Part 500 Control Testing, Evidence Mapping, and Remediation Retesting
Sign the Part 500 Certification Knowing the Evidence Holds
Every April 15, a covered entity's CISO and highest ranking executive sign for controls across identity, testing, logging, vendors and incident response, while the proof sits in tools and tickets that rarely meet. Global Digital Forensics tests whether those controls actually operated during the review period and maps each one to the record that shows it. Every exception gets an owner, a fix and a retest before the signature goes on.
Scope the review
Control Evidence Mapped Section by Section
The amended regulation changed what a DFS examiner looks for. Since November 1, 2025, section 500.12 has required multifactor authentication for any individual accessing any of the entity's information systems, with limited exceptions for smaller entities and for reasonably equivalent controls a CISO approves in writing. The question is no longer whether multifactor authentication exists. It is whether every path in actually enforces it, including the service desk reset, the vendor portal and the legacy application nobody wanted to touch. We build the review around questions like that, one section at a time.
Asset Inventory Under 500.13
Systems, cloud tenants, applications and vendor services reconciled into one inventory, with excluded populations documented so a reviewer can see exactly what was covered.
Multifactor Coverage Under 500.12
Every identity and access path tested for enforcement, with each exception tied to a written CISO approval or entered in the corrective register.
Testing Evidence Under 500.5
Annual penetration tests from inside and outside the perimeter, vulnerability scanning and manual review of what scans miss, each shown with the coverage it actually achieved.
The sections in scope, the review period and the filing deadline are agreed in writing before collection begins.
The engagement
Check the Policy Against What the Systems Recorded
A written policy proves intent. An examiner wants operation: the access review that actually ran in March, the log that was actually retained, the vendor reassessment that actually happened. For the systems your entity places in scope, we test controls across asset inventory under 500.13(a), risk assessment under 500.9, testing and vulnerability management under 500.5, access and multifactor authentication under 500.12, audit trails under 500.6 and incident response under 500.16.
The results feed the 500.4 report to the board and the 500.17(b) annual submission due April 15 for the prior calendar year, which is either a certification of material compliance or an acknowledgment of noncompliance with a remediation timeline. Either way, the people who sign have seen the evidence first.
The risk assessment deserves particular care. DFS's September 10, 2026 guidance on conducting and using risk assessments lists the weaknesses the Department keeps finding, from incomplete asset inventories to overlooked third party dependencies, and the evidence map we build shows the traceability it asks for.
Scope
Asset and scope reconciliation
Identity, endpoints, cloud tenants, applications and vendor services reconciled against nonpublic information, so the population under review is defined before any sample is drawn.
Privileged access and identity control
Account inventories, privilege assignments, multifactor enforcement and periodic access reviews, including emergency and service accounts, tested for the identities selected.
Logging, monitoring and retention
Log sources, retention, tamper protection and monitoring workflows behind the 500.6 audit trail, with the basis for each retention decision recorded.
Incident response and recovery evidence
The 500.16 plan compared with exercises and real events, plus the recovery records and decisions that show the plan works outside the binder.
Vendor and service provider risk
Due diligence, contract terms, monitoring and reassessment records under 500.11, including how vendor identities reach your systems.
Tell us on the first call which area has the weakest evidence today, and we will scope that section first.
Methodology
Building a Record a DFS Examiner Can Follow
-
Population: Systems and Review Period
We fix the assets, systems and vendor services in scope, the review period and prior findings, then define the sample the evidence must cover.
-
Collection: Records With Provenance
Configurations, identities, scan coverage, tickets, log settings and vendor files are collected with source, date and operator recorded on every exhibit.
-
Testing: Expected Against Observed
We compare how each control should behave with how it did across the sample. Every exception gets an owner, a correction plan and a retest date.
-
Indexing: Evidence by Section
The package is indexed by Part 500 section and source system, so internal audit, the CISO and a DFS examiner can each find the support for any finding without asking.
Before collection starts, the NYDFS Part 500 records preparation guide shows your team which source systems an examiner will ask for.
