NYDFS Penetration Testing and Vulnerability Management

Control: NYDFS-500-002
Regulation: NY DFS Part 500
Category: technical
Priority: critical
Frequency: semi-annually
Type: technical

What this control requires

Conduct annual penetration tests and bi-annual vulnerability assessments under NYDFS Part 500.05. Use qualified independent testers for penetration tests. Remediate critical findings within 30 days. Document all testing and remediation.

Other NY DFS Part 500 controls

NYDFS-500-001 - NYDFS Cybersecurity ProgrammeNYDFS-500-003 - NYDFS Cybersecurity Event Reporting