00-15798. Interagency Guidelines Establishing Standards for Safeguarding Customer Information and Rescission of Year 2000 Standards for Safety and Soundness

AGENCIES:

The Office of the Comptroller of the Currency, Treasury; Board of Governors of the Federal Reserve System; Federal Deposit Insurance Corporation; and Office of Thrift Supervision, Treasury.

ACTION:

Joint notice of proposed rule making.

SUMMARY:

The Office of the Comptroller of the Currency, Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, and Office of Thrift Supervision, (collectively, the Agencies) are requesting comment on proposed Guidelines establishing standards for safeguarding customer information published to implement sections 501 and 505(b) of the Gramm-Leach-Bliley Act (the G-L-B Act or Act).

Section 501 of the G-L-B Act requires the Agencies to establish appropriate standards for the financial institutions subject to their respective jurisdictions relating to administrative, technical, and physical safeguards for customer records and information. These safeguards are intended to: Insure the security and confidentiality of customer records and information; protect against any anticipated threats or hazards to the security or integrity of such records; and protect against unauthorized access to or use of such records or information that could result in substantial harm or inconvenience to any customer. The Agencies are to implement these standards in the same manner, to the extent practicable, as standards prescribed pursuant to section 39(a) of the Federal Deposit Insurance Act (FDI Act). The proposed Guidelines implement the requirements of the G-L-B Act.

The Agencies previously issued guidelines establishing Year 2000 safety and soundness standards for insured depository institutions pursuant to section 39 of the FDI Act. Since the events for which these guidelines were issued have passed, the Agencies have concluded that the guidelines are no longer necessary and propose to rescind the guidelines as part of this rulemaking.

DATES:

Comments must be received not later than August 25, 2000.

ADDRESSES:

Comments should be directed to: Office of the Comptroller of the Currency (OCC): Communications Division, Office of the Comptroller of the Currency, 250 E Street, SW., Third Floor, Washington, DC 20219, Attention: Docket No. 00-13; Fax number [phone] or Internet address: [e-mail]. Comments may be inspected and photocopied at the OCC's Public Reference Room, 250 E Street, SW., Washington, D.C., between 9:00 a.m. and 5:00 p.m. on business days. You can make an appointment to inspect the comments by calling [phone].

Board of Governors of the Federal Reserve System (Board): Comments, which should refer to Docket No. R-1073, may be mailed to Ms. Jennifer J. Johnson, Secretary, Board of Governors of the Federal Reserve System, 20th and C Streets, NW, Washington, DC 20551 or mailed electronically to [e-mail]. Comments addressed to Ms. Johnson also may be delivered to the Board's mail room between 8:45 a.m. and 5:15 p.m. and to the security control room outside of those hours. Both the mail room and the security control room are accessible from the courtyard entrance on 20th Street between Constitution Avenue and C Street, NW. Comments may be inspected in Room MP-500 between 9 a.m. and 5 p.m., pursuant to § 261.12, except as provided in § 261.14, of the Board's Rules Regarding the Availability of Information, 12 CFR 261.12 and 261.14.

Federal Deposit Insurance Corporation (FDIC): Send written comments to Robert E. Feldman, Executive Secretary, Attention: Comments/OES, Federal Deposit Insurance Corporation, 550 17th Street, NW., Washington, DC 20429. Comments also may be mailed electronically to [e-mail]. Comments may be hand delivered to the guard station at the rear of the 17th Street building (located on F Street) on business days between 7 a.m. and 5 p.m.; Fax number [phone]. Comments may be inspected and photocopied in the FDIC Public Information Center, Room 100, 801 17th Street, NW., Washington, DC 20429, between 9 a.m. and 5:00 p.m. on business days.

Office of Thrift Supervision (OTS): Send comments to Manager, Dissemination Branch, Information Management & Services Division, Office of Thrift Supervision, 1700 G Street, NW., lower level from 9:00 a.m. to 5:00 p.m. on business days. Send facsimile transmissions to Fax number [phone] or [phone] (if the comment is over 25 pages). Send email to [e-mail] and include your name and telephone number. Interested persons may inspect comments at 1700 G Street, NW., from 9 a.m. until 4 p.m. on Tuesdays and Thursdays.

FOR FURTHER INFORMATION CONTACT:

OCC: Mark Tenhundfeld, Assistant Director, Legislative and Regulatory Activities Division, [phone]; John Carlson, Acting Deputy Director for Bank Technology, [phone]; Deborah Katz, Senior Attorney, Legislative and Regulatory Activities Division, [phone]; or Jeffery Abrahamson, Attorney, Legislative and Regulatory Activities Division, [phone].

Board: Heidi Richards, Manager, Division of Banking Supervision and Regulation, [phone]; or Stephanie Martin, Managing Senior Counsel, Legal Division, [phone].

For the hearing impaired only, contact Janice Simms, Telecommunication Device for the Deaf (TDD) [phone], Board of Governors of the Federal Reserve System, 20th and C Streets, NW., Washington, DC 20551.

FDIC: Thomas J. Tuzinski, Review Examiner, Division of Supervision, [phone]; Jeffrey M. Kopchik, Senior Policy Analyst, Division of Supervision, [phone]; or Robert A. Patrick, Counsel, Legal Division, [phone].

OTS: Paul R. Reymann, Senior Project Manager, Technology Risk Management, [phone]; or Christine Harrington, Counsel, Banking and Finance, Regulations and Legislation Division, [phone].

SUPPLEMENTARY INFORMATION:

The contents of this preamble are listed in the following outline:

I. Background

II. Section-by-Section Analysis

III. Regulatory Analysis

A. Paperwork Reduction Act

B. Regulatory Flexibility Act

C. Executive Order 12866

D. Unfunded Mandates Act of 1995

IV. Solicitation of Comments on Use of Plain Language

I. Background

On November 12, 1999, President Clinton signed the G-L-B Act (Pub. L. 106-102) into law. Section 501, entitled Protection of Nonpublic Personal Information, requires the Agencies and the Securities and Exchange Commission, the National Credit Union Administration, and the Federal Trade Commission to establish appropriate standards for the financial institutions subject to their respective jurisdictions relating to the administrative, technical, and physical safeguards for customer records and information. These safeguards are intended to: (1) Insure the security and confidentiality of customer records and information; (2) protect against any anticipated threats or hazards to the security or integrity of such records; and (3) protect against unauthorized access to or use of such records or information that would result in substantial harm or inconvenience to any customer.

Section 505(b) of the G-L-B Act provides that these standards are to be implemented by the Agencies in the same manner, to the extent practicable, as standards prescribed pursuant to section 39(a) of the FDI Act.^[1] Section 39(a) of the FDI Act authorizes the Agencies to establish operational and managerial standards for insured depository institutions relative to, among other things, internal controls, information systems, and internal audit systems, as well as such other operational and managerial standards as the Agencies determine to be appropriate. These standards may be issued as guidelines or regulations. While this proposal is in the form of guidelines, the Agencies solicit comment on whether the final standards should be issued in the form of guidelines or as regulations.^[2]

The proposed Guidelines apply to “nonpublic personal information” of “customers” as those terms are defined in the Agencies' privacy rules published in accordance with Title V of the G-L-B Act (the Privacy Rule). See Privacy of Consumer Financial Information, 65 FR 35162 (June 1, 2000).^[3] Under section 503(b)(3) of the G-L-B Act and the Privacy Rule, financial institutions will be required to disclose their policies and practices with respect to protecting the confidentiality, security, and integrity of nonpublic personal information as part of the initial and annual notices to their customers. Key components of the proposed Guidelines were derived from security-related supervisory guidance previously issued by the Agencies and the Federal Financial Institutions Examination Council (FFIEC).

The texts of the Agencies' proposed Guidelines are substantively identical. The Agencies request comment on all aspects of the proposed Guidelines as well as comment on the specific provisions and issues highlighted in the section-by-section analysis below. Those commenters who believe that the proposed Guidelines would impose undue burdens on financial institutions should identify which parts of the Guidelines they believe impose excessive burdens and describe the burdens. Those commenters should also discuss either: (1) Alternative methods that would accomplish the same purpose; or (2) why the intended purpose is unnecessary or should be modified.

The Agencies also seek comments on the impact of this proposal on community banks. The Agencies recognize that community banks operate with more limited resources than larger institutions and may present a different risk profile. Thus, in addition to reviewing comments, each Agency will endeavor to assess the potential impact and burden that the proposal may impose on community banks during the comment period. The Agencies also specifically request comment on the impact of this proposal on community banks' current resources and available personnel with the requisite expertise. Commenters should discuss whether (1) The standards are reasonable and realistic for community banks, and (2) whether the goals of the proposed regulation could be achieved, for community banks, through an alternative approach. Based on the comments received, the Agencies will consider whether there is a need to develop a compliance guide for community banks and other smaller institutions in conjunction with the final Guidelines.

As proposed, the Guidelines will appear as an appendix to each Agency's Standards for Safety and Soundness. For the OCC those regulations appear at 12 CFR part 30; for the Board at 12 CFR part 208; for the FDIC at 12 CFR part 364; and for the OTS at 12 CFR part 570. The Board is also amending 12 CFR parts 211 and 225 to apply the Guidelines to other institutions that it supervises.

The Agencies will apply the rules already in place to require the submission of a compliance plan in appropriate circumstances. For the OCC those regulations appear at 12 CFR part 30; for the Board at 12 CFR part 263; for the FDIC at 12 CFR part 308, subpart R; and for the OTS at 12 CFR part 570. This proposal makes conforming changes to the regulatory text of these parts.

Rescission of Year 2000 Standards for Safety and Soundness. The Agencies previously issued guidelines establishing Year 2000 safety and soundness standards for insured depository institutions pursuant to section 39 of the FDI Act. Because the events for which these guidelines were issued have passed, the Agencies have concluded that the guidelines are no longer necessary and propose to rescind the guidelines as part of this rulemaking. These guidelines appear for the OCC at 12 CFR part 30, appendix B and C; for the Board at 12 CFR part 208, appendix D-2; for the FDIC at 12 CFR part 364, appendix B; and for the OTS at 12 CFR part 570, appendix B. The Agencies request comment on whether the rescission of these appendices is appropriate.

II. Section-by-Section Analysis

The discussion that follows applies to each of the Agencies' proposed Guidelines.

Appendix _ to Part _—Interagency Guidelines Establishing Standards for Safeguarding Customer Information

I. Introduction

Proposed paragraph I. sets forth the general purpose of the proposed Guidelines, which is to provide guidance to each financial institution in establishing and implementing administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information. This paragraph also sets forth the statutory authority for the proposed Guidelines, including section 39(a) of the FDI Act (12 U.S.C. 1831p-1) and sections 501 and 505(b) of the G-L-B Act (15 U.S.C. 6801 and 6805(b) ).

