NYDFS Cybersecurity Tabletop Exercise Requirements in 2026: What Examiners Expect and How to Modernize Your Program

Why NYDFS Tabletop Exercises Deserve More Attention in 2026

I spend a lot of time talking to CISOs and incident response leaders at financial institutions. One pattern keeps surfacing in these conversations: organizations that invest heavily in detection, monitoring, and access controls still treat incident response testing as an afterthought.

They'll spend millions on EDR, SIEM, and vulnerability management — then test their ability to actually respond to an incident once a year, in a conference room, with a recycled PowerPoint deck.

The disconnect is striking. And NYDFS examiners have noticed.

With the Second Amendment to 23 NYCRR Part 500 now fully in effect — the final requirements took effect November 1, 2025 — the regulatory bar for incident response testing has moved significantly. Organizations that treat tabletop exercises as a checkbox are exposing themselves to both examination findings and, more importantly, real operational risk when the next incident occurs.

This post breaks down exactly what NYDFS requires, what examiners are looking for beyond the letter of the regulation, and how forward-thinking security teams are evolving their approach.

The Regulatory Foundation: What 23 NYCRR Part 500 Actually Requires

Let's start with the text of the regulation itself, because many organizations are still operating under assumptions from the original 2017 version.

Section 500.16: Incident Response and Business Continuity Management

The amended Section 500.16 requires every covered entity to establish written plans — including incident response and business continuity and disaster recovery (BCDR) plans — designed to promptly respond to and recover from any cybersecurity event materially affecting the confidentiality, integrity, or availability of the entity's information systems.

The incident response plan must address:

• Internal processes for responding to cybersecurity events, including disruptive events such as ransomware
• Goals and defined roles and responsibilities
• External and internal communications procedures
• Requirements for remediation of identified weaknesses
• Documentation and reporting regarding cybersecurity events
• Root cause analysis, business impact assessment, and prevention measures
• Updating of incident response plans as necessary

Here's the critical provision that elevates tabletop exercises from "nice to have" to regulatory requirement:

Section 500.16(d): Each covered entity shall periodically, but at a minimum annually, test its incident response and BCDR plans with all staff and management critical to the response, and shall revise the plan as necessary.

This isn't ambiguous. Annual testing is the minimum. The regulation also specifies that the testing must include "all staff and management critical to the response" — which means IT-only tabletops don't satisfy the requirement.

Section 500.17: The 72-Hour Reporting Obligation

Covered entities must notify NYDFS within 72 hours of determining that a reportable cybersecurity event has occurred. The amended regulation also adds a 24-hour notification requirement for ransomware deployment and extortion payments.

These compressed timelines make tabletop exercises operationally critical. If your team hasn't rehearsed the notification workflow — who determines reportability, who drafts the notification, who approves it, who submits it — you're building that process for the first time during the most stressful hours of a real incident.

The Annual Certification Adds Personal Accountability

Under Section 500.17(b), both the CISO and the highest-ranking executive must annually certify material compliance with Part 500. If your incident response plan hasn't been tested, or if the testing wasn't documented, that certification becomes a personal liability question — not just a compliance one.

What NYDFS Examiners Actually Look For Beyond the Text

The regulation sets the floor. Examiner expectations set the standard. Based on enforcement patterns, published NYDFS guidance, and conversations with compliance leaders across financial services, here's what examiners are evaluating:

1. Scenarios That Reflect Real and Current Threats

NYDFS expects incident response plans to address specific disruptive events, including ransomware. The Department's ransomware guidance explicitly states that incident response plans should address ransomware attacks and should be "tested in advance of any incident (i.e., tabletop exercises)."

This means examiners are looking at your scenarios. A generic "data breach" scenario from 2021 doesn't demonstrate that your organization can respond to a 2026 supply-chain compromise or a cloud misconfiguration that exposes nonpublic information (NPI).

Credible, examination-ready scenarios should reflect threats like:

• Ransomware with extortion and the 24-hour payment notification requirement
• Third-party service provider compromises (especially given Part 500's third-party oversight requirements)
• Cloud misconfigurations leading to NPI exposure
• Business email compromise targeting wire transfers
• Insider threats involving privileged access abuse

One challenge organizations consistently describe: keeping scenarios current. Threats evolve faster than annual planning cycles allow. By the time you've spent 40-80 hours building the next exercise, the threat landscape has shifted.

2. Genuine Cross-Functional Participation

NYDFS treats cybersecurity incidents as business events, not IT events. The regulation requires the senior governing body to have oversight of cybersecurity risk. The CISO must report material cybersecurity issues to senior leadership. The certification must be signed by the highest-ranking executive.

Examiners expect this governance structure to be reflected in exercise participation. An effective tabletop should include:

• Security and IT operations — the technical responders
• Legal and compliance — who assess reporting obligations and regulatory exposure
• Risk management — who evaluate business impact
• Communications / PR — who manage internal and external messaging
• Executive leadership — who make escalation and disclosure decisions

In practice, this is where many organizations struggle. One CISO I spoke with described it candidly: "It's hard to get folks in the room." When exercises happen once a year, feel scripted, and are perceived as low-value, they drop to the bottom of everyone's priority list. The security team ends up settling for whoever can make it rather than ensuring the right stakeholders participate.

This creates a vicious cycle. Poorly attended exercises are less effective, which reinforces the perception they're not valuable, which makes them even harder to schedule next time.

3. Pressure-Tested Decision Points

Strong tabletop exercises don't just walk through procedures — they force uncomfortable decisions under ambiguity:

• Does this event meet NYDFS reporting thresholds? The regulation requires notification for events with a "reasonable likelihood of materially harming any material part of the normal operation(s)" of the entity. That's a judgment call, and teams need practice making it.
• When do we escalate to the senior governing body? The CISO is required to report material cybersecurity issues to leadership. But "material" requires interpretation in real time.
• Who approves the 72-hour notification? And the 24-hour ransomware notification? These decisions involve legal, compliance, the CISO, and executive leadership — and they need to happen fast.
• What gets communicated externally — and when? Premature disclosure can cause market impact. Delayed disclosure can trigger regulatory consequences.

Many organizations only discover misalignment on these questions during a live incident. The tabletop should be where those gaps surface — not the breach.

4. Documented Evidence and Demonstrated Improvement

NYDFS examiners commonly request exercise documentation as part of their reviews. The regulation requires that covered entities keep data and documentation supporting their annual compliance certifications for five years.

What examiners want to see:

• Exercise documentation: Scenario details, participant lists, timeline of decisions
• Identified gaps and observations: Specific weaknesses uncovered during the exercise
• Remediation evidence: What was done to address those gaps — and proof it was completed
• Trend data: Are the same gaps appearing every year, or is the organization demonstrably improving?

This last point is critical. One of the most common failures I see is tabletop exercises that generate discussion but produce no measurable outcomes. A "lessons learned" document gets created, uploaded to SharePoint, and forgotten. Six months later, the same communication breakdowns and role confusion reappear. Without systematic tracking and follow-through, the exercise investment is largely wasted.

The Enforcement Context: $63.3 Million in Penalties and Counting

Understanding examiner expectations is important. Understanding enforcement consequences makes the urgency concrete.

NYDFS has issued $63.3 million in Part 500-related penalties across recent enforcement actions. While these cases primarily targeted control failures like missing MFA, inadequate access controls, and delayed reporting, they establish a clear pattern: NYDFS is willing to impose significant financial penalties for gaps between written policies and actual implementation.

Consider the implications for incident response testing:

• A major payments processor (January 2025): $2 million penalty for violations including failure to use effective controls, qualified personnel, and adequate training. The enforcement underscored that even prompt remediation after an incident cannot fully compensate for pre-incident compliance failures.
• A health insurance provider (August 2025): $2 million penalty after a phishing attack exposed NPI for tens of thousands of consumers. NYDFS found the cybersecurity program wasn't adequately calibrated to protect against, mitigate, or respond to the incident.
• A consumer lending company (May 2023): $4.25 million fine. NYDFS found that security gaps had been previously identified by the company's own internal audit — and not remediated. The same gaps contributed to three cybersecurity events over three years.

The consumer lending case is particularly instructive for incident response testing. If your tabletop exercises identify gaps, and those gaps aren't remediated, and those gaps later contribute to an incident — the exercise documentation itself becomes evidence against you. This makes the follow-through loop not just operationally important but legally significant.

Where Traditional Tabletop Exercises Fall Short

The gap between what NYDFS expects and what most organizations deliver is significant. Here's how the typical approach compares to what's actually needed:

The fundamental problem isn't effort — security teams work hard on these exercises. The problem is that the manual, annual model can't scale to meet either the regulatory standard or the operational need.

Incident response is a perishable skill. If your team only practices once a year, they're not developing the instincts, coordination, and decision-making speed needed in a real crisis. And NYDFS's requirement that testing include "all staff and management critical to the response" means the coordination challenge multiplies with every stakeholder group.

From Annual Compliance Events to Continuous Readiness

Leading organizations are recognizing that the solution isn't to run one better annual tabletop. It's to fundamentally rethink the cadence and approach.

The shift looks like this:

Annual tabletop discussions → Continuous, scenario-driven testing → Rehearsed, measurable response execution

This is the problem we built ChaosTrack to solve. Instead of relying on manual scenario creation and once-a-year workshops, ChaosTrack enables continuous simulation of real-world attack patterns — allowing teams to test against scenarios derived from actual incidents, involve the right stakeholders repeatedly, rehearse notification workflows and escalation decisions under time pressure, and build an auditable record of every exercise, decision, and remediation action.

The goal isn't to replace the strategic thinking that security leaders bring to exercise design. It's to remove the constraints — the 40-80 hours of manual prep, the coordination overhead, the lack of tracking — that make good exercises impossible to run at the frequency organizations need.

When exercises happen monthly rather than annually, three things change:

1. Teams build real muscle memory. Response instincts develop through repetition, not one-off discussions.
2. Gaps get identified and fixed continuously. Instead of the same findings recurring each year, organizations can track remediation in near real-time.
3. Compliance becomes a byproduct of capability. When your response program is genuinely strong, examination evidence is a natural output — not a documentation scramble.

An NYDFS-Ready Tabletop Exercise Checklist

For organizations looking to strengthen their tabletop program ahead of their next NYDFS examination or April 15 certification filing, here are the practical elements that matter:

Before the exercise:

• Develop scenarios based on current threat intelligence, not recycled templates
• Ensure scenarios explicitly address ransomware and other disruptive events (per the amended Section 500.16)
• Include notification timing and reporting threshold decisions in the scenario design
• Confirm participation from all critical functions — security, IT, legal, compliance, risk, communications, and executive leadership
• Make relevant runbooks and procedures available to participants in advance

During the exercise:

• Force decision points around NYDFS reporting thresholds, escalation triggers, and external communications
• Document decisions, rationale, role assignments, and timing in real time
• Introduce realistic complications: conflicting information, stakeholder unavailability, legal ambiguity

After the exercise:

• Produce a structured findings report with specific, measurable gaps identified
• Assign remediation actions with owners and deadlines
• Track remediation to closure — and verify through subsequent exercises
• Archive all documentation to support annual certification and potential examiner review
• Compare findings to prior exercises to demonstrate improvement trends

Final Thought

NYDFS tabletop requirements exist because the Department has investigated hundreds of cybersecurity incidents and found, in their own words, that "there is a tremendous amount that organizations can do to protect themselves." Paper plans don't hold up under the pressure of a real incident. Untested notification workflows lead to missed reporting deadlines. Unrehearsed escalation paths create confusion when speed matters most.

Organizations that modernize how they test, rehearse, and execute incident response don't just pass examinations more easily — they respond faster, communicate more clearly, and recover stronger when real incidents occur.

The next enforcement action won't distinguish between organizations that had a plan and organizations that practiced it. NYDFS has made that abundantly clear. The question isn't whether to invest in better tabletop exercises — it's whether your current program can withstand the scrutiny that's coming.

The insights in this post draw from conversations with security leaders across financial services, published NYDFS guidance, and enforcement actions under 23 NYCRR Part 500. For more on how ChaosTrack helps organizations shift from annual compliance exercises to continuous incident response readiness, visit chaostrack.com.

Related reading: The Broken Promise of Tabletop Exercises: Why Security Leaders Are Demanding Change