Practitioner resource

A Brief Guide to Preparing for a NYS DFS Cybersecurity Audit

November 1, 2026

Before you read

Would you share your contact details with GDF? It helps us understand who finds these resources useful. It is optional, and every guide is yours to read either way.

Skip and read

We will remember your choice on this browser so you can browse the whole library without another request. You can read without sharing information.

Discuss Engaging an Expert All guides

(212) 561-5860 24/7: (800) 868-8189

Start by identifying the request you actually received. An internal audit, a customer assessment and a DFS examination may require different evidence and different decision makers. Confirm the legal entity, review period, applicable Part 500 requirements and response deadline. Counsel and compliance should settle applicability and exemptions before the technical team marks requirements complete. This short guide helps organize that preparation; the full Technical Evidence Playbook provides the more detailed working method. [DFS_FAQ]

Appoint a coordinator and preserve the request record

Name one person to maintain the request list, evidence index and delivery versions. Identify the owners for identity, infrastructure, applications, security operations, vendors and business continuity. Retain the original request and later clarifications. A response coordinator should be able to explain where an item stands without changing the underlying evidence or making a legal conclusion on another owner's behalf.

Establish scope before collecting files

Record the entity's systems, shared services, significant providers and relevant data. Confirm which evidence must describe historical operation and which concerns current settings. Ask owners to identify known gaps immediately. Do not replace an unavailable historical record with a new screenshot and imply that the screenshot shows the earlier state. Keep original exports, collection dates, filters and explanations together.

Assemble a focused first evidence pack

Begin with the applicable policies, current risk assessment, asset inventory, access and MFA records, vulnerability and penetration-test records, incident-response and recovery exercise evidence, relevant provider material and the prior annual submission's support. The right items depend on the actual requirements and request. A document's title is not proof that it covers the correct entity, systems or period.

For each material assertion, identify an evidence reference and a named owner who can explain it. Use samples deliberately and identify their limits. A representative access-removal record may demonstrate how a process operated for that departure; it does not automatically establish that every account was removed on time throughout the year.

Reconcile exceptions instead of concealing them

Create a short register of missing records, contradictory dates, uncovered systems and open remediation. Record the consequence, owner, proposed next step and review date. Distinguish an exception discovered during preparation from a conclusion about whether the entity materially complied. Counsel and the responsible officers should evaluate the significance of the facts.

Use current DFS guidance when reviewing the risk assessment. The September 2026 guidance explains the value of documented risks, control traceability and updates when circumstances change. A borrowed framework should be tailored to the entity's environment and risks rather than treated as a completed assessment because all of its headings have text. [DFS_RISK]

Confirm reporting and signatory responsibilities

Part 500 contains separate annual-submission and incident-notice provisions. Identify the responsible people and their support records before a deadline approaches. A certification of material compliance and an acknowledgment of noncompliance are different submission paths. An assessment report does not choose the path or replace the required signatories. Keep the supporting account aligned with the period and applicable text of the regulation. [DFS]

Prepare for a reviewer to follow the account

Use consistent system names and dates, readable evidence references and concise explanations. Separate original records from annotated copies. Ask each control owner to verify factual accuracy, and arrange the appropriate legal or compliance review. Retain the delivered version and record later corrections. The objective is a response that can be followed and checked, including its limits, rather than a large file collection whose contents nobody can explain.

Evidence handling record linking a source, collection, transfer and analysis — Planning illustration. Apply it to the authorized scope and actual systems described in this guide.

Information Gathering Q&A Checklist

Use this Q&A with the people who own the systems and the relevant legal or business decisions. Mark unknown or not applicable answers explicitly. Record an owner, a confirming source and the date. The public guide-request form asks for your email, not the answers below.

Do not write passwords, recovery keys, unlock codes or authentication secrets here. Record whether authorized access is available, who controls it and how a secure handoff can be arranged. Keep completed copies in the location counsel or the company approves. Do not send a completed record containing sensitive account or employee details through a public contact form.

Who is directing the matter and who can authorize technical access?

Identify directing counsel, the business decision maker, the IT security owner and any outside administrator. Record the immediate deadline, relevant period and known preservation risk. An employee's possession of a device or an administrator's ability to access an account does not by itself settle the authorized examination scope.

Answer: