A single unencrypted database column can destroy months of security work. Under the NYDFS Cybersecurity Regulation, that column is a breach waiting to happen if it contains Nonpublic Information. Section 500.13 demands strict controls on sensitive columns—data elements like social security numbers, account numbers, health records, or any combination of identifiers that could harm consumers if exposed.
Sensitive columns must be encrypted at rest and in transit. Access must be limited to authorized accounts. Every query must be logged. The regulation is clear: if a column can reveal a person’s identity or financial details, it must be tracked, secured, and hardened against any vector of attack. This includes masking sensitive columns where full values are not required, and enforcing role-based controls so that even internal users see only what’s necessary.
Compliance is not just technical. The NYDFS Cybersecurity Regulation requires written policies on the handling of sensitive columns, mapped to actual system designs. Automated discovery of sensitive columns is critical. Static documentation is not enough. Schema drifts, migrations, and new code can change what columns store sensitive values. Without continuous inventory and classification, gaps appear and risk grows.