Understanding NY DFS Penetration Testing Requirements

The NY DFS 23 NYCRR 500 cybersecurity regulation requires covered entities to conduct annual penetration testing as part of their vulnerability assessment program. This article breaks down what's required, who needs to comply, and how to prepare for your penetration test.

What Does Section 500.05 Require?

Section 500.05 (Penetration Testing and Vulnerability Assessments) states that covered entities must conduct:

• Annual penetration testing of information systems from qualified internal or external parties
• Bi-annual vulnerability assessments including systematic scans or reviews designed to identify vulnerabilities

The regulation allows for flexibility in implementation, stating that testing and assessments should be "designed to assess the effectiveness of the covered entity's cybersecurity program."

What Should a Penetration Test Include?

While NY DFS doesn't specify exact testing methodologies, a compliant penetration test should typically include:

External Network Testing

Testing your internet-facing systems, including firewalls, web servers, email servers, and any cloud infrastructure. This simulates attacks from outside your network perimeter.

Internal Network Testing

Assessing your internal network security assuming an attacker has already gained initial access. This tests lateral movement potential and internal controls.

Web Application Testing

If you have customer-facing web applications that handle nonpublic information, testing for OWASP Top 10 vulnerabilities and application-specific issues.

Social Engineering (Optional)

While not explicitly required, testing employee susceptibility to phishing and other social engineering attacks can provide valuable insights into your human security posture.

Choosing a Penetration Testing Provider

When selecting a penetration testing firm, consider:

• Qualifications: Look for certifications like OSCP, GPEN, or CEH
• Experience: Prefer firms with financial services or NY DFS compliance experience
• Insurance: Ensure they carry adequate professional liability insurance
• Reporting: Ask for sample reports to ensure they meet DFS documentation requirements

Preparing for Your Penetration Test

Before the test begins, you should:

1. Define the scope of testing (which systems, networks, and applications)
2. Establish testing windows and notify relevant stakeholders
3. Provide network documentation to testers (for efficiency)
4. Set up test accounts if needed for authenticated testing
5. Ensure incident response team is aware of the testing schedule
6. Back up critical systems before testing begins

What to Do With the Results

After receiving your penetration test report:

1. Review findings immediately - Address critical vulnerabilities as soon as possible
2. Create a remediation plan - Prioritize fixes based on risk level
3. Document remediation - Keep records of what was fixed and when
4. Verify fixes - Consider re-testing critical vulnerabilities after remediation
5. Store the report securely - You'll need it for your annual certification and potential audits

Documentation for Compliance

For your annual certification, you should maintain:

• The penetration test report with findings and recommendations
• Evidence of remediation for identified vulnerabilities
• Scope documentation and rules of engagement
• Tester qualifications and certifications