NYDFS Part 500 Penetration Testing Requirements (500.5)

Video transcript

NYDFS Part 500 requires a pentest at least annually, from inside and outside your systems' boundaries. Here is how crypto firms scope it.

Alongside the annual pentest, section five hundred point five requires automated scans, monitoring for new vulnerabilities, and timely fixes ranked by risk.

BitLicensees carry a second test. Part 200 requires a pentest at least annually and a vulnerability assessment at least quarterly. The small firm exemption lists only Part 500 sections, so ask counsel.

The rule does not define the boundary. Outside is what an attacker on the internet reaches. Inside asks how far a foothold gets toward the systems that sign.

Part 500 never mentions wallets, but its information system definition is broad. The cautious scope runs from apps and APIs to cloud, signing services and offchain automation.

Every April fifteenth, the highest-ranking executive and the CISO certify material compliance. Keep five years of evidence: your policy, pentest reports, risk-ranked findings with retests, and scan results.

Short lapses count too. Part 500 treats a material failure to comply for any 24-hour period as a violation.

Guardian's pentests are run by the researchers who audit your contracts, focused on exploitable paths to funds. Guardian also maps each report to the NYDFS provisions it answers.

Read the full article, or talk to Guardian at guardian.security to scope your Part 500 pentest.

New York's Department of Financial Services (DFS) amended its cybersecurity regulation, 23 NYCRR Part 500, with effect from November 1, 2023.

The amendment rewrote section 500.5 on vulnerability management. The amended pentest rule has applied since April 29, 2024, and the new scanning rule since May 1, 2025.

Both are in force now. Both feed the compliance certification due every April 15.

This article explains the technical and security side of 23 NYCRR 500.5. It is not legal advice; confirm how it applies to you with counsel.

What 500.5 Requires

Each covered entity must keep written vulnerability management policies, based on its risk assessment. At a minimum, they must ensure:

Scans must also run "promptly after any material system changes".

Part 500 defines penetration testing as attempting "to circumvent or defeat the security features of an information system", from outside or inside.

Who It Covers

Part 500 covers anyone operating under a license, registration, charter or similar authorization under New York's Banking Law, Insurance Law or Financial Services Law.

For crypto, that includes BitLicensees and trust companies chartered under the Banking Law.

DFS's 2022 $30 million penalty on Robinhood Crypto cited Part 500 alongside Part 200, the virtual currency regulation.

BitLicensees carry a second test. Part 200 requires pentesting "at least annually" and vulnerability assessment "at least quarterly" (200.16(e)).

The limited exemption

Section 500.19(a) exempts smaller entities from 500.5. Any one of these qualifies:

• Fewer than 20 employees and independent contractors, including affiliates.
• Under $7.5 million in gross annual revenue in each of the last three fiscal years.
• Under $15 million in year-end total assets, including affiliates.

That exemption lists Part 500 sections only. Part 200's testing rule is separate, so ask counsel how both apply.

Class A companies

A Class A company has at least $20 million in gross annual revenue in each of the last two fiscal years. It also has over 2,000 employees, or over $1 billion in revenue, counting affiliates.

Section 500.5 reads the same for Class A. The extra duties sit elsewhere:

• Independent audits of the cybersecurity program (500.2(c)).
• Privileged access management and automated blocking of common passwords (500.7(c)).
• Endpoint detection and response, and centralized logging and alerting (500.14(b)).

An independent audit needs auditors "free to make decisions not influenced by" the company. The pentest itself only needs a "qualified" party.

Inside and Outside the Boundary

The rule asks for both perspectives but does not define the boundary. Draw it from your risk assessment and asset inventory.

• Outside: what an attacker on the internet reaches with no access. Domains, apps, APIs, exposed cloud services, login and recovery.
• Inside: what an attacker reaches from a foothold. A phished laptop, a leaked cloud key, a compromised vendor account.

For a crypto firm, the inside test asks the question that matters: how far does a foothold get toward the systems that sign?

Our guide to the assumed breach pentest covers the inside view.

Qualified testers

Part 500 does not define "qualified". Ask any tester, internal or external, for:

• Named testers and their experience with systems like yours.
• A written methodology and rules of engagement.
• Distance from the team that built what they are testing.
• Reproduced findings and a retest after fixes.

Scoping a Crypto Firm's Test

Part 500 never mentions wallets, keys or smart contracts. Its information system definition is broad, so the cautious approach puts the systems that sign in scope.

Material changes should trigger a scan, and often a focused test: a new chain, a wallet vendor switch or a signer migration.

For test cases, see what a real crypto exchange pentest covers.

Evidence for Certification

Every April 15, each covered entity certifies it "materially complied" with Part 500 in the prior calendar year. Otherwise it files an acknowledgment of noncompliance with a remediation timeline.

The highest-ranking executive and the CISO sign. The certification must rest on documentation sufficient to demonstrate compliance, kept for five years.

For 500.5, that file holds:

• The written vulnerability management policy, tied to the risk assessment.
• Each pentest report: scope, dates, both perspectives and who tested.
• Findings ranked by risk, with fix dates and retest results.
• Scan schedules and results, plus manual reviews of unscanned systems.
• Scans run after material changes, matched to the change log.
• The CISO's annual report to the senior governing body, including remediation plans (500.4(b)).

Short lapses count too. Part 500 counts a material failure to comply "for any 24-hour period" as a violation (500.20(b)(2)).

The scope starts with your 500.9 risk assessment; see our NYDFS risk assessment template. Licensed in the EU too? Compare DORA's testing rules.

How Guardian Helps

Guardian's pentests cover web apps, APIs, cloud, keepers, extensions and SDKs. The researchers who audit your contracts run them.

They focus on exploitable paths to funds, not checklist coverage. Engagements include infrastructure, web app, API, browser extension and offchain automation pentests, SDK audits and OpSec audits.

Guardian's regulatory compliance work maps each pentest report to the provisions it answers, including NYDFS 500.5 and 200.16(e).

Frequently Asked Questions

How often does NYDFS Part 500 require penetration testing?

At least annually. Section 500.5(a)(1) requires a pentest from inside and outside the information systems' boundaries, by a qualified internal or external party. BitLicensees also face Part 200's annual pentest and quarterly vulnerability assessment.

Does the pentest have to be done by an outside firm?

No. Section 500.5 accepts a qualified internal or external party. Class A companies must also run independent audits of their cybersecurity program under 500.2(c), which is a separate requirement.

Are small firms exempt from the Part 500 pentest?

The 500.19(a) limited exemption covers 500.5. It applies with fewer than 20 employees and contractors, under $7.5 million in revenue in each of the last three years, or under $15 million in assets. Part 200's pentest rule is separate.

When did the amended 500.5 take effect?

The second amendment took effect on November 1, 2023. Its amended pentest, monitoring and remediation requirements applied from April 29, 2024, and automated scanning from May 1, 2025.

Sources

• New York DFS: 23 NYCRR Part 500, Cybersecurity Requirements for Financial Services Companies, as amended by the Second Amendment (DFS text, effective November 1, 2023)
• Cornell LII: 23 NYCRR 200.16, Cyber security program (Part 200, Virtual Currencies)
• New York DFS: $30 Million Penalty on Robinhood Crypto (August 2, 2022)
• Debevoise & Plimpton: A Summary of the Final Amendments to the NYDFS Cybersecurity Rules (November 2023)
• Guardian: NYDFS Risk Assessment Guidance: A 500.9 Template for Crypto
• Guardian: Crypto Exchange Pentesting: What a Real Assessment Covers
• Guardian: DORA Penetration Testing Requirements: Articles 24 to 27