NIST CSF 2.0, ProtectPR.DS-02

For identification, rely on qualified certificates for electronic seals or for website authentication under Regulation (EU) No 910/2014 that include the additional attributes in Article 34(3) (Article 34). When exchanging data over the internet, apply secure encryption with strong and widely recognized encryption techniques throughout the communication session. If you issue card-based payment instruments or are an account information service provider or a payment initiation service provider, keep the access sessions offered by account servicing payment service providers as short as possible and terminate them as soon as the requested action is completed. Keep personalized security credentials and authentication codes unreadable, directly or indirectly, by any staff at any time, and inform the payment services user and the issuer of the credentials without undue delay of any loss of their confidentiality under your sphere of competence (Article 35).

If you provide telecommunications services or contribute to them, take appropriate technical precautions and other measures, taking the state of the art into account, to protect the secrecy of telecommunications and against personal-data breaches (Section 165(1)).

Have sound security mechanisms to meet the requirements of Regulation (EU) 2022/2554 that secure and authenticate the channels of information transfer, minimise the risk of data corruption and unauthorised access and prevent information leaks, so that the confidentiality of data is always ensured (Section 80(1) sentence 2 number 4).

Implement a written policy requiring encryption that meets industry standards, to protect the nonpublic information you hold or transmit both in transit over external networks and at rest.

Take technical, operational, organisational and physical protection measures across the areas Article 10 lists, including multi-factor authentication or a continuous-authentication solution, secured voice, video and text communication, and secured communication channels for emergencies.

Take the measures necessary to provide secure services to customers and preserve banking confidentiality when conducting an electronic funds transfer.

Encrypt Tier 3 (Private Sensitive) and Tier 4 (Highly Sensitive) data whenever you transmit it between physical locations.

For personal information you store or transmit electronically, build a computer-system security program with secure user authentication, access controls limiting records to those who need them, encryption of records transmitted across public networks or wirelessly and of personal information stored on a laptop or other portable device, up-to-date firewalls and operating-system security patches for any internet-connected system, up-to-date malware protection, and employee training on the security system.

If you do not accept payment cards, do not transfer a Nevada resident's personal information through an electronic, nonvoice transmission other than a facsimile outside your secure system, and do not move a data storage device containing that personal information beyond your logical or physical controls, unless the data is encrypted using an encryption technology adopted by an established standards-setting body, with appropriate management and safeguards of the cryptographic keys.