Introduction
New York's Department of Financial Services cybersecurity regulation—23 NYCRR Part 500—is one of the most prescriptive in the United States. Unlike principles-based frameworks, it explicitly mandates penetration testing as part of cybersecurity program requirements.
For financial services organizations regulated by NY DFS—banks, insurance companies, mortgage brokers, and other licensed entities—compliance isn't optional. DFS pursues violations through consent orders and penalties with real financial and reputational consequences.
Understanding 23 NYCRR 500
Who Must Comply
- State-chartered banks and trust companies
- Licensed money transmitters
- Insurance companies
- Mortgage companies
- Licensed lenders
- Any entities requiring DFS authorization
Foreign banking organizations with NY branches and licensed branches of non-US insurance companies are also covered.
Limited Exemptions
Some entities may qualify for limited exemptions based on size and other criteria. Check the regulation and current DFS guidance for the latest thresholds and how exemptions apply.
Even exempt entities must comply with certain core requirements.
2023 Amendments
November 2023 amendments strengthened requirements including:
- More explicit testing requirements
- Enhanced documentation requirements
- Stricter enforcement provisions
- Additional requirements for "Class A" covered entities
Section 500.5: Penetration Testing Requirements
Annual Penetration Testing
Section 500.5(a)(2) requires:
"Annual penetration testing of the covered entity's information systems determined each given year based on relevant identified risks in accordance with the risk assessment."
This requirement is explicit: penetration testing must occur at least annually.
Risk-Based Scope
Testing must cover systems identified as high-risk including:
- Systems processing nonpublic information (NPI)
- Customer-facing applications
- Core banking or insurance systems
- Payment processing systems
- Third-party integrations handling sensitive data
2023 Amendment Updates
- Testing by qualified internal or external personnel
- Scope aligned with risk assessment
- Results documented and reported to CISO
- Remediation tracked and verified
Class A Company Requirements
Larger organizations designated as "Class A" covered entities face additional requirements and scrutiny, including enhanced governance and monitoring expectations. Check the regulation for the current definition and thresholds.
What DFS Examiners Evaluate
Testing Frequency Documentation
- Annual testing documented
- Testing dates recorded
- Timing aligned with risk assessment cycle
- Additional testing after significant changes
Scope Alignment with Risk Assessment
- Testing covers systems in risk assessment
- High-risk systems prioritized
- Scope justification documented
- Scope evolves as risk profile changes
Methodology and Qualifications
- Documented testing methodology
- Qualified testers (internal or external)
- Independence from systems tested
- Industry-recognized approaches (OWASP, NIST, PTES)
Findings and Remediation
- Complete findings documentation
- Risk ratings for each finding
- Remediation plans with timelines
- Evidence of completion and retesting
- CISO involvement in review
Board and Senior Management Reporting
- CISO reports on testing results
- Material findings escalated appropriately
- Board receives at least annual cybersecurity reports
Building a Compliant Testing Program
Step 1: Align with Risk Assessment
Your risk assessment (Section 500.9) drives testing scope:
- Identify systems processing NPI
- Assess risk to each system
- Prioritize high-risk systems
- Document connection between assessment and scope
Step 2: Establish Annual Testing Cadence
- Schedule testing to complete within each calendar year
- Allow time for remediation before year-end
- Document testing dates and coverage
- Consider more frequent testing for high-risk systems
Step 3: Define Testing Scope
Cover:
- Internet-facing applications and APIs
- Internal systems processing NPI
- Network infrastructure
- Authentication and access control mechanisms
- Third-party integrations
Step 4: Document Methodology
Maintain documentation of testing standards, scope definition process, rules of engagement, tester qualifications, and reporting format.
Step 5: Implement Remediation Workflow
- Findings received and logged
- Risk assessment performed
- Remediation assigned with deadline
- Progress tracked through completion
- Retesting performed to verify fix
- Finding closed with evidence
- CISO briefed on results
Step 6: Report to Leadership
- CISO receives and reviews all findings
- Material issues escalated to senior management
- Board receives annual report including testing status
Common Examination Findings
Testing Not Conducted Annually: No test within current calendar year.
Scope Not Aligned with Risk Assessment: Testing missed high-risk systems identified in assessment.
No Remediation Evidence: Findings identified but no documentation of fixes.
CISO Not Involved: Results not reported to CISO.
Inadequate Tester Qualifications: Testing by staff without security expertise.
NY DFS Penetration Testing Checklist
Annual Testing
- Testing completed within current year
- Testing dates documented
- Additional testing after significant changes
Scope and Methodology
- Scope aligned with risk assessment
- High-risk systems included
- NPI systems covered
- Methodology documented
- Tester qualifications documented
Findings and Remediation
- All findings documented with severity
- Remediation plans established
- Remediation progress tracked
- Retesting performed
- Evidence of closure maintained
Reporting
- CISO reviewed findings
- Material issues escalated
- Board reporting includes testing status
- Documentation ready for examination
Enforcement Considerations
NY DFS has demonstrated willingness to enforce 23 NYCRR 500:
- Consent orders issued for compliance failures
- Penalties reaching millions of dollars
- Public enforcement actions creating reputational impact
- Detailed ongoing examinations
Organizations should treat penetration testing requirements as mandatory, not aspirational.
Conclusion
23 NYCRR 500 leaves no ambiguity: covered entities must conduct annual testing, align scope with risk assessment, document findings, remediate vulnerabilities, and report to the CISO. Examinations verify compliance with real consequences.
Building a compliant program requires treating penetration testing as ongoing operational requirement rather than annual checkbox. On-demand testing helps organizations maintain compliance and generate examination-ready evidence throughout the year.
RedVeil helps financial services organizations meet 23 NYCRR 500 requirements with on-demand testing for banking applications, insurance systems, and financial infrastructure. Generate examination-ready evidence with validated findings and CISO reporting.