NYDFS Expects End-to-End Control of Sensitive Data. Can You Prove It?

Ask any NYDFS-regulated institution whether they meet the requirements and the answer is almost always the same: “Yes, we’ve got it covered.”

But when we speak with banks, card issuers and financial platforms, a different picture often emerges: controls are strong in some places, but the data itself isn’t consistently protected everywhere it travels.

It’s a sign of how complex hybrid and multi-cloud environments have become, and how NYDFS now evaluates controls based on data-flow protection, not infrastructure alone.

Here are the four areas where organizations may be falling short of NYDFS regulations without realising it.

1. “We have visibility.”

Teams often assume they have good visibility because they monitor infrastructure, run SIEM tools and complete audit spreadsheets.

But NYDFS isn’t asking whether you can monitor infrastructure; regulators want you to demonstrate how nonpublic information travels, who can access it, and how each data flow is protected.

What we typically find:

• Data moves between internal systems and cloud providers with little or no inspection.

• Third-party connections (payment processors, analytics vendors, SaaS platforms) create blind spots.

• Teams track assets, but not how sensitive information actually flows between them.

If you can’t map how NPI moves, you can’t prove it’s protected.

2. “Our controls are consistent.”

Often they’re not, especially in multi-cloud environments. This is the most common assumption we challenge.

Banks rely on a mix of AWS, Azure, Google Cloud, private cloud and on-prem systems. But if each one handles encryption, keys and segmentation differently, then consistency fails to hold up across your environments. 

We often see:

• One cloud provider encrypts traffic by default, another requires configuration, and legacy systems can’t do it at all.

• Data segmentation stops at network boundaries rather than being applied to the data itself.

• The same type of sensitive data is handled differently depending on where it flows.

NYDFS expects provable, uniform protection of NPI everywhere. So are your controls really consistent? 

3. “We control the keys.”

In practice, many don’t; the cloud provider does. This is the most underestimated gap.

Institutions assume they control encryption keys because they “manage” them inside a cloud provider’s console. But in reality, control is only meaningful if third parties cannot access or influence the keys.

When we ask how keys are generated, stored and managed, here’s what usually emerges:

• Cloud providers retain some form of influence or access.

• Keys are tied to specific cloud environments and cannot be applied consistently across all of them.

• Encryption policies vary depending on where the workload runs.

If a cloud provider holds the keys, you cannot demonstrate exclusive control, and NYDFS has made clear that responsibility for NPI does not shift to vendors.

How to tell quickly if your data in transit is exposed

We ask every NYDFS-regulated organization the same three questions:

1. Can you prove that all sensitive data is protected consistently across every cloud and vendor?

2. Can you show that you, not your cloud provider, control the encryption keys?

3. If an attacker gained valid credentials, could they still extract readable data?

If the answer to any of these is uncertain, your NYDFS compliance is at risk.

How DPRM closes the NYDFS readiness gap

Certes DPRM gives financial institutions a single control that secures data consistently, no matter where it travels. It applies protection at the data flow level, so sensitive information stays isolated, authenticated and encrypted across every cloud, network and vendor. Because DPRM separates protection from the underlying infrastructure, the same policies apply everywhere, even across legacy systems that can’t natively support strong controls.

Your team keeps full ownership of encryption keys and enforcement, removing dependency on cloud-provider key handling. And if a breach occurs, attackers cannot extract readable data, even with valid credentials. DPRM is also built with quantum-safe cryptography, so institutions avoid another rebuild once PQC standards take effect.

With DPRM in place, regulators see clear proof of how NPI is protected across the entire environment, not a patchwork of settings that only cover part of the environment.

Find the Gaps That Put Your NYDFS Compliance at Risk

Most institutions discover gaps only when regulators point them out, usually during an examination, enforcement inquiry or audit review. A readiness briefing exposes those gaps early, shows exactly where controls fall short, and gives teams a direct path to demonstrable protection.

A Certes NYDFS Readiness Briefing helps you:

• See where data in transit is exposed across multi-cloud and third-party environments

• Validate whether your encryption and key-management approach meets NYDFS expectations

• Understand where your current controls break down across different clouds and systems

• Learn how data-flow protection provides the proof regulators now expect

If you’re unsure whether your current approach would stand up to NYDFS scrutiny, this session will give you clarity fast and show how Certes DPRM can help you close the gap before it becomes an issue. 

Book a free NYDFS readiness briefing now and walk away with an actionable roadmap.