NYDFS section 500.15 requires a written policy for encryption that meets industry standards, protecting nonpublic information in transit over external networks and at rest. If encrypting at rest is infeasible, the CISO may approve effective alternative compensating controls in writing, and must review that decision and the controls at least annually.
This is general information, not legal advice.
What the rule says
Subsection (a) requires the written policy and covers both states of data. Subsection (b) applies only to data at rest: the entity may instead secure it with effective alternative compensating controls, reviewed and approved in writing by the CISO, with feasibility and effectiveness reviewed at least annually. There is no matching escape hatch for data in transit over external networks.
What infeasible means in practice
The rule does not define the word. Real cases are usually legacy systems whose database or file format cannot be encrypted without breaking applications, or vendor products that offer no encryption option. Cost or inconvenience alone is a weak argument. A written explanation of why it cannot be done now, with a plan if one exists, reads better than silence.
What a compensating control record contains
| Element | Content |
|---|---|
| System and data | What is unencrypted and what nonpublic information it holds |
| Reason | Why at rest encryption is infeasible |
| Compensating controls | For example network isolation, tight access limits, stronger monitoring, tokenization of sensitive fields |
| Approval | Written approval by the CISO with date |
| Review | Annual re-check of feasibility and effectiveness, with next date |
| Exit plan | Retirement or upgrade plan, if any |
Engineering checks that support the policy
- Inventory where nonpublic information is stored, including backups, replicas and exports.
- Confirm encryption settings on managed databases, object storage and disks, and record the evidence.
- Check TLS on all external connections, including to vendors and between environments that cross untrusted networks.
- Review key management: who can use keys, how they rotate, where they live.
- Record exceptions in the same register and set review dates.
Where the data sits matters as much as whether it is encrypted. Moving sensitive fields out of a legacy store can remove the need for an exception.
Mistakes to avoid
Frequent problems: assuming a cloud provider encrypts everything by default without checking each store; forgetting backups, replicas and exports; keeping keys beside the data they protect; and leaving exceptions open for years with no review. Verify settings per resource, include copies in the scope, separate key custody, and give each exception an expiry date that forces a decision.
Another angle: key management
Encryption is only as good as its keys. Record who can use each key, how rotation works, and what happens if a key is lost. Auditors and partners tend to ask about key custody next, so having a short answer ready saves time.
Quick check
Can the CISO waive encryption in transit?
The compensating control path in 500.15(b) is written for data at rest only.
How often must exceptions be reviewed?
The CISO must review the feasibility of encryption and the effectiveness of the compensating controls at least annually.
Sources
Last reviewed: 19 October 2026.