I.A. Scope

Paragraph I.A. describes the scope of the proposed Guidelines. Each Agency defines specifically those entities within its particular scope of coverage in this paragraph of the proposed Guidelines. ^[4]

I.B. Preservation of Existing Authority

Paragraph I.B. makes clear that in issuing these proposed Guidelines none of the Agencies is, in any way, limiting its authority to address any unsafe or unsound practice, violation of law, unsafe or unsound condition, or other practice, including any condition or practice related to safeguarding customer information. Any action taken by any Agency under section 39(a) of the FDI Act and these Guidelines may be taken independently of, in conjunction with, or in addition to any other enforcement action available to the Agency.

I.C. Definitions

Paragraph I.C. sets forth the definitions of various terms for purposes of the proposed Guidelines. ^[5]

I.C.1. In General

Paragraph I.C.1. provides that terms used in the proposed Guidelines have the same meanings as set forth in sections 3 and 39(a) of the FDI Act (12 U.S.C. 1813 and 1831p-1), except to the extent that the definition of the term is modified in the proposed Guidelines or where the context requires otherwise.

I.C.2. Customer Information

Proposed paragraph I.C.2. defines customer information. Customer information includes any records, data, files, or other information containing nonpublic personal information, as defined in section _.3(n) of the Privacy Rule, about a customer. This includes records in paper, electronic, or any other form that are within the control of a financial institution or that are maintained by any service provider on behalf of an institution. Although the G-L-B Act uses both the terms “records” and “information,” for the sake of simplicity, in the proposed Guidelines the term “customer information” encompasses all customer records.

Section 501(b) refers to safeguarding the security and confidentiality of “customer” information. The term “customer” is also used in other sections of Title V of the G-L-B Act and has been defined by the Agencies in the Privacy Rule interpreting these sections to include those consumers who have a customer relationship with the institution. This term does not cover business customers, or consumers who have not established an ongoing relationship with a financial institution (e.g. those that merely use an institution's ATM or apply for a loan). See sections _.3(h) and (i) of the Privacy Rule.

The Agencies propose defining “customer” for purposes of the Guidelines consistently with the Privacy Rule. However, the Agencies have considered whether the scope of the Guidelines should apply to records regarding all consumers, the institution's consumer and business clients, or all of an institution's records. The Agencies solicit comment on whether a broader definition would change the information security program that an institution would implement, or, whether, as a practical matter, institutions would respond to the Guidelines by implementing an information security program for all types of records under their control rather than segregating “customer” records for special treatment.

I.C.3. Customer

Proposed paragraph I.C.3. defines customer. Customer would include any customer of an institution as defined in section _.3(h) of the Privacy Rule. A customer is a consumer who has established a continuing relationship with an institution under which the institution provides one or more financial products or services to the consumer to be used primarily for personal, family or household purposes.

I.C.4. Service Provider

Proposed paragraph I.C.4. defines a service provider as any person or entity that maintains or processes customer information on behalf of an institution, or is otherwise granted access to customer information through its provision of services to an institution.

I.C.5. Board of Directors

Proposed paragraph I.C.5. defines board of directors to mean, in the case of a branch or agency of a foreign bank, the managing official in charge of the branch or agency. ^[6]

I.C.6. Customer Information System

Proposed paragraph I.C.6. defines customer information system to be electronic or physical methods used to access, collect, store, use, transmit and protect customer information.

II. Standards for Safeguarding Customer Information

II.A. Information Security Program

The proposed Guidelines describe the Agencies' expectations for the creation, implementation, and maintenance of an information security program. This program must include administrative, technical, and physical safeguards appropriate to the size and complexity of the institution and the nature and scope of its activities. The proposed Guidelines describe the oversight role of the board of directors in this process and management's continuing duty to evaluate and report to the board on the overall status of this program. The four steps in this process require an institution to: (1) Identify and assess the risks that may threaten customer information; (2) develop a written plan containing policies and procedures to manage and control these risks; (3) implement and test the plan; and (4) adjust the plan on a continuing basis to account for changes in technology, the sensitivity of customer information, and internal or external threats to information security. The proposed Guidelines also set forth an institution's responsibility for overseeing outsourcing arrangements.

II.B. Objectives

Proposed paragraph II.B. describes the objectives for an information security program to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazards to the security or integrity of such information, and protect against unauthorized access to or use of customer information that could either: (1) Result in substantial harm or inconvenience to any customer; or (2) present a safety and soundness risk to the institution. For purposes of the Guidelines, unauthorized access to or use of customer information does not include access to or use of customer information with the customer's consent. The Agencies request comment on whether there are additional or alternative objectives that should be included in the Guidelines.

III. Develop and Implement Information Security Program

III.A. Involve the Board of Directors and Management

Proposed paragraph III.A. describes the involvement of the board and management in the development and implementation of an information security program. The board's responsibilities are to: (1) Approve the institution's written information security policy and program that complies with these Guidelines; and (2) oversee efforts to develop, implement, and maintain an effective information security program, including the regular review of management reports.

The three responsibilities for management in the development of an information security program are to: (1) Evaluate the impact on the institution's security program of changing business arrangements (e.g. mergers and acquisitions, alliances and joint ventures, outsourcing arrangements), and changes to customer information systems; (2) document compliance with these Guidelines; and (3) keep the board informed of the current status of the institution's information security program, e.g., report to the board on a regular basis on the overall status of the information security program, including material matters related to: Risk assessment; risk management and control decisions; results of testing; attempted or actual security breaches or violations and responsive actions taken by management; and any recommendations for improvements to the information security program.

The Agencies specifically invite comment regarding the appropriate frequency of reports to the board. Should the Guidelines specify reporting intervals—monthly, quarterly, annually? How regularly should management report to the board regarding the institution's information security program and why are these intervals appropriate? Should the Guidelines require that the board designate a Corporate Information Security Officer or other responsible individual who would have the authority, subject to the board's approval, to develop and administer the institution's information security program?

III.B. Assess Risk

Proposed paragraph III.B. describes the risk assessment process that should be developed as part of the information security program in order to meet the objectives of the Guidelines. First, a financial institution should identify and assess risks that may threaten the security, confidentiality, or integrity of customer information, whether in storage, processing, or transit. The risk assessment should be made in light of an institution's size, scope of operations, and technology. Institutions should determine the sensitivity of customer information to be protected as part of this analysis.

Next, a financial institution should conduct an assessment of the sufficiency of existing policies, procedures, customer information systems, and other arrangements intended to control the risks it has identified. Finally, the financial institution should monitor, evaluate, and adjust its risk assessment, taking into consideration any technological or other changes or the sensitivity of the information.

III.C. Manage and Control Risk

Proposed paragraph III.C. describes the elements of a comprehensive risk management plan designed to control identified risks and to achieve the overall objective of ensuring the security and confidentiality of customer information. It identifies the factors an institution should consider in evaluating the adequacy of its policies and procedures to effectively manage these risks commensurate with the sensitivity of the information as well as the complexity and scope of the institution and its activities. In establishing the policies and procedures, each institution should consider appropriate:

a. Access rights to customer information;

b. Access controls on customer information systems, including controls to authenticate and grant access only to authorized individuals and companies;

c. Access restrictions at locations containing customer information, such as buildings, computer facilities, and records storage facilities;

d. Encryption of electronic customer information, including while in transit or in storage on networks or systems to which unauthorized individuals may have access;

e. Procedures to confirm that customer information system modifications are consistent with the institution's information security program;

f. Dual control procedures, segregation of duties, and employee background checks for employees with responsibilities for or access to customer information;

g. Contract provisions and oversight mechanisms to protect the security of customer information maintained or processed by service providers;

h. Monitoring systems and procedures to detect actual and attempted attacks on or intrusions into customer information systems;

i. Response programs that specify actions to be taken when unauthorized access to customer information systems is suspected or detected;

j. Protection against destruction of customer information due to potential physical hazards, such as fire and water damage; and

k. Response programs to preserve the integrity and security of customer information in the event of computer or other technological failure, including, where appropriate, reconstructing lost or damaged customer information.

The Agencies intend that these elements accommodate institutions of varying sizes, scope of operations, and risk management structures. The Agencies invite comment on the degree of detail that should be included in the Guidelines regarding the risk management program, which elements should be specified in the Guidelines, and any other components of a risk management program that should be included.

The Guidelines also provide that an institution's information security program should include a training component designed to teach employees to recognize and respond to fraudulent attempts to obtain customer information and, where appropriate, to report any attempts to regulatory and law enforcement agencies.

The information security program also should include regular testing of systems to confirm that an institution and its service providers control identified risks and achieve the objectives to ensure the security and confidentiality of customer information. The tests should be verified by an independent third party or staff independent of those who conducted the test. Tests should be documented. The frequency and nature of the testing should be determined by the risk assessment and adjusted as necessary to reflect changes in the internal and external conditions. The Agencies request comment on whether specific types of security tests, such as penetration tests or intrusion detections tests, should be required.

The Agencies invite comment regarding the appropriate degree of independence that should be specified in the Guidelines in connection with the testing of information security systems and the review of test results. Should the tests or reviews of tests be conducted by persons who are not employees of the financial institution? If employees may conduct the testing or may review test results, what measures, if any, are appropriate to assure their independence?

Finally, the Guidelines describe the need for an ongoing process of monitoring, evaluation, and adjustment of the information security program in light of any relevant changes in technology, the sensitivity of customer information, and internal or external threats to information security.

III.D. Oversee Outsourcing Arrangements

Proposed paragraph III.D. addresses outsourcing. An institution should exercise appropriate due diligence in managing and monitoring its outsourcing arrangements to confirm that its service providers have implemented an effective information security program to protect customer information and customer information systems consistent with these Guidelines.

The Agencies welcome comments on the appropriate treatment of outsourcing arrangements. For example, are industry best practices available regarding effective monitoring of service provider security precautions? Do service providers accommodate requests for specific contract provisions regarding information security? To the extent that service providers do not accommodate these requests, how do financial institutions implement effective information security programs? Should these Guidelines contain specific contract provisions requiring service provider performance standards in connection with the security of customer information?

III.E. Implement the Standards

Proposed paragraph III.E. describes the timing requirements for the implementation of these standards. Each financial institution is to take appropriate steps to fully implement an information security program pursuant to these Guidelines by July 1, 2001.

