It depends on the rule. The FTC Safeguards Rule asks for continuous monitoring, or else vulnerability assessments at least every six months plus annual penetration testing. New York's financial services rule sets scan frequency by your risk assessment and after material system changes. Neither is a single universal number. This is not legal advice.
What the FTC Safeguards Rule says
For financial institutions it covers, the rule says monitoring and testing shall include continuous monitoring or periodic penetration testing and vulnerability assessments. Without effective continuous monitoring or other systems that detect ongoing changes that may create vulnerabilities, it asks for two things: annual penetration testing, and vulnerability assessments at least every six months, and whenever there are material changes to operations or business arrangements, or circumstances that may materially affect the security program.
The practical reading is that continuous detection of change is an acceptable alternative to a fixed cadence, if it is effective.
What New York's rule says
New York's rule asks for annual penetration testing from inside and outside system boundaries by a qualified party. It also asks for automated scans, plus manual review of systems the scans do not cover, at a frequency set by the risk assessment and promptly after material system changes. It adds a monitoring process so you are promptly informed of new vulnerabilities, and timely remediation prioritized by risk.
Side by side
| Question | FTC Safeguards Rule | New York 500.5 |
|---|---|---|
| Fixed minimum for scans | Six months, if no effective continuous monitoring | None, set by risk assessment |
| Penetration testing | Annual if no continuous monitoring | At least annual |
| After big changes | Yes, material changes | Yes, material system changes |
| Manual review of unscanned systems | Not stated in that clause | Yes |
| Learning of new disclosures | Not stated in that clause | Monitoring process required |
Turning rules into a cadence
- Scan on every build for dependencies and images, because the cost is small.
- Re-scan deployed assets on a schedule, daily for internet-facing and weekly or monthly for the rest, based on your risk assessment.
- Trigger a scan after material changes: new environments, migrations, major releases, new vendors.
- List what scans cannot see, and review those systems by hand on a schedule.
- Watch for new disclosures between scans, since a clean scan last week says nothing about a flaw published yesterday.
Item five is why continuous approaches matter. A component can become vulnerable without any change on your side, only because new information appeared. Our vulnerability management program guide goes deeper.
Record the reasoning
Write down why your cadence suits your risk. An examiner is more convinced by a documented rationale and consistent execution than by a number picked from a blog post, including this one.
Where tooling helps
Safeguard monitors dependency inventories continuously and can flag newly disclosed vulnerabilities against components you already ship, with SBOM generation and asset discovery supporting the list of what is in scope.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how a newly disclosed issue surfaces against software that was already deployed, with no new scan scheduled.
Quick check
Is a quarterly scan enough?
Neither rule above names quarterly. Your risk assessment decides, and a longer gap needs a stronger reason, especially for internet-facing systems.
Does a vendor scan report replace our own?
It can supplement yours for systems the vendor runs. For systems you operate, you still own the scanning and the follow-up.
Sources
Last reviewed: 19 October 2026.
