--- title: Why Data-Centric Security Matters to New York’s Financial Services Firms description: Any efforts to comply with the amended NYS cybersecurity regulation should begin with a data-centric security approach. image: https://insights.comforte.com/hubfs/comforte%20AG_Why%20Data_Centric%20Security%20Matters%20to%20New%20York%E2%80%99s%20Financial%20Services%20Firms_11.07.png --- [![Hubspot\_blog\_logo](https://insights.comforte.com/hs-fs/hubfs/Hubspot_blog_logo.png?width=295&name=Hubspot_blog_logo.png)](http://www.comforte.com) [![Subscribe to comforte Insights](https://no-cache.hubspot.com/cta/default/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/ba125972-4bdc-4e47-b9a9-81df496120a0) [![comforte AG - Why Data-Centric Security Matters to New York’s Financial Services Firms](https://insights.comforte.com/hubfs/comforte%20AG_Why%20Data_Centric%20Security%20Matters%20to%20New%20York%E2%80%99s%20Financial%20Services%20Firms_11.07.png)](https://insights.comforte.com/why-data-centric-security-matters-to-new-yorks-financial-services-firms) [Dan Simmons](https://insights.comforte.com/author/dan-simmons) l Jul 11, 2024 l [Data Protection](https://insights.comforte.com/tag/data-protection), [Compliance](https://insights.comforte.com/tag/compliance) # Why Data-Centric Security Matters to New York’s Financial Services Firms New York is the financial capital of the US and the world. That puts tremendous pressure on the New York State (NYS) Department of Financial Services to ensure its regulatory regime is both fair and effective. A large part of that today revolves around ensuring New York’s businesses have effective cyber governance as well as the right people, processes, and technology in place to mitigate serious cyber risks. That’s why the state last year announced a major update to [its cybersecurity regulation](https://www.dfs.ny.gov/industry_guidance/regulatory_activity/financial_services)for financial services firms, which include strict new requirements for complying organizations. It re-emphasizes the importance of a data-centric security strategy. ## Time for change The Department of Financial Services supervises and regulates nearly 3,000 financial institutions with assets totalling over $8.8 trillion, including hundreds of insurers, banks and other financial services players. It [describes its](https://www.dfs.ny.gov/reports_and_publications/press_releases/pr202311011) cybersecurity regulations as “nation leading” and – given surging volumes of cyber-threats and data breaches – they need to be. The sector suffered the second-highest volume [of data breaches in the US last year](https://www.statista.com/statistics/1318486/us-number-of-data-loss-incidents-in-financial-sector/), with incidents in the US as a whole climbing to 744. That’s up an astonishing 439% from 2020. The sector is also the second-most expensive for data breach costs, at an average of $5.9m per incident, [as of last year.](https://www.ibm.com/downloads/cas/E3G5JMBP) ## What’s in the new regulation? Against this backdrop, the new regulation mandates a string of cybersecurity best practice updates—covering areas from governance and policy to vulnerability management, identity security, incident response, application security, monitoring and training. Among these are: *“Additional controls to prevent initial unauthorized access to information systems and to prevent or mitigate the spread of an attack.”* This is where data-centric security comes in. Specifically, the amendment requires: *“As part of its cybersecurity program, \[based on its risk assessment,\] each covered entity shall implement \[controls, including\] a written policy requiring encryption that meets industry standards, to protect non-public information held or transmitted by the covered entity both in transit over external networks and at rest.”* It also demands that “covered entities” ensure their third-party service providers follow the same rules—a nod to the growing risk of supply chain breaches. ## A data-centric security approach At the heart of the cybersecurity challenge for the financial services industry is the wealth of customer and internal corporate data that businesses hold. That’s why any efforts to comply with the amended NYS cybersecurity regulation should begin with a data-centric security approach. At a bare minimum, it means that if threat actors manage to circumvent perimeter security, they will be unable to monetize any sensitive data that they access. So what does this mean in practice? There are several key elements: - **Automated data discovery and classification.** This should be done on a continuous basis as data flows in and out of the business. AI tooling is essential here given the vast volumes of data involved and the dynamic nature of the environment. - **Encryption or tokenization (at rest and in transit).** This protects the data from prying eyes and makes it unusable to threat actors. Tokenization is particularly useful as it means the data can be used in use cases like AI analytics without compromising its security. - **Robust access controls.** These should include role-based access control (RBAC) and multi-factor authentication (MFA). The latter is mentioned explicitly in the regulation. - **Continuous monitoring and auditing.** This will help raise a red flag if threat actors breach the organization, accelerate incident response, and streamline compliance reporting. - **Data governance.