III. Regulatory Analysis

A. Paperwork Reduction Act

FDIC: The FDIC has determined that the proposed rule does not contain any information collections as defined by the Paperwork Reduction Act (44 U.S.C. 3501, et seq.).

B. Regulatory Flexibility Act

OCC: The Regulatory Flexibility Act (5 U.S.C. 601-612) (RFA) requires an agency to either provide an Initial Regulatory Flexibility Analysis with a proposed rule or certify that the proposed rule will not have a significant economic impact on a substantial number of small entities (defined for purposes of the RFA to include banks with less than $ 100 million in assets).

A. Reasons for Proposed Rule

The proposed Guidelines implement section 501(b) of the G-L-B Act. Section 501(b) requires the OCC to publish standards for financial institutions subject to its jurisdiction relating to administrative, technical, and physical standards to: (1) Insure the security and confidentiality of customer records and information; (2) protect against any anticipated threats or hazards to the security or integrity of such records; and (3) protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.

The OCC does not expect that this rule, if adopted, would have the threshold impact on small entities. The rule would adopt guidelines that are to be implemented by each institution within the OCC's primary jurisdiction in a way that is appropriate for that institution. Thus, the burden stemming from this rule is likely to be less on small institutions. Moreover, institutions regulated by the OCC, regardless of size, likely already have in place certain policies and procedures that would satisfy at least some of the guidelines. However, the OCC invites comment on the burden that likely will result on small institutions from this rulemaking, and has prepared the following analysis.

B. Statement of Objectives and Legal Basis

The objectives of the proposed Guidelines are described in the Supplementary Information section. The legal bases for the proposed rule are 12 U.S.C. 93a, 1818, 1831p-1, and 3102(b), and 15 U.S.C. 6801 and 6805(b)(1).

C. Description of Small Entities to Which the Rule Will Apply

The proposed rule would apply to all national banks, Federal branches and Federal agencies of foreign banks, and any subsidiaries of such entities with assets under $100 million.

D. Projected Reporting, Recordkeeping and Other Compliance Requirements

The OCC does not believe that the proposed rule imposes any reporting or any specific recordkeeping requirements within the meaning of the RFA. The proposed rule requires all covered institutions to develop an information security program to safeguard customer information. An institution must assess risks to customer information, establish policies, procedures and training to control risks, test the program's effectiveness, and manage and monitor its service providers. These requirements will apply to all institutions subject to the OCC's jurisdiction, regardless of their size.

Because the information security program described in the proposed Guidelines reflects existing supervisory guidance already issued by the OCC and the FFIEC, as well as sound business practices, the OCC believes that most institutions already have such a program in place. Accordingly, the OCC believes that most covered institutions will already have the expertise to develop, implement, and maintain the program, including the skills of computer security professionals and lawyers. However, some institutions may need to formalize or enhance their information security programs. The OCC is concerned about the potential impact of the proposed Guidelines on community banks and will be reviewing current information security practices at smaller institutions. The OCC invites comment on the costs of establishing and operating an information security program.

E. Identification of Duplicative, Overlapping, or Conflicting Federal Rules

The OCC is unable to identify any statutes or rules which would overlap or conflict with the requirement to develop and implement an information security program. The OCC seeks comment and information about any such statutes or rules, as well as any other state, local, or industry rules or policies that require a covered institution to implement business practices that would comply with the requirements of the proposed rule.

F. Discussion of Significant Alternatives

The G-L-B Act requires that the Agencies issue standards to safeguard customer information. However, the G-L-B Act also states that the standards should be implemented in the same manner, to the extent practicable, as standards issued under section 39(a) of the FDI Act. Therefore, the standards have been issued as Guidelines and in a form that resembles all of the other standards prescribed by the Agencies thus far under section 39(a).

In addition, the G-L-B Act requires that standards be developed for all institutions, without exception. Therefore, the proposed Guidelines apply to institutions of all sizes, including those with assets of $100 million or less. However, the standards in the proposed Guidelines are flexible, so that each institution may develop an information security program tailored to its size and the nature of its operations. The OCC welcomes comment on any significant alternatives, consistent with the G-L-B Act, that would minimize the impact on small entities.

Board: The Regulatory Flexibility Act (5 U.S.C. 601-612) (RFA) requires an agency either to publish an initial regulatory flexibility analysis with a proposed rule or certify that the proposed rule would not have a significant economic impact on a substantial number of small entities. The Board cannot at this time determine whether the proposed Guidelines would have significant economic impact on a substantial number of small entities as defined by the RFA. Therefore, pursuant to subsections 603(b) and (c) of the RFA, the Board provides the following initial regulatory flexibility analysis.

A. Reasons for Proposed Rule

The Board is requesting comment on the proposed interagency Guidelines published pursuant to section 501 of the G-L-B Act. Section 501 requires the Agencies to publish standards for financial institutions relating to administrative, technical, and physical standards to: (1) Insure the security and confidentiality of customer records and information; (2) protect against any anticipated threats or hazards to the security or integrity of such records; and (3) protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.

B. Statement of Objectives and Legal Basis

The objectives of the proposed Guidelines are described in the Supplementary Information section above. The legal basis for the proposed Guidelines is the G-L-B Act, sections 501 and 505 (15 U.S.C. 6801 and 6805).

C. Description/Estimate of Small Entities to Which the Rule Applies

The proposed Guidelines would apply to approximately 9,500 institutions, including state member banks and certain of their subsidiaries, bank holding companies and certain of their subsidiaries, state-licensed uninsured branches and agencies of foreign banks, and Edge and agreement corporations. The Board estimates that over 4,500 of the covered institutions are small institutions with assets less than $100 million.

D. Projected Reporting, Recordkeeping and Other Compliance Requirements

The G-L-B Act and the proposed Guidelines require a covered institution to develop an information security program to safeguard customer information. The Guidelines will apply to all covered institutions regardless of size. Development of an information security program involves assessing risks to customer information, establishing policies, procedures, and training to control risks, testing the program's effectiveness, and managing and monitoring service providers. A covered institution may require professional skills to develop an information security program, including the skills of computer security professionals and lawyers.

The Board believes that the establishment of information security programs is a sound business practice for the covered institutions that is already addressed by existing supervisory procedures. Although some institutions may need to establish or enhance information security programs to comply with the proposed Guidelines, the cost of doing so is not known. Neverthless, the Board is concerned about the potential impact on community banks and will be reviewing current information security practices at smaller institutions during the comment period. The Board seeks any information or comment on the costs of establishing information security programs as detailed in the proposed Guidelines, particularly for smaller institutions. The Board welcomes comment on the appropriate level of detail and degree of flexibility in the proposed Guidelines and on the potential cost of particular provisions in the proposed Guidelines.

The Board does not believe that there are information collection requirements imposed by the proposed Guidelines.

E. Identification of Duplicative, Overlapping, or Conflicting Federal Rules

The Board is unable to identify any statutes or rules which would overlap or conflict with the requirement to develop and implement an information security program. The Board seeks comment and information about any such statutes or rules, as well as any other state, local, or industry rules or policies that require a covered institution to implement business practices that would overlap or conflict with the requirements of the proposed Guidelines.

F. Discussion of Significant Alternatives

The proposed Guidelines attempt to clarify the statutory requirements for all covered entities, including small entities. The proposed Guidelines are intended to provide substantial flexibility so that any institution, regardless of size, may adopt an information security program tailored to its individual needs. Neverthless, the Board is concerned about the potential impact on community banks and will be reviewing current information security practices at smaller institutions during the comment period. The Board seeks comment on elements that would be most useful in a Compliance Guide to be issued in conjunction with the final Guidelines. In addition, the Board welcomes comment on any significant alternatives to the proposed Guidelines that would provide adequate guidance regarding expectations for compliance with the G-L-B Act. The Board seeks any information or comment on cost-effective, sound information security programs and practices implemented by financial institutions, including community banks.

FDIC: The Regulatory Flexibility Act (5 U.S.C. 601-612) (RFA) requires an agency to publish an initial regulatory flexibility analysis with a proposed rule whenever the agency is required to publish a general notice of proposed rulemaking for a proposed rule, except to the extent provided in the RFA. Pursuant to section 603 of the RFA, the FDIC provides the following initial regulatory flexibility analysis.

A. Reasons for Proposed Rule

The FDIC is requesting comment on the proposed interagency Guidelines published pursuant to section 501 of the G-L-B Act. Section 501 requires the Agencies to publish standards for financial institutions relating to administrative, technical, and physical standards to: (1) Insure the security and confidentiality of customer records and information; (2) protect against any anticipated threats or hazards to the security or integrity of such records; and (3) protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer. The proposed standards do not represent any change in the policies of the FDIC; rather they implement the G-L-B Act requirement to provide appropriate standards relating to the security and confidentiality of customer records. The FDIC requests comment on whether small entities would be required to amend their operations in order to comply with the proposed standards and the costs for such compliance.

B. Statement of Objectives and Legal Basis

The SUPPLEMENTARY INFORMATION section above contains this information. The legal basis for the proposed rule is the G-L-B Act.

C. Description /Estimate of Small Entities to Which the Rule Applies

The proposed Guidelines would apply to all FDIC-insured state nonmember banks, approximately 3,700 of which are small entities as defined by the RFA.

D. Projected Reporting, Recordkeeping and Other Compliance Requirements

The FDIC does not believe that there are new reporting or recordkeeping requirements imposed by the proposed rule as defined by the Regulatory Flexibility Act (5 U.S.C. 603). Other compliance requirements of the proposed guidelines are applicable to all financial institutions subject to the jurisdiction of the FDIC and are discussed in the SUPPLEMENTARY INFORMATION section above. The G-L-B Act and the proposed Guidelines require all financial institutions subject to the jurisdiction of the FDIC to develop an information security program to safeguard customer information. The Guidelines will apply to all such covered institutions regardless of size. Development of an information security program involves assessing risks to customer information, establishing policies, procedures, and training to control risks, testing the program's effectiveness, and managing and monitoring service providers. A covered institution may require professional skills to develop an information security program, including the skills of computer security professionals and lawyers.

The FDIC believes that the establishment of information security programs is a sound business practice for the covered institutions that is already addressed by existing supervisory procedures. Although some institutions may need to enhance information security programs, the cost of doing so is not known. The FDIC seeks any information or comment on the costs of establishing information security programs.

E. Identification of Duplicative, Overlapping, or Conflicting Federal Rules

The FDIC is unable to identify any statutes or rules that would overlap or conflict with the requirement to develop and implement an information security program. The FDIC seeks comment and information about any such statutes or rules, as well as any other state, local, or industry rules or policies that require a financial institution subject to its jurisdiction to implement business practices that would comply with the requirements of the proposed Guidelines.

