NYDFS covered entities
NYDFS 23 NYCRR 500 Technical Evidence Support
Prepare clear technical evidence for your NYDFS cybersecurity review. GDF tests controls and connects the results to system activity, documented fixes and verification.
Keep incident evidence separate from notification decisions
Section 500.17 addresses defined cybersecurity incidents and the applicable determination and notification requirements, rather than every cybersecurity event. Counsel and the covered entity determine triggers, timing and submission; GDF supports the agreed technical record.
The evidence map identifies the amended section, system, period, observed control and exceptions. DFS's September 10, 2026 risk-assessment guidance (opens in a new tab) emphasizes current assets, shared and third-party dependencies, and records connecting identified risks to control choices and accepted residual risk. It explains existing Part 500 duties and does not mandate a new framework.
Primary references: NYDFS current requirements and implementation timeline (opens in a new tab) · NYDFS amended Part 500 text (opens in a new tab).
The engagement
Check policies against system records
For an applicable covered entity, technical evidence may address asset inventory under 500.13(a), risk assessment under 500.9, penetration testing/vulnerability practices under 500.5, access/MFA, audit trails and incident-response records. The entity and counsel determine applicability, exemptions and required reporting.
The entity and counsel determine regulatory interpretation and reporting obligations. GDF documents technical evidence for the CISO report under 500.4 and the annual 500.17(b) filing. That filing may be a certification of material compliance or an acknowledgment of noncompliance and is due April 15 for the prior calendar year. The entity retains responsibility for submission and sign-off.
A test plan identifies the policy statement, system owner, technical implementation, evidence source, population, sample, expected result, exception path, and retest method. The work is designed to coexist with internal audit, outside counsel, and existing governance platforms.
Scope
Asset and scope reconciliation
Information systems and nonpublic information mapped across identity providers, endpoint agents, cloud tenants, application inventories, and third-party services. Excluded populations are documented.
Penetration testing and vulnerability program evidence
The amended 500.5 distinguishes annual internal and external penetration testing from risk-based vulnerability scanning and manual review of systems not covered by scans, with timely review after material changes. Confirm the entity's applicable requirements and exemptions; do not substitute an old biannual cadence.
Privileged access and identity control
Account inventories, privileged access reviews, MFA enforcement records under 500.12, and periodic review evidence. Break-glass and service account use is documented and reviewable.
Logging, monitoring, and retention
Audit trail evidence under 500.6: log sources, retention periods, tamper protection, and monitoring workflows. Retention decisions are recorded with the business and evidentiary rationale.
Incident response and recovery evidence
Incident-response plans under 500.16 are assessed against the agreed events and exercises. Recovery evidence, decision logs, incident-notification records and any applicable extortion-payment reporting records are collected in reviewable form.
Third-party and vendor risk
Third-party service provider records supporting 500.11: due diligence, contractual protections, monitoring, and periodic reassessment. Access reviews for vendor identities are documented.
Remediation and exception packaging
Material findings tracked through vulnerability remediation, owner response, exception approval, and technical retest. Exception population and expiration dates are visible.
Methodology
How Part 500 evidence work runs
-
Scope
Covered assets, information systems, and third-party services are identified. The review period, Part 500 requirement version, and prior findings inform sample design.
-
Collect
Configuration exports, identity records, scan coverage, tickets, log configurations, and incident and vendor records are collected with source, date, and operator.
-
Test
Populations are sampled; expected results are compared with observed behavior. Exceptions become tracked items with owner, correction plan, and retest date.
-
Package
Evidence is indexed by Part 500 section, cross-referenced to source system, and organized for CISO reporting, internal audit, and DFS examiner review.
Evidence commonly examined
Evidence reviewed
- Asset, identity, and application inventories reconciled
- Penetration test and vulnerability scan reports with coverage
- Privileged access and MFA enforcement records
- Log source inventories, retention configurations, and monitoring records
- Incident response plan, exercise records, and event notification files
- Vendor due diligence, monitoring, and reassessment records
What you can expect
What you receive
- Evidence map from Part 500 section to source system
- Section-by-section evidence package with sampling notes
- Exception and corrective-action register with owner and dates
- Retest evidence for material findings
- CISO-ready summary aligned to the 500.4 annual reporting cycle
Frequently asked
Common questions
Do you issue a legal compliance opinion or certification?
No. GDF produces the underlying technical record. The covered entity's CISO, general counsel, and where relevant its board committee retain interpretation, certification, and reporting.
How is the annual penetration test scoped?
Scope is defined against the information systems in 500.1, coverage reconciled to inventory, and testing performed by qualified practitioners. Findings feed the risk register and the remediation and retest workflow.
Can you help prepare for a DFS examination?
Yes. GDF can support mock reviews of technical evidence, help package materials for the examiner, and identify gaps for correction before formal submission. Legal representation to DFS remains with counsel.
Talk with an examiner
Discuss your matter and next step
Tell us the systems, evidence and deadline. We can review relevant experience, potential conflicts and the scope before engagement.
Since 1992 · 24/7 dispatch · Court-tested experts
Talk with an examiner
Discuss the matter and the next step.
Tell us what happened and what you need to find out. Speak with a GDF expert about how we can help.
24/7 hotline: 1-800-868-8189