** The regulation mandates sufficient resources are made available to implement and maintain an effective cybersecurity program, and that the CISO informs senior officials promptly of any material incident The IMF [claimed recently](https://insights.comforte.com/fixing-a-12bn-challenge-for-banks-through-data-centric-security?hsLang=en) that more than 20,000 attacks on the banking sector have caused losses exceeding $12bn over the past 20 years—with “extreme losses” more than quadrupling since 2017 to $2.5bn. It’s reassuring therefore that NYS regulators are raising the bar for cybersecurity in the region. Now it’s time for financial institutions to get their compliance house in order. --- | Share this: | [![LinkedIn](https://insights.comforte.com/hubfs/Social%20Icons/linkedin%20icon.png)](https://www.linkedin.com/shareArticle?mini=true&url=https://insights.comforte.com/why-data-centric-security-matters-to-new-yorks-financial-services-firms&utm_medium=social&utm_source=linkedin) | [![Bluesky](https://insights.comforte.com/hubfs/Social%20Icons/bluesky_logo.png)](https://bsky.app/intent/compose?url=https://insights.comforte.com/why-data-centric-security-matters-to-new-yorks-financial-services-firms&utm_medium=social&utm_source=Bluesky) | ![Twitter](https://insights.comforte.com/hubfs/Social%20Icons/twitter_x_logo-1.png) | [![XING](https://insights.comforte.com/hubfs/Social%20Icons/xing-color2.png)](https://www.xing.com/spi/shares/new?url=https://insights.comforte.com/why-data-centric-security-matters-to-new-yorks-financial-services-firms&utm_medium=social&utm_source=xing) | [![Email](https://insights.comforte.com/hubfs/Social%20Icons/email%20icon.png)](mailto:?subject=Check%20out%20https://insights.comforte.com/why-data-centric-security-matters-to-new-yorks-financial-services-firms&utm_medium=social&utm_source=email%20&body=Check%20out%20https://insights.comforte.com/why-data-centric-security-matters-to-new-yorks-financial-services-firms&utm_medium=social&utm_source=email) | | --- | --- | --- | --- | --- | --- | ## Learn how to discover, classify, and protect all sensitive data. Click the button below to download the solution brief for our Data Security Platform: [![Download Solution Brief](https://no-cache.hubspot.com/cta/default/4026697/65e094b1-44ae-496e-be17-1678a1876675.png)](https://cta-redirect.hubspot.com/cta/redirect/4026697/65e094b1-44ae-496e-be17-1678a1876675) ### Related posts ![Reuse, Reward: How Banks Can Safely Unlock the Value of Their Data](https://insights.comforte.com/hubfs/comforte%20AG_%20Reuse%20Reward_%20How%20Banks%20Can%20Safely%20Unlock%20the%20Value%20of%20Their%20Data_03.2025.png) Mar 12, 2026 l [Data Protection](https://insights.comforte.com/tag/data-protection) , [Payments Transformation](https://insights.comforte.com/tag/payments-transformation) , [Business Value](https://insights.comforte.com/tag/business-value) ### [Reuse, Reward: How Banks Can Safely Unlock the Value of Their Data](https://insights.comforte.com/reuse-reward-how-banks-can-safely-unlock-the-value-of-their-data?hsLang=en) The financial world is awash with data. But too few organizations are able to use it effectively. In [Bank Director’s *2025 Technology Survey*](https://www.bankdirector.com/wp-content/uploads/2025/09/2025TechReport-OpenVersion.pdf), one-third of US banking leaders cite an inability to harness data as a top technology challenge facing their... [Read more](https://insights.comforte.com/reuse-reward-how-banks-can-safely-unlock-the-value-of-their-data?hsLang=en) ![Delivering a Secure, Trusted Foundation for Cloud Growth at LGT](https://insights.comforte.com/hubfs/comforte%20AG_Delivering%20a%20Secure%2c%20Trusted%20Foundation%20for%20Cloud%20Growth%20at%20LGT_01.2026.png) Jan 15, 2026 l [Data Protection](https://insights.comforte.com/tag/data-protection) , [Business Value](https://insights.comforte.com/tag/business-value) ### [Delivering a Secure, Trusted Foundation for Cloud Growth at LGT](https://insights.comforte.com/delivering-a-secure-trusted-foundation-for-cloud-growth-at-lgt?hsLang=en) There’s a world of difference between retail and private banking. While the former is transactional and focused on the mass market, the latter is built on trust and personal relationships. That trust can be hard won, but is easily lost, especially... [Read more](https://insights.comforte.com/delivering-a-secure-trusted-foundation-for-cloud-growth-at-lgt?hsLang=en) ![Top Indicators You Have a Cybersecurity Problem—and What to Do About It](https://insights.comforte.com/hubfs/comforte%20AG_Top%20Indicators%20You%20Have%20a%20Cybersecurity%20Problem_and%20What%20to%20Do%20About%20It.png) May 22, 2025 l [Data Protection](https://insights.comforte.com/tag/data-protection) , [Digital Enablement](https://insights.comforte.com/tag/digital-enablement) ### [Top Indicators You Have a Cybersecurity Problem—and What to Do About It](https://insights.comforte.com/top-indicators-you-have-a-cybersecurity-problem-and-what-to-do-about-it?hsLang=en) Data is both blessing and curse to the modern enterprise. Yes, when analyzed effectively it can surface intelligence to improve decision making, customer engagement, process efficiency and, ultimately, drive revenue. But it also represents a major... [Read more](https://insights.comforte.com/top-indicators-you-have-a-cybersecurity-problem-and-what-to-do-about-it?hsLang=en) ### Service - [Contact](https://www.comforte.com/contact/) - [About us](https://www.comforte.com/company/) - [Blog](https://insights.comforte.com/) - [Press Releases](https://www.comforte.com/company/press-releases/) - [Career](https://www.comforte.com/company/career/) - [Resources](https://www.comforte.com/resources/) ### EMEA comforte AG Abraham-Lincoln-Str. 22 65189 Wiesbaden Germany Phone: + 49 611 93199 00 Fax: + 49 611 93199 05 ### Asia-Pacific comforte PTY Suite 20, 1 Rivett Road North Ryde NSW 2113 Australia Postal Address: PO Box 1710 Lane Cove NSW 1595 Australia Phone: +61 2 8197 0272 ### Americas comforte Inc. 30 Wall Street, 8th Floor New York, NY 10005-2205 USA Phone: +1-646-438-5716 ### Southeast Asia comforte Asia Pte. Ltd. 1 Raffles Place, #19-61 Tower 2  Singapore 048616 Phone: +65 6808 5507 - [Sitemap](https://www.comforte.com/sitemap/) - [Legal Notice](https://www.comforte.com/legal-notice/) - [Privacy Policy](https://www.comforte.com/privacy-policy/) © comforte AG 2026