United StatesNCUA Security Program and Guidelines for Safeguarding Member Information
In force since .
A sector security regimes rule binding private bodies.
As of .
What it requires
- This instrument reaches your organization only if it is a federally insured credit union, or if it maintains or has access to member information on behalf of one as a service provider. Declare is_bank where either holds.
- If your organization is a federally insured credit union, develop a written security program within 90 days of the effective date of insurance, designed to ensure the security and confidentiality of member records, protect against anticipated threats or hazards to the security or integrity of those records, and protect against unauthorized access to or use of them that could result in substantial harm or serious inconvenience to a member.
- Design the security program to respond to incidents of unauthorized access to or use of member information that could result in substantial harm or serious inconvenience to a member.
- Under the Guidelines in Appendix A, a comprehensive written information security program includes administrative, technical, and physical safeguards appropriate to the size and complexity of the credit union and the nature and scope of its activities.
- The Guidelines say the board of directors or an appropriate committee should approve the written information security policy and program, and should receive a report on its status and the credit union's compliance at least annually.
- Each credit union must consider whether the security measures the Guidelines list, among them access controls, encryption of electronic member information, monitoring to detect attacks and intrusions, and response programs including appropriate reports to regulatory and law enforcement agencies, are appropriate and, if so, adopt those it concludes are appropriate.
- The Guidelines say a credit union should exercise appropriate due diligence in selecting its service providers, require them by contract to implement appropriate measures designed to meet the objectives of the Guidelines, and, where its risk assessment indicates, monitor them.
These lines are LexLint's reading of the law's text, as of .
What this law does
Each federally insured credit union will develop a written security program within 90 days of the effective date of insurance. The security program will be designed to ensure the security and confidentiality of member records, protect against the anticipated threats or hazards to the security or integrity of such records, and protect against unauthorized access to or use of such records that could result in substantial harm or serious inconvenience to a member.
The security program will be designed to respond to incidents of unauthorized access to or use of member information that could result in substantial harm or serious inconvenience to a member. The Guidelines state that a comprehensive written information security program includes administrative, technical, and physical safeguards appropriate to the size and complexity of the credit union and the nature and scope of its activities.
The Guidelines apply to member information maintained by or on behalf of federally insured credit unions. Each credit union must consider whether the listed security measures, which include access controls, encryption of electronic member information, monitoring systems to detect attacks and intrusions, and response programs, are appropriate and adopt those it concludes are appropriate.
A credit union should exercise appropriate due diligence in selecting its service providers and require its service providers by contract to implement appropriate measures designed to meet the objectives of the Guidelines. A credit union should report to its board or an appropriate committee of the board at least annually on the overall status of the information security program and the credit union's compliance with the Guidelines. The rule is effective .
When LexLint raises it
When your app profile says your app is a bank.