Pre Filing Review, Mock Examination or Incident Record
Pre filing evidence review
Run in the months before April 15, it tests the controls the officers will certify, packages the evidence and leaves enough time to fix and retest the exceptions before anyone signs.
Mock DFS examination
We walk the record the way an examiner would, request the support for selected findings and show where the package would stall, so the gaps close before the real request letter arrives.
Incident record for a notice decision
When a cybersecurity event may trigger the 72 hour notice under 500.17(a), we preserve and analyze the records so the entity and its counsel decide on facts rather than a first impression. If that clock is already running, call (800) 868-8189.
Evidence commonly examined
Part 500 Technical Evidence We Review
Reconciled asset, identity and application inventories define the population. Penetration test and vulnerability reports show the work performed and the coverage it reached. Privilege and multifactor records support the access review, log inventories and retention settings document the audit trail, response plans and exercise records connect procedure to practice, and vendor due diligence and reassessment files support each external relationship.
What you receive
Your Evidence Package and Corrective Register
An evidence map links each selected section to its source systems, and a section by section package holds the exhibits and sampling notes. The corrective register lists exceptions, owners and dates, retest records show what was checked after correction, and the CISO summary organizes the results for the 500.4 report and the annual submission.
The sections in scope are named in writing before filing season, so the review fits the certification calendar.
Examiners Who Build Records That Get Read Closely
Global Digital Forensics was founded in 1992, and our examiners have testified in federal and state courts. A Part 500 evidence package gets the same treatment as an exhibit: every item carries its source, its collection date and the person who collected it.
Evidence packages are assembled by examiners whose work is built to be read closely, including Robert Knudsen, a CISSP and Certified Computer Examiner who has conducted hundreds of computer and mobile device examinations supporting federal and state court matters. See the team's credentials.
Call (800) 868-8189 or request a free consultation to plan this work around your operation.
Free preparation pack
Download the NYDFS Cybersecurity Preparation Pack
The pack gathers entity details, responsible staff, policy records and system evidence into editable CSV checklists, with a guide explaining what each list is for. Fill it in before the first call and the scope comes back built around your actual systems.
NYDFS Cybersecurity Preparation Pack
Entity details, policy records, system evidence and the questions to settle before a Part 500 review.
Format: ZIP with an HTML guide and editable CSV checklists.
Technical Records for Part 500 Review
How shared controls across affiliates and third parties are validated and documented.
Format: PDF, also readable online.
New York Utility Preparation Pack
Gather the supporting records while keeping utility oversight, DFS applicability and private information questions distinct for the specialists responsible for each.
Format: ZIP with a PDF, an XLSX workbook and CSV records.
Working from the regulation itself? DFS publishes the amended Part 500 text and its implementation timeline for covered entities, and our library of preparation packages covers other audits by subject.
Frequently asked
Officer Certification, Annual Tests and MFA Coverage
What do the officers who sign actually receive?
A CISO summary of the results, the evidence map linking each certified section to its sources, and the corrective register showing every exception, its owner and its retest status. The CISO and the governance committee work from the same record.
How is the annual penetration test scoped?
Against the information systems that meet the 500.1 definition for your entity, reconciled with your asset inventory and tested from inside and outside the perimeter. Every finding enters the remediation and retest workflow.
How do you test multifactor authentication coverage?
We trace each way an individual can reach an information system, including remote access, cloud consoles, vendor connections, help desk resets and legacy applications, and confirm enforcement on each path. Gaps are matched to a written CISO approval or entered in the register.
Can you help prepare for a DFS examination?
Yes. We run a mock technical evidence review, organize the examiner materials and identify the gaps to correct before anything is requested, working alongside the compliance and legal teams who represent the entity.
Talk with an examiner
Build the Record Before the Examiner Asks
Bring the selected requirements, your system inventory and the filing deadline to a free initial consultation. We will discuss source coverage, responsible owners and the evidence scope your team needs.
GDF has served clients since 1992 and the hotline is answered 24/7.
Before filing season
Test the Record Before You Certify
Tell us the sections your officers will certify, the systems that hold the evidence and your deadline. The first call settles which sections to test first, the sample and the delivery date, and gives you the cost of the review. The consultation is free.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .