NYDFS raised the bar on testing.
A continuous adversary clears it.
The NYDFS cybersecurity rule asks NYDFS-regulated financial institutions for annual penetration testing and regular vulnerability assessments, based on your risk assessment. SpartanX supports that program with a continuous adversary that proves exploitability inside and out. It supports your program and complements your assessor; it does not make you compliant on its own.
Annual penetration testing, and ongoing vulnerability assessment.
Section 500.5 of 23 NYCRR Part 500 requires covered entities to conduct penetration testing of information systems at least annually, from both inside and outside the information systems’ boundaries, and to run automated scans and manual reviews for vulnerabilities on a schedule set by risk.Section 500.5 applies uniformly to covered entities. Class A companies carry additional obligations elsewhere in the rule, including an annual independent audit of the cybersecurity program, privileged access management, endpoint detection and response, and centralized logging, but the testing requirement itself is the same.Part 500 also requires an annual certification of material compliance, or a written acknowledgment of material non-compliance identifying each deficient section and a remediation timeline, submitted to the Superintendent by April 15 and signed by both the highest-ranking executive and the CISO.Our view: an annual test is the floor, and the gap between tests is where the risk accumulates.
NYDFS-regulated financial institutions.
Part 500 covers entities licensed or regulated by the New York Department of Financial Services, including banks, insurers, and many financial-services firms operating in New York. Your information systems, inside and outside the perimeter, are in scope, which is exactly the ground an adversary works.Section 500.19(a) grants a limited exemption to entities below its thresholds, which are exempt from Section 500.5 altogether. The thresholds are low enough that most covered financial institutions are squarely in scope.
Inside and outside the perimeter, on a continuous cadence.
Examination-ready, continuously.
You get inside-and-outside testing that does not wait for the annual window, exploit-validated findings, and a live evidence trail, so a NYDFS examination finds a program that is current, not a report that has aged.Signing off on a posture validated once, twelve months ago, is an uncomfortable position. Signing off on one validated continuously, with evidence on file, is a defensible one.
Support your NYDFS testing program with a continuous adversary.
See how SpartanX proves exploitability inside and out and hands you the evidence.