United StatesInteragency Guidelines Establishing Information Security Standards
Interagency Guidelines Establishing Information Security Standards 12 CFR Part 30 Appendix B, 12 CFR Part 225 Appendix F and 12 CFR Part 364 Appendix B
In force since .
A sector security regimes rule binding private bodies.
As of .
What it requires
- This instrument reaches your organization only if it is a national bank, Federal savings association, Federal branch or agency of a foreign bank, bank holding company, FDIC-insured bank that is not a member of the Federal Reserve System, FDIC-insured state savings association, insured state branch of a foreign bank, or a subsidiary of one of them (other than a broker, dealer, person providing insurance, investment company or investment adviser). Declare is_bank where that holds.
- Implement a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to your size and complexity and the nature and scope of your activities, designed to ensure the security and confidentiality of customer information, protect against anticipated threats or hazards to its security or integrity, protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer, and ensure the proper disposal of customer and consumer information.
- Have your board of directors or an appropriate committee of the board approve the written information security program and oversee its development, implementation, and maintenance, and report to the board or committee at least annually on the status of the program and your compliance.
- Identify reasonably foreseeable internal and external threats to customer information and customer information systems, assess their likelihood and potential damage, and assess the sufficiency of your controls.
- Consider whether the security measures the Guidelines list, among them access controls, encryption of electronic customer information, monitoring to detect actual and attempted attacks and intrusions, and response programs that include appropriate reports to regulatory and law enforcement agencies, are appropriate and, if so, adopt those you conclude are appropriate.
- Exercise appropriate due diligence in selecting your service providers, require them by contract to implement appropriate measures designed to meet the objectives of the Guidelines, and, where your risk assessment indicates, monitor them to confirm that they have met their obligations.
These lines are LexLint's reading of the law's text, as of .
What this law does
The Guidelines apply to customer information maintained by or on behalf of entities over which the Office of the Comptroller of the Currency has authority, which are national banks, Federal savings associations, Federal branches and Federal agencies of foreign banks, and any subsidiaries of such entities except brokers, dealers, persons providing insurance, investment companies, and investment advisers.
The Federal Reserve Board's version applies to customer information maintained by or on behalf of bank holding companies and their nonbank subsidiaries or affiliates, except brokers, dealers, persons providing insurance, investment companies, and investment advisors, for which the Board has supervisory authority.
The Federal Deposit Insurance Corporation's version applies to banks insured by the FDIC other than members of the Federal Reserve System, state savings associations insured by the FDIC, insured state branches of foreign banks, and any subsidiaries of such entities except brokers, dealers, persons providing insurance, investment companies, and investment advisers.
Each national bank or Federal savings association shall implement a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to its size and complexity and the nature and scope of its activities.
The board of directors or an appropriate committee of the board of each national bank or Federal savings association shall approve its written information security program and oversee the development, implementation, and maintenance of that program.
Each national bank or Federal savings association shall identify reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems.
Each national bank or Federal savings association must consider whether listed security measures, including access controls, encryption of electronic customer information, monitoring systems to detect attacks and intrusions, and response programs, are appropriate and adopt those it concludes are appropriate.
Each national bank or Federal savings association shall exercise appropriate due diligence in selecting its service providers and require its service providers by contract to implement appropriate measures designed to meet the objectives of the Guidelines. Each national bank or Federal savings association shall report to its board or an appropriate committee of the board at least annually.
The Comptroller may take action under section 39 of the Federal Deposit Insurance Act and the Guidelines independently of, in conjunction with, or in addition to, any other enforcement action available to the Comptroller. Each national bank or Federal savings association must implement an information security program pursuant to the Guidelines by .
When LexLint raises it
When your app profile says your app is a bank.