NYDFS Part 500 Penetration Testing, Retesting and Evidence
Test What an Intruder Could Reach Before DFS Asks
Amended section 500.5 requires a covered entity to have its information systems penetration tested from inside and outside their boundaries, by a qualified party, at least once a year. A Global Digital Forensics test shows whether an attacker can chain your exposures through identity, cloud and applications to nonpublic information, and it logs every step with its time, source and operator. Senior operators confirm each attack path by hand, rank findings by business consequence and retest your fixes before the filing.
The engagement
Inside and Outside the Boundary, Every Year
Call the New York office at (212) 561-5860 or the 24/7 hotline at (800) 868-8189 to set the testing window. Amended section 500.5 separates the annual penetration test from vulnerability management: automated scans, and manual review of the systems scans miss, run at a frequency the risk assessment sets and promptly after material system changes. We plan both against your risk assessment and the exemption position your compliance and legal teams have already settled, so the test strengthens the program instead of reopening it.
We scope the test against the covered entity's information systems as section 500.1 defines them. In practice that means internet facing services, internal networks, identity systems such as Active Directory, Entra ID and Okta, cloud control planes in AWS, Azure and GCP, core business applications and APIs, and any third party service provider integration whose compromise would affect nonpublic information. Founder Joseph Caruso holds the CISSP and brings a technology career that began in 1980 and spans real time transaction systems and cybersecurity incident response, and Robert Knudsen combines the CISSP, CompTIA Security+ and Network+ with eighteen years of forensic casework in federal and state court matters.
The report separates demonstrated findings, configuration evidence, observations and conditions deliberately left untested. Automated results are validated by hand and placed in context, and any step we chose not to reproduce for safety or authorization reasons is labeled as such, so no scanner line passes for a proven attack path. Where the results need to join the wider control record for the annual filing, our Part 500 evidence support page describes how that record is assembled.
If the examination date is already set, send the scope statement from the last test and the date and on the first call we will tell you whether a test and a retest both fit before the filing.
Scope
External network and internet facing services
Enumeration of exposed hosts, services, TLS configurations and the known vulnerability surface, reproduction of credible attack paths through misconfigured or vulnerable services and documented before and after evidence for anything exploited during the engagement.
Internal network and identity
Testing from an assumed foothold against Active Directory or Entra ID, the common paths for lateral movement including Kerberoasting, certificate services abuse, delegation abuse, DPAPI and SMB relay, and credential exposure. The test plan maps selected techniques to MITRE ATT&CK where they fit the environment and stops at documented markers so business operations are not disrupted.
Cloud control planes
AWS IAM roles, policies, trust relationships, cross account paths and S3 exposure, Azure and Entra ID conditional access, app registrations, managed identities and privileged roles, and GCP IAM. Findings are ranked by the access and business impact they would allow rather than by scanner severity.
Web applications and APIs
OWASP Top 10 and OWASP API Top 10 coverage, authentication and authorization boundaries, tenant isolation for multitenant SaaS, business logic issues and access control edge cases, tested at multiple privilege levels where the application supports them.
Third party service providers in scope
Where a service provider's environment carries covered nonpublic information, the engagement either extends to the provider under a testing authorization or documents reliance on the provider's independent test as an inherited control.
Vulnerability monitoring cadence
Vulnerability monitoring is agreed around the actual risk assessment, system changes and the applicable amended requirements. We record asset coverage, successful authentication, the scan or manual review method, exceptions and the person responsible for follow up, so the cadence is provable rather than merely scheduled.
Evidence commonly reviewed
Evidence We Produce During the Test
Every reproduced finding is supported by screenshots and command output, and an exploitation timeline records the timestamp of each material step. Test account artifacts are cleaned up and listed with the indicators of compromise so your defenders can review what the engagement left behind, cloud audit logs from CloudTrail, Azure Activity and GCP Cloud Audit record the testing activity from the platform's side, and retest evidence is captured for any finding remediated during the engagement.
What you receive
What Your CISO and Board Receive
You receive an executive summary written for the CISO and the board committee, a technical report with reproduction steps for every material finding, a testing scope statement aligned to section 500.5 that records the systems, dates and methodology, remediation guidance that names the control owner, the exploit precondition, the recommended fix and the retest plan, and a structured findings export for your GRC or ticketing system.
Want to see how the testing scope statement joins the rest of the control record before you commit? The Part 500 evidence support page shows where it sits.
