NYDFS Penetration Testing: Part 500.5 Requirements Explained

Quick answer: NYDFS penetration testing is the security testing required by the New York Department of Financial Services Cybersecurity Regulation, 23 NYCRR Part 500. Under Section 500.5, as amended in November 2023, covered entities must have penetration testing performed at least annually by a qualified internal or external party, from both inside and outside the boundaries of their information systems. They must also run automated vulnerability scans and manual reviews at a risk-based frequency and promptly after material system changes, and they must remediate findings in a timely, risk-prioritized way.

Part 500 is one of the most influential cybersecurity regulations in the United States. It applies to banks, insurers, mortgage companies, money transmitters, virtual currency businesses and many other organizations licensed or chartered in New York. The 2023 amendments added stronger governance duties, new requirements for larger Class A companies, universal multi-factor authentication and clearer testing rules, with deadlines phased in through November 2025.

This guide explains what Part 500 requires for testing, who must comply, how to scope and run NYDFS penetration testing, how testing supports the annual compliance filing, and how to choose a testing partner. To discuss testing for your organization, explore Privaxi's financial services cybersecurity services.

What Is NYDFS Part 500?

The NYDFS Cybersecurity Regulation first took effect in 2017 and was significantly amended on 1 November 2023. It requires covered entities to maintain a cybersecurity program based on a risk assessment, adopt approved written policies, appoint a Chief Information Security Officer (CISO), control access, protect data, manage third-party service providers, monitor systems, respond to incidents and report to the regulator. Testing is the part of the regulation that proves those controls actually work.

What Is NYDFS Penetration Testing?

NYDFS penetration testing means the annual, independent penetration test that Section 500.5 requires, together with the vulnerability management activities around it. A penetration test goes beyond automated scanning: qualified testers try to exploit weaknesses safely, chain issues together and show what a real attacker could reach. The regulation specifically expects testing from inside and outside the information system boundaries, which in practice means both external and internal testing.

For a general introduction, see our guide to penetration testing services.

Who Must Comply?

Part 500 applies to any covered entity, meaning any person operating, or required to operate, under a license, registration, charter, certificate, permit or similar authorization under New York Banking Law, Insurance Law or Financial Services Law. Common examples include:

• State-chartered banks, trust companies and foreign bank branches licensed in New York.

• Insurance companies, agents and brokers licensed in New York.

• Mortgage bankers, brokers and servicers.

• Money transmitters and check cashers.

• Virtual currency businesses licensed under the BitLicense regime.

• Licensed lenders, budget planners and premium finance agencies.

Some smaller entities qualify for limited exemptions under Section 500.19 based on headcount, New York revenue or total assets, and exempt entities still have certain obligations. Because exemptions are narrow and specific, confirm your status with legal counsel before deciding testing is optional.

What Section 500.5 Requires

Annual NYDFS penetration testing is the anchor of this section, but the scanning, monitoring and remediation duties are just as important. Regulators look for a continuous vulnerability management program, with the yearly penetration test confirming it works.

Other Part 500 Requirements That Testing Supports

• Risk assessment (500.9): testing results feed the annual risk assessment and help set scan frequency.

• Access privileges (500.7): testing checks whether privileged access is limited and monitored.

• Multi-factor authentication (500.12): since November 2025, MFA is required for any individual accessing any information system, and testing confirms there are no gaps.

• Asset inventory (500.13): an accurate inventory defines what must be tested.

• Monitoring and training (500.14): testing shows whether monitoring detects realistic activity.

• Incident response and business continuity (500.16): testing helps validate response and recovery plans.

• Notices to the superintendent (500.17): qualifying cybersecurity incidents must be reported within 72 hours.

Class A Companies

The amended regulation created a category of larger covered entities called Class A companies. These are covered entities with at least 20 million dollars in gross annual revenue from New York business operations, together with their affiliates, in each of the last two fiscal years, and either more than 2,000 employees on average or more than one billion dollars in gross annual revenue worldwide. Class A companies face additional duties, including independent audits of their cybersecurity programs, stronger privileged access controls, endpoint detection and response, and centralized logging and alerting.

For Class A companies, NYDFS penetration testing usually carries more weight and wider scope. Independent auditors and examiners often review testing results closely, so evidence of scope, methodology and remediation matters.

What to Include in Scope

• External perimeter: websites, portals, VPNs and other internet-facing systems. See external penetration testing.

• Internal network: workstations, servers, Active Directory and segmentation. See internal penetration testing.

• Customer and agent applications: online banking, policyholder portals, quoting tools and payment flows. See web application penetration testing.

• APIs and mobile apps: interfaces used by customers, brokers and partners. See API penetration testing and mobile application penetration testing.

• Cloud environments: cloud accounts and services holding nonpublic information. See cloud penetration testing.

• Remote access and MFA: every path into information systems, to confirm MFA coverage.

• Third-party connections: service providers with access to systems or nonpublic information. See third-party penetration testing.

Start from your asset inventory and risk assessment so scope reflects where nonpublic information lives and how it moves. Our guide to penetration testing scope explains how to prioritize.

How to Run NYDFS Penetration Testing

1. Confirm obligations: check covered entity status, Class A status and any exemptions.

2. Review the risk assessment and asset inventory: identify systems and data in scope.

3. Select a qualified tester: confirm independence, experience and certifications.

4. Agree rules of engagement: define scope, timing, safeguards and contacts.

5. Test from inside and outside: run external, internal and application testing.

6. Remediate and retest: fix findings by risk and verify the fixes.

7. Report and retain evidence: share results with the CISO and senior governing body and keep records for the annual filing.