F. Discussion of Significant Alternatives

As previously noted, the G-L-B Act requires the FDIC to establish appropriate standards for financial institutions under its jurisdiction relating to the security and confidentiality of customer records. These proposed Guidelines attempt to clarify the statutory requirements for all covered entities, including small entities. These proposed Guidelines also provide substantial flexibility so that any institution, regardless of size, may adopt an information security program tailored to its individual needs. The FDIC welcomes comment on any significant alternatives, consistent with the G-L-B Act that would minimize the impact on small entities.

OTS: The Regulatory Flexibility Act (5 U.S.C. 601-612) (RFA) requires OTS to publish an initial regulatory flexibility analysis with this proposed rule unless OTS can certify that the proposed rule would not have a significant economic impact on a substantial number of small entities. Because OTS cannot at this time determine what impact this proposal would have on small entities, OTS provides the following initial regulatory flexibility analysis.

A. Reasons for Proposed Action

OTS makes this proposal pursuant to section 501 of the G-L-B Act. Section 501 requires OTS to publish standards for the thrift industry relating to administrative, technical, and physical safeguards to: (1) Insure the security and confidentiality of customer records and information; (2) protect against any anticipated threats or hazards to the security or integrity of such records; and (3) protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.

B. Objectives of and Legal Basis for Proposal

The SUPPLEMENTARY INFORMATION section above contains this information. The legal bases for the proposed action are: section 501 of the G-L-B Act; section 39 of the FDIA; and sections 2, 4, and 5 of the Home Owners' Loan Act (12 U.S.C. 1462, 1463, and 1464).

C. Description of Entities to Which Proposal Would Apply

This proposal would apply to all savings associations whose deposits are FDIC insured, and subsidiaries of such savings associations, except subsidiaries that are brokers, dealers, persons providing insurance, investment companies, and investment advisers. ^[7] There are approximately 487 such small savings associations, approximately 97 of which have subsidiaries.

D. Projected Reporting, Recordkeeping, and Other Compliance Requirements; Skills Required

The proposed rule does not contain any specific reporting requirements. However, it would require institutions to maintain certain records documenting compliance with the proposed rule, as detailed more specifically above.

The statute and the proposed rule require a covered institution to develop an information security program to safeguard customer information. Developing such a program involves assessing risks to customer information, establishing policies, procedures, and training to control risks, testing the program's effectiveness, and managing and monitoring service providers. OTS believes that establishing an information security program is a sound business practice for covered institutions. However, some institutions may need to establish or enhance information security programs. The cost of doing so is unknown. OTS seeks information and comment on the costs of establishing and operating information security programs.

Compliance with the proposed rule would require professional skills, especially skills of computer hardware and software professionals. Professional skills would be necessary to assess information security needs, design and implement an information security program, and to monitor service providers. The particular skills needed will depend on the nature of each institution's customer information systems. Institutions with sophisticated and extensive computerization would need far more skills to comply with the proposed rules than would institutions with little computerization. As a result, small entities are likely to have less burdensome compliance needs than large entities.

E. Significant Alternatives

The G-L-B Act requires OTS to establish standards for information security standards, but does not mandate the specific form that those standards must take. OTS has considered different alternatives for these standards, considering the burden on small institutions. OTS considered exempting small institutions entirely from the requirement to implement any information security standards. However, OTS does not believe that Congress has authorized OTS to exempt small institutions. Section 501(b) of the G-L-B Act requires OTS to establish standards for the institutions within OTS's jurisdiction, without regard to the institution's size.

OTS has also considered an alternative of publishing standards using language the same, or nearly the same, as that in section 501(b) of the G-L-B Act. The statutory language is broad and general. This alternative would give institutions maximum flexibility in implementing information security protections. It would also ensure that institutions would not be at a competitive disadvantage with other types of financial institutions not subject to the Agencies' information security standards. This alternative has disadvantages, however. Because the statutory language is very general, this alternative would not give institutions information about what risks need to be addressed or what types of protections are appropriate. Small institutions in particular may need guidance in this area. OTS welcomes comments on whether the proposed guidelines have too much or too little detail. How would changing the level of detail affect institutions' security practices?

OTS has proposed guidelines that would describe appropriate steps institutions must take to ensure the security of their customer information. While describing appropriate steps, OTS proposes flexible guidelines to let each institution design individual information standards appropriate for the institution's particular circumstances.

OTS is considering whether to adopt the proposed information security standards as guidance or as a regulation. OTS solicits comments on whether the regulatory burden on small entities would differ depending on the form of the standards. If so, how and to what extent?

OTS welcomes comments on the appropriateness of its approach, and on any other alternatives that would satisfy the objectives of this proposal.

F. Federal Rules That Duplicate, Overlap, or Conflict With the Proposal

OTS is unaware of any statutes or rules that would overlap or conflict with the requirement to develop and implement an information security program. OTS seeks comment and information about any such statutes or rules, as well as other rules or policies that require covered institutions to implement business practices that would comply with the proposed guidelines.

C. Executive Order 12866

OCC: The Comptroller of the Currency has determined that this proposed rule, if adopted as a final rule, does not constitute a “significant regulatory action” for the purposes of Executive Order 12866. The OCC issued the proposed Guidelines in accordance with the requirements of Sections 501 and 505(b) of the G-L-B Act and not under its own authority. The standards established by the Guidelines reflect good business practices and guidance previously issued by the OCC and the FFIEC. Accordingly, the OCC believes that most institutions already have information security programs in place.

Nevertheless, the OCC acknowledges that the proposed Guidelines may impose costs on some institutions by requiring them to formalize or enhance their existing information security programs. Therefore, the OCC invites institutions and the public to provide any cost estimates and related data that they think would be useful to the agency in evaluating the overall costs of the proposed Guidelines. The OCC will review any comments and cost data provided carefully and will revisit the cost aspects of the proposed Guidelines in developing the final rule.

OTS: OTS has determined that this proposed rule, if adopted as a final rule, would not constitute a “significant regulatory action” for the purposes of Executive Order 12866. OTS issued the proposed guidelines as required by sections 501 and 505(b) of the G-L-B Act and not under its own authority. The guidelines reflect good business practices that many institutions already follow. Further, OTS believes that any costs of complying with the guidelines would be below the thresholds prescribed in the Executive Order. Nevertheless, OTS acknowledges that the proposed guidelines may impose costs on some institutions by requiring them to formalize or enhance their existing information security programs. Therefore, OTS invites institutions and the public to provide any cost estimates and related data that they think would be useful to the agency in evaluating the overall costs of the proposed guidelines. OTS will carefully review any comments and cost data provided and will revisit the cost aspects of the proposed guidelines in developing the final rule.

D. Unfunded Mandates Act of 1995

OCC: Section 202 of the Unfunded Mandates Reform Act of 1995, 2 U.S.C. 1532 (Unfunded Mandates Act), requires that an agency prepare a budgetary impact statement before promulgating any rule likely to result in a federal mandate that may result in the expenditure by state, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more in any one year. If a budgetary impact statement is required, section 205 of the Unfunded Mandates Act also requires the agency to identify and consider a reasonable number of regulatory alternatives before promulgating the rule. However, an agency is not required to assess the effects of its regulatory actions on the private sector to the extent that such regulations incorporate requirements specifically set forth in law. 2 U.S.C. 1531.

The OCC believes that most institutions have already established an information security program because it is a sound business practice that also has been addressed in existing supervisory guidance. Therefore, the OCC has determined that this proposed rule is unlikely to result in expenditures by state, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more in any one year. Accordingly, the OCC has not prepared a budgetary impact statement or specifically addressed the regulatory alternatives considered.

OTS: Section 202 of the Unfunded Mandates Act requires that an agency prepare a budgetary impact statement before promulgating any rule likely to result in a federal mandate that may result in the expenditure by state, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more in any one year. If a budgetary impact statement is required, section 205 of the Unfunded Mandates Act also requires the agency to identify and consider a reasonable number of regulatory alternatives before promulgating the rule. However, an agency is not required to assess the effects of its regulatory actions on the private sector to the extent that such regulations incorporate requirements specifically set forth in law. 2 U.S.C. 1531.

OTS has determined that this proposed rule is unlikely to result in expenditures by state, local, and tribal governments, in the aggregate, or by the private sector, of $100 million or more in any one year. Accordingly, the OTS has not prepared a budgetary impact statement or specifically addressed the regulatory alternatives, except as described in the OTS's initial regulatory flexibility analysis earlier in this preamble.

IV. Solicitation of Comments on Use of Plain Language

Section 722 of the G-L-B Act requires the federal banking agencies to use plain language in all proposed and final rules published after January 1, 2000. We invite your comments on how to make this proposal easier to understand. For example:

• Have we organized the material to suit your needs? If not, how could this material be better organized?
• Are the requirements in the Guidelines clearly stated? If not, how could the Guidelines be more clearly stated?
• Do the Guidelines contain technical language or jargon that is not clear? If so, which language requires clarification?
• Would a different format (grouping and order of sections, use of headings, paragraphing) make the Guidelines easier to understand? If so, what changes to the format would make the Guidelines easier to understand?
• Would more, but shorter, sections be better? If so which sections should be changed?
• What else could we do to make the Guidelines easier to understand?

List of Subjects

12 CFR Part 30

• Banks, banking
• Consumer protection
• National banks
• Privacy
• Reporting and recordkeeping requirements

12 CFR Part 208

• Banks, banking
• Consumer protection
• Federal Reserve System
• Foreign banking
• Holding companies
• Information
• Privacy
• Reporting and recordkeeping requirements

12 CFR Part 211

• Exports
• Federal Reserve System
• Foreign banking
• Holding companies
• Investments
• Privacy
• Reporting and recordkeeping requirements

12 CFR Part 225

• Administrative practice and procedure
• Banks, banking
• Federal Reserve System
• Holding companies
• Privacy
• Reporting and recordkeeping requirements, securities

12 CFR Part 263

• Administrative practice and procedure
• Claims
• Crime
• Equal access in justice
• Federal Reserve System
• Lawyers
• Penalties

12 CFR Part 308

• Administrative practice and procedure
• Banks, banking
• Claims
• Crime
• Equal access of justice
• Lawyers
• Penalties
• State nonmember banks

12 CFR Part 364

• Administrative practice and procedure
• Bank deposit insurance
• Banks, banking
• Reporting and recordkeeping requirements
• Safety and soundness

12 CFR Part 568

• Reporting and recordkeeping requirements
• Savings associations
• Security measures

12 CFR Part 570

• Consumer protection
• Privacy
• Savings associations

Office of the Comptroller of the Currency

12 CFR Chapter I

Authority and Issuance

For the reasons set forth in the joint preamble, part 30 of the chapter I of title 12 of the Code of Federal Regulations is proposed to be amended as follows:

PART 30—SAFETY AND SOUNDNESS STANDARDS

1. The authority citation for part 30 is revised to read as follows:

Authority: 12 U.S.C. 93a, 1818, 1831p-1, 3102(b); 15 U.S.C. 6801, 6805(b)(1).

