Is a crypto-asset provider, in Rhode Island

R.I. Gen. Laws sec. 19-14-35 · Read the law's page

• Applies to a licensee under chapter 19-14 of the Rhode Island General Laws, which you declare by stating that you provide financial services: a person licensed to make or fund loans, broker loans, provide currency transmission, cash checks, provide debt-management services, perform the duties of a mortgage-loan originator or service a loan as a third-party loan servicer. A regulated institution as defined in section 19-1-1, its subsidiary, and a bank holding company or subsidiary of a bank holding company subject to federal bank holding company laws and regulations are outside the section.
• Develop, implement and maintain a comprehensive written information security program, in one or more readily accessible parts, with administrative, technical and physical safeguards appropriate to your size and complexity, the nature and scope of your activities including your use of third-party service providers, and the sensitivity of the customer information you hold.
• Designate a qualified individual, who may be employed by you, an affiliate or a service provider, to oversee, implement and enforce the program; where a service provider or affiliate fills that role, retain responsibility for compliance, designate a senior member of the licensee to direct and oversee the qualified individual, and require the provider or affiliate to maintain a program that protects you.
• Perform a written risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality and integrity of customer information, with criteria for evaluating and categorizing risks and for assessing the confidentiality, integrity and availability of information systems and customer information, and periodically perform additional risk assessments.
• Design and implement safeguards to control the identified risks, including access controls, encryption of customer information in transit over external networks and at rest (or effective alternative compensating controls approved by the qualified individual where encryption is infeasible), secure development practices, multi-factor authentication for any individual accessing any information system unless the qualified individual approves in writing reasonably equivalent or more secure controls, change management procedures, and policies, procedures and controls to monitor and log the activity of authorized users.
• Develop, implement and maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the product or service to the customer, unless it is necessary for business operations or other legitimate business purposes, is required to be retained by law or regulation, or targeted disposal is not reasonably feasible, and periodically review data retention policies.
• Test the program: absent effective continuous monitoring, conduct annual penetration testing of your information systems determined each year by your risk assessment, and vulnerability assessments at least every six months and whenever there are material changes to operations or business arrangements or circumstances you know or have reason to know may materially affect the program.
• Provide personnel with security awareness training that is updated to reflect risks identified by the risk assessment, use qualified information security personnel sufficient to manage information security risks, and verify that key information security personnel keep their knowledge of threats and countermeasures current.
• Select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue, require them by contract to implement and maintain those safeguards, and periodically assess them based on the risk they present.
• Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity or availability of customer information in your control, and a written plan addressing business continuity and disaster recovery.
• Require the qualified individual to report in writing, at least annually, to your board of directors or equivalent governing body, or to a senior officer responsible for the program if there is none, on the overall status of the program and your compliance and on material matters including risk assessment, service provider arrangements, test results and security events.

R.I. Gen. Laws sec. 19-14-36 · Read the law's page

• Applies to a licensee under chapter 19-14 of the Rhode Island General Laws, which you declare by stating that you provide financial services: a person licensed to make or fund loans, broker loans, provide currency transmission, cash checks, provide debt-management services, perform the duties of a mortgage-loan originator or service a loan as a third-party loan servicer. A regulated institution as defined in section 19-1-1, its subsidiary, and a bank holding company or subsidiary of a bank holding company subject to federal bank holding company laws and regulations are outside the section.
• Notify the director or the director's designee as promptly as possible, and in no event later than three business days from a determination that a security event has occurred, when you must give notice of the event to a governmental body, self-regulatory agency or other supervisory body under state or federal law, or the event has a reasonable likelihood of materially harming any consumer residing in Rhode Island or any material part of your normal operations.
• Give the notice in electronic form as the director directs, and keep updating and supplementing it with later notifications about the security event.
• Include in the notice your name and contact information, the types of information involved, the date or date range of the event if it is possible to determine, the total number of Rhode Island consumers affected or potentially affected (a best estimate in the initial report, updated with each later report), a general description of how the information was exposed, lost, stolen or breached and the roles of any third-party service providers, the efforts under way to remediate the situation, whether a law enforcement official has given you a written determination that notifying the public would impede a criminal investigation or damage national security, and a contact person familiar with the event.
• Comply with chapter 49.3 of title 11 as applicable, and give the director a copy of the notice sent to consumers when you are required to notify the director.