Engagement workflow
From Rules of Engagement to Verified Retest
Scoping and rules of engagement
We scope the tested information systems and nonpublic information with the responsible entity and record targets, exclusions, starting access, permitted techniques, testing window, contacts and stop conditions. Your compliance team tells us which evidence the program file needs, and the deliverables are built to that list.
Reconnaissance and threat modeling
Active and passive reconnaissance appropriate to the scope feeds a written threat model that ties the systems holding nonpublic information, the systems supporting critical business functions and the systems supporting recovery to the attacker paths that could reach them. The threat model decides where testing effort goes, so time is spent where the consequence is rather than evenly across the scope.
Testing execution
Authorized techniques are run against the in scope systems with contemporaneous logging of source address, target, tooling, timestamps, request and response artifacts and any pause for coordination with the entity's defenders. Where a control fires, whether an EDR alert, a WAF block, an IDS detection or a SOC ticket, the fact and the time are recorded so the entity has objective evidence of what its detection stack actually did.
Reporting and 500.5 alignment
The report records tested systems, method, dates, material findings, evidence, exclusions and the agreed remediation or retest status, and a separate testing scope statement can summarize the work performed. Both are written to drop straight into the material your CISO assembles for the annual compliance filing under section 500.17(b).
Remediation validation and retest
Remediated findings are retested against the same reproduction steps used for the original finding, with before and after artifacts captured. Where the DFS examiner or the entity's audit committee asks for a separate retest attestation, it is prepared as its own document and cross references the original finding identifier so the record is easy to follow.
Rules of engagement come first in every case, and they take a conversation rather than a form. Call (800) 868-8189 to start that conversation with a senior examiner.
Frequently asked
Examiner Reports, Retests and Foreign Bank Branches
What does the report give a DFS examiner?
The tested systems, the methods, the dates, every material finding with its evidence and the remediation and retest status, plus a separate testing scope statement. That is the record an examiner asks for when reviewing the annual test under section 500.5.
Do you also run the 500.9 risk assessment?
GDF supplies the technical inputs that feed the section 500.9 risk assessment: the asset inventory, control effectiveness observations and test findings. The assessment itself belongs to the covered entity's CISO and compliance function, and our findings are formatted to slot straight into it.
Do you retest after remediation?
Yes. Retesting remediated findings is included in the engagement scope. The before and after reproduction evidence appears in the final report and can be broken out as a separate attestation letter where the DFS examiner requests one.
Can testing be scheduled around a DFS examination?
Yes. Testing windows are commonly aligned to the covered entity's examination schedule so the report is current when the examiner asks for it, and the retest can be timed to close findings before the filing.
How is testing scoped for a New York branch of a foreign bank?
For a New York branch of a foreign banking organization, scope begins with the covered entity's information systems and the shared parent or vendor dependencies that matter to them. The engagement letter records those boundaries and exclusions, so the scope matches the systems that actually support the New York branch.
Settle Applicability and Evidence Before the First Packet
Identify the regulated entity, any claimed exemption, the covered environment, the latest risk assessment, the changes since the last test and any existing findings. The accountable entity and its counsel confirm which Part 500 provisions apply, and we build the test to that position.
Before the first packet is sent we agree on the qualified tester, the external, internal and application scope, the starting credentials and the prohibited actions, and throughout the engagement we retain evidence of the targets actually tested, the systems that were unreachable or excluded, the method and the dates. Each remediation row records the finding, the control owner, the due date and the retest result, and an untested correction stays open on the register until it is verified.
Retests and follow up are scheduled as their own line items, and the report names exactly which systems each clean result covers.
NYDFS cybersecurity resource center for 23 NYCRR Part 500
Bring the applicability position your organization has reached, and we will build the test plan to that position rather than to a generic Part 500 template.
Talk with an examiner
Scope the Annual Test Before the Exam Calendar Does
Tell us the covered entity, the systems in scope and the examination or filing date. A senior operator will discuss scope, evidence and timing, and the initial consultation is free and confidential.
Since 1992 · 24/7 dispatch · Court tested experts
Speak with GDF
Put Your Covered Systems in Front of a Senior Operator
On the first call a senior operator walks through the covered systems, last year's findings and the filing date, recommends the testing depth and lays out the timeline for the test and the retest. Keep credentials and system details off email.
24/7 hotline: (800) 868-8189
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .