annual test, the closure sprint handles risk-ranked remediation, and the evidence is mapped subsection by subsection for the 15 April certification. One system, with one record.
Does Incenter satisfy the annual penetration test in 500.5(a)(1)?
Incenter's continuous testing answers 500.5(a)(2) and (b) for the surface it covers. The annual test in (a)(1) is a scoped test from inside and outside the boundaries by a qualified party, which we deliver as its own engagement.
What does "qualified" mean?
The regulation does not define it. Examiners look at independence, method and credentials. OSec is CREST-accredited and every report names the people who did the testing.
How is "timely" remediation judged?
Against your risk ranking and your own policy. The record has to show the ranking, the dates and the re-test, so the judgement is visible.
We are a small covered entity. Does 500.5 apply to us?
Limited exemptions exist under Section 500.19, and most covered entities must meet 500.5 in full. Your counsel confirms your category.
Does the test report go to DFS?
No. It supports your annual certification and is available to examiners on request.