Does NYDFS require penetration testing?

Yes. Section 500.5 requires covered entities to conduct penetration testing from both inside and outside their systems at least once a year, unless they qualify for the limited exemption in section 500.19.

Who can perform the penetration test?

The regulation says a qualified internal or external party. An outside test also gives you an independent report to show an examiner.

How fast can I get both tests done?

You can buy both online and start the same day. Each runs inside a 30-day window, which leaves time to fix findings and retest before you export the final reports.

NYDFS Penetration Testing: What 23 NYCRR 500 Requires

Penetration testing for the New York DFS cybersecurity regulation

If your company holds a license, registration, or charter from the New York Department of Financial Services, its cybersecurity regulation applies to you. That covers banks, insurers and insurance agencies, mortgage companies, money transmitters, and other financial businesses licensed in New York. The regulation asks for penetration testing every year, from both inside and outside your systems. This page explains what it says and how to get both tests done without a consulting engagement.

What the regulation says

Section 500.5 of the regulation (23 NYCRR Part 500) requires covered entities to conduct penetration testing "from both inside and outside" the boundaries of their information systems, at least annually, by a "qualified internal or external party." It also requires automated scans of your systems for vulnerabilities, and prompt fixes ranked by risk.

Inside and outside means two tests

The outside test checks what an attacker on the internet can reach: your public websites, remote access, and anything else exposed.
The inside test starts from a foothold on your network and shows how far an intruder could move.

An external test on its own does not satisfy the regulation. You need both.

The small company exemption

Smaller covered entities, for example those with fewer than 20 employees, may qualify for a limited exemption under section 500.19 that removes the annual penetration testing requirement. Check section 500.19 or ask your compliance advisor before you rely on it. Many exempt firms still test because their insurer or a business partner asks for it.

Both tests, one checkout

Automated external penetration test, from $1,995 for a 30-day window (1 external IP or domain).
Automated internal penetration test, from $2,995 for a 30-day window (up to 25 internal hosts).
Vulnerability scanning on a schedule, from $595 a year for external (10 IPs) and from $1,095 a year for internal.

Each test starts the same day, safely attempts real exploitation, includes retests after you fix findings, and ends with an executive summary and a technical report for your records and your examiner.

When you need an engineer

If your examiner or your own policy calls for a test led by a named engineer, our managed penetration testing team does that.

This page is general information, not legal advice. Ask your attorney or compliance advisor how the regulation applies to your business.

See pen test pricing and buy online · Talk to a specialist