2. Revise § 30.1 to read as follows:

§ 30.1

Scope.

(a) This rule and the standards set forth in appendices A and B to this part apply to national banks and federal branches of foreign banks, that are subject to the provisions of section 39 of the Federal Deposit Insurance Act (section 39) (12 U.S.C. 1831p-1).

(b) The standards set forth in appendix B to this part also apply to uninsured national banks, federal branches and federal agencies of foreign banks, and the subsidiaries of any national bank, federal branch or federal agency of a foreign bank (except brokers, dealers, persons providing insurance, investment companies and investment advisers). Violation of these standards may be an unsafe and unsound practice within the meaning of 12 U.S.C. 1818.

3. In § 30.2, revise the last sentence to read as follows:

§ 30.2

Purpose.

* * * The Interagency Guidelines Establishing Standards for Safety and Soundness are set forth in appendix A to this part, and the Interagency Guidelines Establishing Standards for Safeguarding Customer Information are set forth in appendix B to this part.

4. In § 30.3, revise paragraph (a) to read as follows:

§ 30.3

Determination and notification of failure to meet safety and soundness standard.

(a) Determination. The OCC may, based upon an examination, inspection, or any other information that becomes available to the OCC, determine that a bank has failed to satisfy the safety and soundness standards contained in the Interagency Guidelines Establishing Standards for Safety and Soundness set forth in appendix A to this part, and the Interagency Guidelines Establishing Standards for Safeguarding Customer Information set forth in appendix B to this part.

* * * * *

5. Revise Appendix B to part 30 to read as follows:

Appendix B to Part 30—Interagency Guidelines Establishing Standards For Safeguarding Customer Information

Table of Contents

I. Introduction

A. Scope

B. Preservation of Existing Authority

C. Definitions

II. Standards for Safeguarding Customer Information

A. Information Security Program

B. Objectives

III. Development and Implementation of Customer Information Security Program

A. Involve the Board of Directors and Management

B. Assess Risk

C. Manage and Control Risk

D. Oversee Outsourcing Arrangements

E. Implement the Standards

I. Introduction

The Interagency Guidelines Establishing Standards for Safeguarding Customer Information (Guidelines) set forth standards pursuant to section 39 of the Federal Deposit Insurance Act (section 39, codified at 12 U.S.C. 1831p-1), and sections 501 and 505(b), codified at 15 U.S.C. 6801 and 6805(b), of the Gramm-Leach-Bliley Act. These Guidelines address standards for developing and implementing administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information.

A. Scope. The Guidelines apply to customer information maintained by or on behalf of entities over which the OCC has authority. Such entities, referred to as “the bank,” are national banks, federal branches and federal agencies of foreign banks, and any subsidiaries of such entities (except brokers, dealers, persons providing insurance, investment companies, and investment advisers).

B. Preservation of Existing Authority. Neither section 39 nor these Guidelines in any way limit the authority of the OCC to address unsafe or unsound practices, violations of law, unsafe or unsound conditions, or other practices. The OCC may take action under section 39 and these Guidelines independently of, in conjunction with, or in addition to, any other enforcement action available to the OCC.

C. Definitions. For purposes of the Guidelines, the following definitions apply:

1. In general. For purposes of the Guidelines, except as modified in the Guidelines or unless the context otherwise requires, the terms used have the same meanings as set forth in sections 3 and 39 of the Federal Deposit Insurance Act (12 U.S.C. 1813 and 1831p-1).

2. Customer information means any records, data, files, or other information containing nonpublic personal information, as defined in § 40.3(n) of this chapter, about a customer, whether in paper, electronic or other form, that are maintained by or on behalf of the bank.

3. Customer means any customer of the bank as defined in § 40.3(h) of this chapter.

4. Service provider means any person or entity that maintains or processes customer information on behalf of the bank, or is otherwise granted access to customer information through its provision of services to the bank.

5. Board of directors, in the case of a branch or agency of a foreign bank means the managing official in charge of the branch or agency.

6. Customer information systems means the electronic or physical methods used to access, collect, store, use, transmit and protect customer information.

II. Standards for Safeguarding Customer Information

A. Information Security Program. Each bank shall implement a comprehensive information security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the bank and the nature and scope of its activities.

B. Objectives. A bank's information security program shall:

1. Ensure the security and confidentiality of customer information;

2. Protect against any anticipated threats or hazards to the security or integrity of such information; and

3. Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer or risk to the safety and soundness of the bank.

III. Development and Implementation of Information Security Program

A. Involve the Board of Directors and Management.

1. The board of directors of each bank shall:

a. Approve the bank's written information security policy and program that complies with these Guidelines; and

b. Oversee efforts to develop, implement, and maintain an effective information security program.

2. The bank's management shall develop, implement, and maintain an effective information security program. In conjunction with its responsibility to implement the bank's information security program, management of each bank shall regularly:

a. Evaluate the impact on the bank's security program of changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems;

b. Document its compliance with these Guidelines; and

c. Report to the board on the overall status of the information security program, including material matters related to the following: risk assessment; risk management and control decisions; results of testing; attempted or actual security breaches or violations and responsive actions taken by management; and any recommendations for improvements in the information security program.

B. Assess Risk. To achieve the objectives of its information security program, each bank shall:

1. Identify and assess the risks that may threaten the security, confidentiality, or integrity of customer information systems. As part of the risk assessment, a bank shall determine the sensitivity of customer information and the internal or external threats to the bank's customer information systems.

2. Assess the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks.

3. Monitor, evaluate, and adjust its risk assessment in light of any relevant changes to technology, the sensitivity of customer information, and internal or external threats to information security.

C. Manage and Control Risk. As part of a comprehensive risk management plan, each bank shall:

1. Establish written policies and procedures that are adequate to control the identified risks and achieve the overall objectives of the bank's information security program. Policies and procedures shall be commensurate with the sensitivity of the information as well as the complexity and scope of the bank and its activities. In establishing the policies and procedures, each bank should consider appropriate:

a. Access rights to customer information;

b. Access controls on customer information systems, including controls to authenticate and grant access only to authorized individuals and companies;

c. Access restrictions at locations containing customer information, such as buildings, computer facilities, and records storage facilities;

d. Encryption of electronic customer information, including while in transit or in storage on networks or systems to which unauthorized individuals may have access;

e. Procedures to confirm that customer information system modifications are consistent with the bank's information security program;

f. Dual control procedures, segregation of duties, and employee background checks for employees with responsibilities for or access to customer information;

g. Contract provisions and oversight mechanisms to protect the security of customer information maintained or processed by service providers;

h. Monitoring systems and procedures to detect actual and attempted attacks on or intrusions into customer information systems;

i. Response programs that specify actions to be taken when unauthorized access to customer information systems is suspected or detected;

j. Protection against destruction of customer information due to potential physical hazards, such as fire and water damage; and

k. Response programs to preserve the integrity and security of customer information in the event of computer or other technological failure, including, where appropriate, reconstructing lost or damaged customer information.

2. Train staff to recognize, respond to, and, where appropriate, report to regulatory and law enforcement agencies, any unauthorized or fraudulent attempts to obtain customer information.

3. Regularly test the key controls, systems and procedures of the information security program to confirm that they control the risks and achieve the overall objectives of the bank's information security program. The frequency and nature of such tests should be determined by the risk assessment, and adjusted as necessary to reflect changes in internal and external conditions. Tests shall be conducted, where appropriate, by independent third parties or staff independent of those that develop or maintain the security programs. Test results shall be reviewed by independent third parties or staff independent of those that conducted the test.

4. Monitor, evaluate, and adjust, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of its customer information, and internal or external threats to information security.

D. Oversee Outsourcing Arrangements. The bank continues to be responsible for safeguarding customer information even when it gives a service provider access to that information. The bank must exercise appropriate due diligence in managing and monitoring its outsourcing arrangements to confirm that its service providers have implemented an effective information security program to protect customer information and customer information systems consistent with these Guidelines.

E. Implement the Standards. Each bank is to take appropriate steps to fully implement an information security program pursuant to these Guidelines by July 1, 2001.

Dated: June 5, 2000.

John D. Hawke, Jr.,

Comptroller of the Currency.

Federal Reserve System

12 CFR Chapter II

Authority and Issuance

For the reasons set forth in the joint preamble, parts 208, 211, 225, and 263 of chapter II of title 12 of the Code of Federal Regulations are proposed to be amended as follows:

PART 208—MEMBERSHIP OF STATE BANKING INSTITUTIONS IN THE FEDERAL RESERVE SYSTEM (REGULATION H)

1. The authority citation for 12 CFR part 208 is revised to read as follows:

Authority: 12 U.S.C. 24, 36, 92a, 93a, 248(a), 248(c), 321-338a, 371d, 461, 481-486, 601, 611, 1814, 1816, 1818, 1820(d)(9), 1823(j), 1828(o), 1831, 1831o, 1831p-1, 1831r-1, 1835a, 1882, 2901-2907, 3105, 3310, 3331-3351, and 3906-3909; 15 U.S.C. 78b, 78 l (b), 78 l (g), 78l(i), 78o-4(c)(5), 78q, 78q-1, 78w, 6801, and 6805; 31 U.S.C. 5318; 42 U.S.C. 4012a, 4104a, 4104b, 4106, and 4128.

2. Amend § 208.3 to revise paragraph (d)(1) to read as follows:

§ 208.3

Application and conditions for membership in the Federal Reserve System.

* * * * *

(d) Conditions of membership. (1) Safety and soundness. Each member bank shall at all times conduct its business and exercise its powers with due regard to safety and soundness. Each member bank shall comply with the Interagency Guidelines Establishing Standards for Safety and Soundness prescribed pursuant to section 39 of the FDI Act (12 U.S.C. 1831p-1), set forth in appendix D-1 to this part, and the Interagency Guidelines Establishing Standards for Safeguarding Customer Information prescribed pursuant to sections 501 and 505 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 and 6805), set forth in appendix D-2 to this part.

* * * * *

3. Revise appendix D-2 to read as follows:

Appendix D-2 To Part 208—Interagency Guidelines Establishing Standards For Safeguarding Customer Information

Table of Contents

I. Introduction

A. Scope

B. Preservation of Existing Authority

C. Definitions

II. Standards for Safeguarding Customer Information

A. Information Security Program

B. Objectives

III. Development and Implementation of Customer Information Security Program

A. Involve the Board of Directors and Management

B. Assess Risk

C. Manage and Control Risk

D. Oversee Outsourcing Arrangements

E. Implement the Standards

I. Introduction

These Interagency Guidelines Establishing Standards for Safeguarding Customer Information (Guidelines) set forth standards pursuant to sections 501 and 505 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 and 6805), in the same manner, to the extent practicable, as standards prescribed pursuant to section 39 of the Federal Deposit Insurance Act (12 U.S.C. 1831p-1). These Guidelines address standards for developing and implementing administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information.

A. Scope. The Guidelines apply to customer information maintained by or on behalf of state member banks (banks) and their nonbank subsidiaries, except for brokers, dealers, persons providing insurance, investment companies, and investment advisors. Pursuant to §§ 211.9 and 211.24 of this chapter, these guidelines also apply to customer information maintained by or on behalf of Edge corporations, agreement corporations, and uninsured state-licensed branches or agencies of a foreign bank.

B. Preservation of Existing Authority. Neither section 39 nor these Guidelines in any way limit the authority of the Board to address unsafe or unsound practices, violations of law, unsafe or unsound conditions, or other practices. The Board may take action under section 39 and these Guidelines independently of, in conjunction with, or in addition to, any other enforcement action available to the Board.

C. Definitions. For purposes of the Guidelines, the following definitions apply:

1. In general. For purposes of the Guidelines, except as modified in the Guidelines or unless the context otherwise requires, the terms used have the same meanings as set forth in sections 3 and 39 of the Federal Deposit Insurance Act (12 U.S.C. 1813 and 1831p-1).

2. Customer information means any records, data, files, or other information containing nonpublic personal information, as defined in § 216.3(n) of this chapter, about a customer, whether in paper, electronic or other form, that are maintained by or on behalf of the bank.

3. Customer means any customer of the bank as defined in § 216.3(h) of this chapter.

4. Service provider means any person or entity that maintains or processes customer information on behalf of the bank, or is otherwise granted access to customer information through its provision of services to the bank.

5. Board of directors, in the case of a branch or agency of a foreign bank means the managing official in charge of the branch or agency.

6. Customer information systems means the electronic or physical methods used to access, collect, store, use, transmit and protect customer information.

7. Subsidiary means any company controlled by a bank, except a broker, dealer, person providing insurance, investment company, investment advisor, insured depository institution, or subsidiary of an insured depository institution.

II. Standards for Safeguarding Customer Information

A. Information Security Program. Each bank shall implement a comprehensive information security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the bank and the nature and scope of its activities. A bank also shall ensure that each of its subsidiaries is subject to a comprehensive information security program. The bank may fulfill this requirement either by including a subsidiary within the scope of the bank's comprehensive information security program or by causing the subsidiary to implement a separate comprehensive information security program in accordance with the standards and procedures in sections II and III of this appendix that apply to banks.

B. Objectives. A bank's information security program shall:

1. Ensure the security and confidentiality of customer information;

2. Protect against any anticipated threats or hazards to the security or integrity of such information; and

3. Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer or risk to the safety and soundness of the bank.

III. Development and Implementation of Information Security Program

A. Involve the Board of Directors and Management.

1. The board of directors of each bank shall:

a. Approve the bank's written information security policy and program that complies with these Guidelines; and

b. Oversee efforts to develop, implement, and maintain an effective information security program.

2. The bank's management shall develop, implement, and maintain an effective information security program. In conjunction with its responsibility to implement the bank's information security program, management of each bank shall regularly:

a. Evaluate the impact on the bank's security program of changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems;

b. Document its compliance with these Guidelines; and

c. Report to the board on the overall status of the information security program, including material matters related to: risk assessment; risk management and control decisions; results of testing; attempted or actual security breaches or violations and responsive actions taken by management; and any recommendations for improvements in the information security program.

B. Assess Risk. To achieve the objectives of its information security program, each bank shall:

1. Identify and assess the risks that may threaten the security, confidentiality, or integrity of customer information systems. As part of the risk assessment, a bank shall determine the sensitivity of customer information and the internal or external threats to the bank's customer information systems.

2. Assess the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risk.

3. Monitor, evaluate, and adjust its risk assessment in light of any relevant changes to technology, the sensitivity of customer information, and internal or external threats to information security.

C. Manage and Control Risk. As part of a comprehensive risk management plan, each bank shall:

1. Establish written policies and procedures that are adequate to control the identified risks and achieve the overall objectives of the bank's information security program. Policies and procedures shall be commensurate with the sensitivity of the information as well as the complexity and scope of the bank and its activities. In establishing the policies and procedures, each bank should consider appropriate:

a. Access rights to customer information;

b. Access controls on customer information systems, including controls to authenticate and grant access only to authorized individuals and companies;

c. Access restrictions at locations containing customer information, such as buildings, computer facilities, and records storage facilities;

d. Encryption of electronic customer information, including while in transit or in storage on networks or systems to which unauthorized individuals may have access;

e. Procedures to confirm that customer information system modifications are consistent with the bank's information security program;

f. Dual control procedures, segregation of duties, and employee background checks for employees with responsibilities for or access to customer information;

g. Contract provisions and oversight mechanisms to protect the security of customer information maintained or processed by service providers;

h. Monitoring systems and procedures to detect actual and attempted attacks on or intrusions into customer information systems;

i. Response programs that specify actions to be taken when unauthorized access to customer information systems is suspected or detected;

j. Protection against destruction of customer information due to potential physical hazards, such as fire and water damage; and

k. Response programs to preserve the integrity and security of customer information in the event of computer or other technological failure, including, where appropriate, reconstructing lost or damaged customer information.

2. Train staff to recognize, respond to, and, where appropriate, report to regulatory and law enforcement agencies, any unauthorized or fraudulent attempts to obtain customer information.

3. Regularly test the key controls, systems and procedures of the information security program to confirm that they control the risks and achieve the overall objectives of the bank's information security program. The frequency and nature of such tests should be determined by the risk assessment, and adjusted as necessary to reflect changes in internal and external conditions. Tests shall be conducted, where appropriate, by independent third parties or staff independent of those that develop or maintain the security programs. Test results shall be reviewed by independent third parties or staff independent of those that conducted the test.

4. Monitor, evaluate, and adjust, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of its customer information, and internal or external threats to information security.

D. Oversee Outsourcing Arrangements. The bank continues to be responsible for safeguarding customer information even when it gives a service provider access to that information. The bank must exercise appropriate due diligence in managing and monitoring its outsourcing arrangements to confirm that its service providers have implemented an effective information security program to protect customer information and customer information systems consistent with these Guidelines.

E. Implement the Standards. Each bank is to take appropriate steps to fully implement an information security program pursuant to these Guidelines by July 1, 2001.

PART 211—INTERNATIONAL BANKING OPERATIONS (REGULATION K)

4. The authority citation for part 211 is revised to read as follows:

Authority: 12 U.S.C. 221 et seq., 1818, 1835a, 1841 et seq., 3101 et seq., and 3901 et seq.; 15 U.S.C. 6801 and 6805.

5. Add new § 211.9 to read as follows:

§ 211.9

Protection of customer information.

An Edge or agreement corporation shall comply with the Interagency Guidelines Establishing Standards for Safeguarding Customer Information prescribed pursuant to sections 501 and 505 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 and 6805), set forth in appendix D-2 to part 208 of this chapter.

6. In § 211.24, add new paragraph (i) to read as follows:

§ 211.24

Approval of offices of foreign banks; procedures for applications; standards for approval; representative-office activities and standards for approval; preservation of existing authority; reports of crimes and suspected crimes; government securities sales practices.

* * * * *

(i) Protection of customer information. An uninsured state-licensed branch or agency of a foreign bank shall comply with the Interagency Guidelines Establishing Standards for Safeguarding Customer Information prescribed pursuant to sections 501 and 505 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 and 6805), set forth in appendix D-2 to part 208 of this chapter.

PART 225—BANK HOLDING COMPANIES AND CHANGE IN BANK CONTROL (REGULATION Y)

7. The authority citation for part 225 is revised to read as follows:

Authority: 12 U.S.C. 1817(j)(13), 1818, 1828(o), 1831i, 1831p-1, 1843(c)(8), 1844(b), 1972(1), 3106, 3108, 3310, 3331-3351, 3907, and 3909; 15 U.S.C. 6801 and 6805.

8. In § 225.1, add new paragraph (c)(16) to read as follows:

§ 225.1

Authority, purpose, and scope.

* * * * *

(c) * * *

(16) Appendix F contains the Interagency Guidelines Establishing Standards for Safeguarding Customer Information.

9. In § 225.4, add new paragraph (g) to read as follows:

§ 225.4

Corporate practices.

* * * * *

(g) Protection of nonpublic personal information. A bank holding company, including a bank holding company that is a financial holding company, shall comply with the Interagency Guidelines Establishing Standards for Safeguarding Customer Information, as set forth in appendix F of this part, prescribed pursuant to sections 501 and 505 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 and 6805).

10. Add new appendix F to read as follows:

Appendix F To Part 225—Interagency Guidelines Establishing Standards For Safeguarding Customer Information

Table of Contents

I. Introduction

A. Scope

B. Preservation of Existing Authority

C. Definitions

II. Standards for Safeguarding Customer Information

A. Information Security Program

B. Objectives

III. Development and Implementation of Customer Information Security Program

A. Involve the Board of Directors and Management

B. Assess Risk

C. Manage and Control Risk

D. Oversee Outsourcing Arrangements

E. Implement the Standards

I. Introduction

These Interagency Guidelines Establishing Standards for Safeguarding Customer Information (Guidelines) set forth standards pursuant to sections 501 and 505 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 and 6805). These Guidelines address standards for developing and implementing administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information.

A. Scope. The Guidelines apply to customer information maintained by or on behalf of bank holding companies and their nonbank subsidiaries or affiliates (except brokers, dealers, persons providing insurance, investment companies, and investment advisors), for which the Board has supervisory authority.

B. Preservation of Existing Authority. These Guidelines do not in any way limit the authority of the Board to address unsafe or unsound practices, violations of law, unsafe or unsound conditions, or other practices. The Board may take action to enforce these Guidelines independently of, in conjunction with, or in addition to, any other enforcement action available to the Board.