For testing phases in more detail, see our overview of penetration testing methodology.

Testing and the Annual Compliance Filing

By 15 April each year, covered entities must submit either a certification of material compliance or an acknowledgment of noncompliance for the prior calendar year. The filing must be signed by the highest-ranking executive and the CISO, and it must be based on data and documentation sufficient to support it. Records supporting the filing must be kept for five years.

Your NYDFS penetration testing report is one of the most important pieces of that documentation. It shows that testing happened, what was found and how findings were fixed. Plan testing early enough in the year that remediation and retesting are complete before the filing deadline. Our guide to the penetration testing report explains what a strong report includes.

Governance and the Board

The amended regulation strengthened governance. The CISO must report in writing at least annually to the senior governing body on the cybersecurity program and material risks, and the board must have sufficient understanding of cybersecurity to oversee it. Testing results give boards concrete evidence of where the program is strong and where investment is needed. Clear executive summaries from NYDFS penetration testing help directors ask better questions and approve the right remediation priorities.

Common Findings in NYDFS Environments

• Systems or accounts that still allow access without multi-factor authentication.

• Excessive privileged access and weak controls over administrator accounts.

• Unpatched internet-facing systems and outdated software.

• Authorization flaws in customer, policyholder and broker portals.

• Weak segmentation between corporate and sensitive systems.

• Third-party connections with broader access than needed.

• Gaps in logging and alerting for realistic attacker activity.

For a structured approach to closing gaps, read our guide to penetration testing remediation.

NYDFS and Other Frameworks

Many covered entities also answer to GLBA, PCI DSS, SOC 2, state insurance data security laws and, for firms with European operations, the EU's DORA. A well-designed testing program can support several frameworks at once if scope and reporting are planned carefully. For related guidance, see our articles on penetration testing compliance requirements, GLBA penetration testing, bank penetration testing and DORA penetration testing.

Choosing a NYDFS Testing Partner

• Experience testing banks, insurers and other New York regulated businesses.

• Understanding of Part 500, including the 2023 amendments and Class A duties.

• Qualified, certified testers who perform manual testing, not just scans.

• Coverage of external, internal, application, API and cloud testing.

• Reports that support the annual filing, examiners and independent audits.

• Remediation guidance and retesting included.

Our guide to choosing a penetration testing company lists more questions to ask.

Cost of NYDFS Penetration Testing

The cost of NYDFS penetration testing depends on the size of the environment, the number of applications and APIs, cloud complexity, the number of locations, Class A status and the reporting needed. A small licensed agency with a simple network may need a modest external and internal test, while a Class A insurer or bank with many applications needs a much larger engagement. For pricing factors, see penetration testing cost.

Common Mistakes to Avoid

• Treating a vulnerability scan as the annual penetration test.

• Testing only from outside and skipping internal testing.

• Leaving cloud services, APIs or third-party access out of scope.

• Testing too late in the year to finish remediation before 15 April.

• Failing to document retesting and closure of findings.

• Assuming an exemption applies without confirming it.

Building a Year-Round Program

Part 500 expects vulnerability management to be continuous. Combine annual NYDFS penetration testing with risk-based scanning, prompt testing after material changes, regular review of MFA coverage, third-party oversight and incident response exercises. Track metrics such as time to remediate and repeat findings, and report trends to the senior governing body. For continuous coverage, see our guides to annual penetration testing and continuous penetration testing.

Preparing for an Examination

NYDFS examiners and independent auditors usually ask to see the latest penetration test report, evidence that findings were remediated, scan results, the risk assessment, the asset inventory and the CISO's report to the board. Keeping this evidence organized throughout the year makes examinations faster and reduces the chance of findings. A testing partner who understands what examiners look for can help you present results clearly, with scope, methodology, risk ratings and remediation status easy to follow.

Frequently Asked Questions About NYDFS Penetration Testing

What is NYDFS penetration testing?

NYDFS penetration testing is the annual penetration testing required by Section 500.5 of the NYDFS Cybersecurity Regulation, performed by a qualified internal or external party from inside and outside information system boundaries.

How often is penetration testing required under NYDFS?

At least once a year. Vulnerability scans are also required at a risk-based frequency and promptly after material system changes.

Who must comply with NYDFS Part 500?

Organizations licensed, registered or chartered under New York Banking Law, Insurance Law or Financial Services Law, such as banks, insurers, mortgage companies, money transmitters and virtual currency businesses.

Does a vulnerability scan count as a penetration test?

No. Scans are a separate requirement. A penetration test involves qualified testers attempting to exploit weaknesses and showing real impact.

When is the NYDFS compliance filing due?

Covered entities must submit a certification of compliance or an acknowledgment of noncompliance by 15 April each year for the prior calendar year.

Can internal staff perform the test?

Yes, the regulation allows a qualified internal or external party, but many organizations use external testers for independence and examiner confidence.

Final Thoughts

NYDFS penetration testing is a core requirement of Part 500 and one of the clearest ways to prove a cybersecurity program works. Confirm your obligations, scope testing from your asset inventory and risk assessment, test from inside and outside at least annually, fix and retest findings, and keep strong evidence for the April filing and for examiners.

To plan NYDFS penetration testing for your organization, explore Privaxi's financial services cybersecurity services.