Law / United States / 
Rhode Island
Licensed nonbank financial institutions, information security program
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to a licensee under chapter 19-14 of the Rhode Island General Laws, which you declare by stating that you provide financial services: a person licensed to make or fund loans, broker loans, provide currency transmission, cash checks, provide debt-management services, perform the duties of a mortgage-loan originator or service a loan as a third-party loan servicer. A regulated institution as defined in section 19-1-1, its subsidiary, and a bank holding company or subsidiary of a bank holding company subject to federal bank holding company laws and regulations are outside the section.
- Develop, implement and maintain a comprehensive written information security program, in one or more readily accessible parts, with administrative, technical and physical safeguards appropriate to your size and complexity, the nature and scope of your activities including your use of third-party service providers, and the sensitivity of the customer information you hold.
- Designate a qualified individual, who may be employed by you, an affiliate or a service provider, to oversee, implement and enforce the program; where a service provider or affiliate fills that role, retain responsibility for compliance, designate a senior member of the licensee to direct and oversee the qualified individual, and require the provider or affiliate to maintain a program that protects you.
- Perform a written risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality and integrity of customer information, with criteria for evaluating and categorizing risks and for assessing the confidentiality, integrity and availability of information systems and customer information, and periodically perform additional risk assessments.
- Design and implement safeguards to control the identified risks, including access controls, encryption of customer information in transit over external networks and at rest (or effective alternative compensating controls approved by the qualified individual where encryption is infeasible), secure development practices, multi-factor authentication for any individual accessing any information system unless the qualified individual approves in writing reasonably equivalent or more secure controls, change management procedures, and policies, procedures and controls to monitor and log the activity of authorized users.
- Develop, implement and maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the product or service to the customer, unless it is necessary for business operations or other legitimate business purposes, is required to be retained by law or regulation, or targeted disposal is not reasonably feasible, and periodically review data retention policies.
- Test the program: absent effective continuous monitoring, conduct annual penetration testing of your information systems determined each year by your risk assessment, and vulnerability assessments at least every six months and whenever there are material changes to operations or business arrangements or circumstances you know or have reason to know may materially affect the program.
- Provide personnel with security awareness training that is updated to reflect risks identified by the risk assessment, use qualified information security personnel sufficient to manage information security risks, and verify that key information security personnel keep their knowledge of threats and countermeasures current.
- Select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue, require them by contract to implement and maintain those safeguards, and periodically assess them based on the risk they present.
- Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity or availability of customer information in your control, and a written plan addressing business continuity and disaster recovery.
- Require the qualified individual to report in writing, at least annually, to your board of directors or equivalent governing body, or to a senior officer responsible for the program if there is none, on the overall status of the program and your compliance and on material matters including risk assessment, service provider arrangements, test results and security events.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 19-14-26(b) lets the department assess a civil penalty of not more than $1,000 for each violation, or imprisonment not exceeding one year, or both, for a material violation of the title, and provides that the attorney general prosecutes all criminal activities under the chapter.
Penalty structure
Section 19-14-26(b) sets a civil penalty of not more than $1,000 for each violation, or in the case of identifiable measured transactions per transaction, and provides that each violation constitutes a separate offense.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 1,000
Who enforces it
Enforcement body
The department, which on proof of a material violation by a licensee may suspend or revoke its license, order a person to cease and desist from activity for which a license is required, ask a court to appoint a receiver or to issue injunctive relief, recover on the licensee's bond or impose conditions on its business (section 19-14-26(d)).
What this law does
Each licensee must develop, implement and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical and physical safeguards appropriate to its size and complexity, the nature and scope of its activities and the sensitivity of the customer information it holds. A licensee is any person licensed under the chapter.
The chapter requires a license to make or fund loans, broker loans, provide currency transmission, cash checks, provide debt-management services, perform the duties of a mortgage-loan originator or service a loan as a third-party loan servicer. A licensee must designate a qualified individual responsible for overseeing, implementing and enforcing the information security program, and where it uses a service provider or affiliate for that role it retains responsibility for compliance.
A licensee must perform a written risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information. A licensee must protect by encryption all customer information held or transmitted in transit over external networks and at rest, or use effective alternative compensating controls reviewed and approved by the qualified individual where encryption is infeasible.
A licensee must implement multi-factor authentication for any individual accessing any information system, unless the qualified individual has approved in writing the use of reasonably equivalent or more secure access controls. Absent effective continuous monitoring, a licensee must conduct annual penetration testing of its information systems and vulnerability assessments at least every six months and whenever material changes occur.
A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in its control. A licensee must require the qualified individual to report in writing, at least annually, to the board of directors or equivalent governing body, or to a senior officer responsible for the program where there is none.
A licensee must establish a written plan addressing business continuity and disaster recovery. The section does not apply to a regulated institution as defined in section 19-1-1, its subsidiary, or a bank holding company or subsidiary of a bank holding company subject to federal bank holding company laws and regulations.
If a licensee materially violates an applicable provision of the title or a regulation under it, the department may assess a civil penalty of not more than $1,000 for each violation, or imprisonment not exceeding one year, or both. Section 19-14-35 was added by Public Law 2025, chapters 424 and 425, effective .
When LexLint raises it
When your app profile says your app provides financial services.