C. Definitions. For purposes of the Guidelines, the following definitions apply:

1. In general. For purposes of the Guidelines, except as modified in the Guidelines or unless the context otherwise requires, the terms used have the same meanings as set forth in sections 3 and 39 of the Federal Deposit Insurance Act (12 U.S.C. 1813 and 1831p-1).

2. Customer information means any records, data, files, or other information containing nonpublic personal information, as defined in § 216.3(n) of this chapter, about a customer, whether in paper, electronic or other form, that are maintained by or on behalf of the bank holding company.

3. Customer means any customer of the bank holding company as defined in § 216.3(h) of this chapter.

4. Service provider means any person or entity that maintains or processes customer information on behalf of the bank holding company, or is otherwise granted access to customer information through its provision of services to the bank holding company.

5. Board of directors, in the case of a branch or agency of a foreign bank means the managing official in charge of the branch or agency.

6. Customer information systems means the electronic or physical methods used to access, collect, store, use, transmit and protect customer information.

7. Subsidiary means any company controlled by a bank holding company, except a broker, dealer, person providing insurance, investment company, investment advisor, insured depository institution, or subsidiary of an insured depository institution.

II. Standards for Safeguarding Customer Information

A. Information Security Program. Each bank holding company shall implement a comprehensive information security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the bank holding company and the nature and scope of its activities. A bank holding company also shall ensure that each of its subsidiaries is subject to a comprehensive information security program. The bank holding company may fulfill this requirement either by including a subsidiary within the scope of the bank holding company's comprehensive information security program or by causing the subsidiary to implement a separate comprehensive information security program in accordance with the standards and procedures in sections II and III of this appendix that apply to bank holding companies.

B. Objectives. A bank holding company's information security program shall:

1. Ensure the security and confidentiality of customer information;

2. Protect against any anticipated threats or hazards to the security or integrity of such information; and

3. Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer or risk to the safety and soundness of the bank holding company.

III. Development and Implementation of Information Security Program

A. Involve the Board of Directors and Management.

1. The board of directors of each bank holding company shall:

a. Approve the bank holding company's written information security policy and program that complies with these Guidelines; and

b. Oversee efforts to develop, implement, and maintain an effective information security program.

2. The bank holding company's management shall develop, implement, and maintain an effective information security program. In conjunction with its responsibility to implement the bank holding company's information security program, management of each bank holding company shall regularly:

a. Evaluate the impact on the bank holding company's security program of changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems;

b. Document its compliance with these Guidelines; and

c. Report to the board on the overall status of the information security program, including material matters related to: risk assessment; risk management and control decisions; results of testing; attempted or actual security breaches or violations and responsive actions taken by management; and any recommendations for improvements in the information security program.

B. Assess Risk. To achieve the objectives of its information security program, each bank holding company shall:

1. Identify and assess the risks that may threaten the security, confidentiality, or integrity of customer information systems. As part of the risk assessment, a bank holding company shall determine the sensitivity of customer information and the internal or external threats to the bank holding company's customer information systems.

2. Assess the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks identified in section III.B.1 of this appendix.

3. Monitor, evaluate, and adjust its risk assessment in light of any relevant changes to technology, the sensitivity of customer information, and internal or external threats to information security.

C. Manage and Control Risk. As part of a comprehensive risk management plan, each bank holding company shall:

1. Establish written policies and procedures that are adequate to control the identified risks and achieve the overall objectives of the bank holding company's information security program. Policies and procedures shall be commensurate with the sensitivity of the information as well as the complexity and scope of the bank holding company and its activities. In establishing the policies and procedures, each bank holding company should consider appropriate:

a. Access rights to customer information;

b. Access controls on customer information systems, including controls to authenticate and grant access only to authorized individuals and companies;

c. Access restrictions at locations containing customer information, such as buildings, computer facilities, and records storage facilities;

d. Encryption of electronic customer information, including while in transit or in storage on networks or systems to which unauthorized individuals may have access;

e. Procedures to confirm that customer information system modifications are consistent with the bank holding company's information security program;

f. Dual control procedures, segregation of duties, and employee background checks for employees with responsibilities for or access to customer information;

g. Contract provisions and oversight mechanisms to protect the security of customer information maintained or processed by service providers;

h. Monitoring systems and procedures to detect actual and attempted attacks on or intrusions into customer information systems;

i. Response programs that specify actions to be taken when unauthorized access to customer information systems is suspected or detected;

j. Protection against destruction of customer information due to potential physical hazards, such as fire and water damage; and

k. Response programs to preserve the integrity and security of customer information in the event of computer or other technological failure, including, where appropriate, reconstructing lost or damaged customer information.

2. Train staff to recognize, respond to, and, where appropriate, report to regulatory and law enforcement agencies, any unauthorized or fraudulent attempts to obtain customer information.

3. Regularly test the key controls, systems and procedures of the information security program to confirm that they control the risks and achieve the overall objectives of the bank holding company's information security program. The frequency and nature of such tests should be determined by the risk assessment, and adjusted as necessary to reflect changes in internal and external conditions. Tests shall be conducted, where appropriate, by independent third parties or staff independent of those that develop or maintain the security programs. Test results shall be reviewed by independent third parties or staff independent of those that conducted the test.

4. Monitor, evaluate, and adjust, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of its customer information, and internal or external threats to information security.

D. Oversee Outsourcing Arrangements. The bank holding company continues to be responsible for safeguarding customer information even when it gives a service provider access to that information. The bank holding company must exercise appropriate due diligence in managing and monitoring its outsourcing arrangements to confirm that its service providers have implemented an effective information security program to protect customer information and customer information systems consistent with these Guidelines.

E. Implement the Standards. Each bank holding company is to take appropriate steps to fully implement an information security program pursuant to these Guidelines by July 1, 2001.

PART 263—RULES OF PRACTICE FOR HEARINGS

11. The authority citation for part 263 is revised to read as follows:

Authority: 5 U.S.C. 504; 12 U.S.C. 248, 324, 504, 505, 1817(j), 1818, 1828(c), 1831o, 1831p-1, 1847(b), 1847(d), 1884(b), 1972(2)(F), 3105, 3107, 3108, 3907, 3909; 15 U.S.C. 21, 78o-4, 78o-5, 78u-2, 6801, 6805; and 28 U.S.C. 2461 note.

12. Amend § 263.302 to revise paragraph (a) to read as follows:

§ 263.302

Determination and notification of failure to meet safety and soundness standard and request for compliance plan.

(a) Determination. The Board may, based upon an examination, inspection, or any other information that becomes available to the Board, determine that a bank has failed to satisfy the safety and soundness standards contained in the Interagency Guidelines Establishing Standards for Safety and Soundness or the Interagency Guidelines Establishing Standards for Safeguarding Customer Information, set forth in appendices D-1 and D-2 to part 208 of this chapter, respectively.

* * * * *

By order of the Board of Governors of the Federal Reserve System, June 13, 2000.

Jennifer J. Johnson,

Secretary of the Board.

Federal Deposit Insurance Corporation

12 CFR Chapter III

Authority and Issuance

For the reasons set forth in the joint preamble, parts 308 and 364 of chapter III of title 12 of the Code of Federal Regulation are proposed to be amended as follows:

PART 308—RULES OF PRACTICE AND PROCEDURE

1. The authority citation for part 308 continues to read as follows:

Authority: 5 U.S.C. 504, 554-557; 12 U.S.C. 93(b), 164, 505, 1815(e), 1817, 1818, 1820, 1828, 1829, 1829b, 1831i, 1831o, 1831p-1, 1832(c), 1884(b), 1972, 3102, 3108(a), 3349, 3909, 4717; 15 U.S.C. 78(h) and (i), 78o-4(c), 78o-5, 78q-1, 78s, 78u, 78u-2, 78u-3 and 78w; 28 U.S.C. 2461 note; 31 U.S.C. 330, 5321; 42 U.S.C. 4012a; sec. 31001(s), Pub. L. 104-134, 110 Stat. 1321-358.

1. Amend § 308.302 to revise paragraph (a) to read as follows:

§ 308.302

Determination and notification of failure to meet a safety and soundness standard and request for compliance plan.

(a) Determination. The FDIC may, based upon an examination, inspection, or any other information that becomes available to the FDIC, determine that a bank has failed to satisfy the safety and soundness standards set out in part 364 of this chapter and in the Interagency Guidelines Establishing Standards for Safety and Soundness in appendix A and the Interagency Guidelines Establishing Standards for Safeguarding Customer Information in appendix B to part 364 of this chapter.

* * * * *

PART 364—STANDARDS FOR SAFETY AND SOUNDNESS

2. The authority citation for part 364 is revised to read as follows:

Authority: 12 U.S.C. 1818 (Tenth), 1831p-1; 15 U.S.C. 6801(b), 6805(b)(1).

3. Amend § 364.101 to revise paragraph (b) to read as follows:

§ 364.101

Standards for safety and soundness.

* * * * *

(b) Interagency Guidelines Establishing Standards for Safeguarding Customer Information. The Interagency Guidelines Establishing Standards for Safeguarding Customer Information prescribed pursuant to section 39 of the Federal Deposit Insurance Act (12 U.S.C. 1831p-1) and sections 501 and 505(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801, 6805(b)), as set forth in appendix B to this part, apply to all insured state nonmember banks, insured state licensed branches of foreign banks, and any subsidiaries of such entities (except brokers, dealers, persons providing insurance, investment companies, and investment advisers).

4. Revise Appendix B to Part 364 to read as follows:

Appendix B to Part 364—Interagency Guidelines Establishing Standards for Safeguarding Customer Information

Table of Contents

I. Introduction

A. Scope

B. Preservation of Existing Authority

C. Definitions

II. Standards for Safeguarding Customer Information

A. Information Security Program

B. Objectives

III. Development and Implementation of Customer Information Security Program

A. Involve the Board of Directors and Management

B. Assess Risk

C. Manage and Control Risk

D. Oversee Outsourcing Arrangements

E. Implement the Standards

I. Introduction

The Interagency Guidelines Establishing Standards for Safeguarding Customer Information (Guidelines) set forth standards pursuant to section 39 of the Federal Deposit Insurance Act (section 39, codified at 12 U.S.C. 1831p-1), and sections 501 and 505(b), codified at 15 U.S.C. 6801 and 6805(b), of the Gramm-Leach-Bliley Act. These Guidelines address standards for developing and implementing administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information.

