Confidential computing is no longer optional. Under the New York Department of Financial Services (NYDFS) Cybersecurity Regulation, financial institutions must prove that sensitive data is protected at every stage—at rest, in transit, and now, in use. Attackers target memory, screenshots, and any blind spot left open by traditional encryption. Confidential computing closes that gap by processing data inside secure hardware-based environments, shielded from even the host system.
The NYDFS rules demand clear evidence of strong controls and incident reporting. Encryption alone may pass outdated audits, but it won’t survive the scrutiny of current regulators or advanced threat actors. Confidential computing aligns directly with the regulation’s requirements for access restriction, continuous monitoring, and auditable protection of nonpublic information. It transforms compliance from a checklist exercise into a verifiable security posture that withstands both regulators and adversaries.
Under NYDFS, failure isn’t just a breach—it’s a reportable event that can lead to fines, loss of license, and public disclosure. Meeting the letter and spirit of the regulation means proving control over all data states. Confidential computing provides a defensible way to meet that burden, enabling cryptographic isolation during live workloads without slowing down operations.