A. Scope. The Guidelines apply to customer information maintained by or on behalf of entities for which the Federal Deposit Insurance Corporation (FDIC) has authority. Such entities are referred to in this appendix as “the bank.” These are banks insured by the FDIC (other than members of the Federal Reserve System), insured state branches of foreign banks, and any subsidiaries of such entities (except brokers, dealers, persons providing insurance, investment companies, and investment advisers).

B. Preservation of Existing Authority. Neither section 39 nor these Guidelines in any way limit the authority of the FDIC to address unsafe or unsound practices, violations of law, unsafe or unsound conditions, or other practices. The FDIC may take action under section 39 and these Guidelines independently of, in conjunction with, or in addition to, any other enforcement action available to the FDIC.

C. Definitions. For purposes of the Guidelines, the following definitions apply:

1. In general. For purposes of the Guidelines, except as modified in the Guidelines or unless the context otherwise requires, the terms used have the same meanings as set forth in sections 3 and 39 of the Federal Deposit Insurance Act (12 U.S.C. 1813 and 1831p-1).

2. Customer information means any records, data, files, or other information containing nonpublic personal information, as defined in § 332.3(n) of this chapter (the Privacy Rule), about a customer, whether in paper, electronic or other form, that are maintained by or on behalf of the bank.

3. Customer means any customer of the bank as defined in § 332.3(h) of this chapter.

4. Service provider means any person or entity that maintains or processes customer information on behalf of the bank, or is otherwise granted access to customer information through its provision of services to the bank.

5. Board of directors, in the case of a branch or agency of a foreign bank means the managing official in charge of the branch or agency.

6. Customer information systems means the electronic or physical methods used to access, collect, store, use, transmit and protect customer information.

II. Standards for Safeguarding Customer Information

A. Information Security Program. Each bank shall implement a comprehensive information security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the bank and the nature and scope of its activities.

B. Objectives. A bank's information security program shall:

1. Ensure the security and confidentiality of customer information;

2. Protect against any anticipated threats or hazards to the security or integrity of such information; and

3. Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer or risk to the safety and soundness of the bank.

III. Development and Implementation of Information Security Program

A. Involve the Board of Directors and Management.

1. The board of directors of each bank shall:

a. Approve the bank's written information security policy and program that complies with these Guidelines; and

b. Oversee efforts to develop, implement, and maintain an effective information security program.

2. The bank's management shall develop, implement, and maintain an effective information security program. In conjunction with its responsibility to implement the bank's information security program, management of each bank shall regularly:

a. Evaluate the impact on the bank's security program of changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems;

b. Document its compliance with these Guidelines; and

c. Report to the board on the overall status of the information security program, including material matters related to: risk assessment; risk management and control decisions; results of testing; attempted or actual security breaches or violations and responsive actions taken by management; and any recommendations for improvements in the information security program.

B. Assess Risk. To achieve the objectives of its information security program, each bank shall:

1. Identify and assess the risks that may threaten the security, confidentiality, or integrity of customer information systems. As part of the risk assessment, a bank shall determine the sensitivity of customer information and the internal or external threats to the bank's customer information systems.

2. Assess the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks.

3. Monitor, evaluate, and adjust its risk assessment in light of any relevant changes to technology, the sensitivity of customer information, and internal or external threats to information security.

C. Manage and Control Risk. As part of a comprehensive risk management plan, each bank shall:

1. Establish written policies and procedures that are adequate to control the identified risks and achieve the overall objectives of the bank's information security program. Policies and procedures shall be commensurate with the sensitivity of the information as well as the complexity and scope of the bank and its activities. In establishing the policies and procedures, each bank should consider appropriate:

a. Access rights to customer information;

b. Access controls on customer information systems, including controls to authenticate and grant access only to authorized individuals and companies;

c. Access restrictions at locations containing customer information, such as buildings, computer facilities, and records storage facilities;

d. Encryption of electronic customer information, including while in transit or in storage on networks or systems to which unauthorized individuals may have access;

e. Procedures to confirm that customer information system modifications are consistent with the bank's information security program;

f. Dual control procedures, segregation of duties, and employee background checks for employees with responsibilities for or access to customer information;

g. Contract provisions and oversight mechanisms to protect the security of customer information maintained or processed by service providers;

h. Monitoring systems and procedures to detect actual and attempted attacks on or intrusions into customer information systems;

i. Response programs that specify actions to be taken when unauthorized access to customer information systems is suspected or detected;

j. Protection against destruction of customer information due to potential physical hazards, such as fire and water damage; and

k. Response programs to preserve the integrity and security of customer information in the event of computer or other technological failure, including, where appropriate, reconstructing lost or damaged customer information.

2. Train staff to recognize, respond to, and, where appropriate, report to regulatory and law enforcement agencies, any unauthorized or fraudulent attempts to obtain customer information.

3. Regularly test the key controls, systems and procedures of the information security program to confirm that they control the risks and achieve the overall objectives of your information security program. The frequency and nature of such tests should be determined by the risk assessment, and adjusted as necessary to reflect changes in internal and external conditions. Tests shall be conducted, where appropriate, by independent third parties or staff independent of those that develop or maintain the security programs. Test results shall be reviewed by independent third parties or staff independent of those that conducted the test.

4. Monitor, evaluate, and adjust, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of its customer information, and internal or external threats to information security.

D. Oversee Outsourcing Arrangements. The bank continues to be responsible for safeguarding customer information even when it gives a service provider access to that information. The bank must exercise appropriate due diligence in managing and monitoring your outsourcing arrangements to confirm that your service providers have implemented an effective information security program to protect customer information and customer information systems consistent with these Guidelines.

E. Implement the Standards. Each bank is to take appropriate steps to fully implement an information security program pursuant to these Guidelines by July 1, 2001.

By order of the Board of Directors.

Dated at Washington, D.C., this 6th day of June, 2000.

Federal Deposit Insurance Corporation.

Robert E. Feldman,

Executive Secretary.

Office of Thrift Supervision

12 CFR Chapter V

Authority and Issuance

For the reasons set forth in the joint preamble, parts 568 and 570 of chapter V of title 12 of the Code of Federal regulations are proposed to be amended as follows:

PART 568—SECURITY PROCEDURES

1. The authority citation for part 568 is revised to read as follows:

Authority: Secs. 2-5, 82 Stat. 294-295 (12 U.S.C. 1881-1984); 12 U.S.C. 1831p-1; 15 U.S.C. 6801, 6805(b)(1). 2. Amend § 568.1 to revise paragraph (a) to read as follows:

§ 568.1

Authority, purpose, and scope.

(a) This part is issued by the Office of Thrift Supervision (“OTS”) pursuant to section 3 of the Bank Protection Act of 1968 (12 U.S.C. 1882), and sections 501 and 505(b)(1) of the Gramm-Leach-Bliley Act (12 U.S.C. 6801, 6805(b)(1). This part is applicable to savings associations. It requires each savings association to adopt appropriate security procedures to discourage robberies, burglaries, and larcenies and to assist in the identification and prosecution of persons who commit such acts. Section 568.5 of this part is applicable to savings associations and their subsidiaries (except brokers, dealers, persons providing insurance, investment companies, and investment advisers). Section 568.5 of this part requires covered institutions to establish and implement appropriate administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information.

* * * * *

3. Add § 568.5 to read as follows:

§ 568.5

Protection of customer information.

Savings associations and their subsidiaries (except brokers, dealers, persons providing insurance, investment companies, and investment advisers) must comply with the Interagency Guidelines Establishing Standards for Safeguarding Customer Information prescribed pursuant to sections 501 and 505 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 and 6805), set forth in appendix B to part 570 of this chapter.

PART 570—SUBMISSION AND REVIEW OF SAFETY AND SOUNDNESS COMPLIANCE PLANS AND ISSUANCE OF ORDERS TO CORRECT SAFETY AND SOUNDNESS DEFICIENCIES

4. Amend § 570.1 to add a sentence to the end of paragraph (a) and revise the last sentence of paragraph (b) to read as follows:

§ 570.1

Authority, purpose, scope and preservation of existing authority.

(a) * * * Appendix B to this part is further issued under sections 501(b) and 505 of the Gramm-Leach-Bliley Act (Pub. L. 106-102, 113 Stat. 1338 (1999)).

(b) * * * Interagency Guidelines Establishing Standards for Safeguarding Customer Information are set forth in appendix B to this part.

5. Amend § 570.2 to revise paragraph (a) to read as follows:

§ 570.2

Determination and notification of failure to meet safety and soundness stnadards and request for compliance plan.

(a) Determination. The OTS may, based upon an examination, inspection, or any other information that becomes available to the OTS, determine that a savings association has failed to satisfy the safety and soundness standards contained in the Interagency Guidelines Establishing Standards for Safety and Soundness as set forth in appendix A to this part or the Interagency Guidelines Establishing Standards for Safeguarding Customer Information as set forth in appendix B to this part.

* * * * *

6. Revise Appendix B to Part 570 to read as follows:

Appendix B to Part 570—Interagency Guidelines Establishing Standards for Safeguarding Customer Information

Table of Contents

I. Introduction

A. Scope

B. Preservation of Existing Authority

C. Definitions

II. Standards for Safeguarding Customer Information

A. Information Security Program

B. Objectives

III. Development and Implementation of Customer Information Security Program

A. Involve the Board of Directors and Management

B. Assess Risk

C. Manage and Control Risk

D. Oversee Outsourcing Arrangements

E. Implement the Standards

I. Introduction

The Interagency Guidelines Establishing Standards for Safeguarding Customer Information (Guidelines) set forth standards pursuant to section 39 of the Federal Deposit Insurance Act (section 39, codified at 12 U.S.C. 1831p-1), and sections 501 and 505(b), codified at 15 U.S.C. 6801 and 6805(b), of the Gramm-Leach-Bliley Act. These Guidelines address standards for developing and implementing administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information.

A. Scope. The Guidelines apply to customer information maintained by or on behalf of entities for which OTS has authority. For purposes of this appendix, these entities are savings associations whose deposits are FDIC-insured and any subsidiaries of such savings associations, except brokers, dealers, persons providing insurance, investment companies, and investment advisers. This appendix refers to such entities as “you.”

B. Preservation of Existing Authority. Neither section 39 nor these Guidelines in any way limit the OTS's authority to address unsafe or unsound practices, violations of law, unsafe or unsound conditions, or other practices. OTS may take action under section 39 and these Guidelines independently of, in conjunction with, or in addition to, any other enforcement action available to OTS.

C. Definitions. For purposes of the Guidelines, the following definitions apply:

1. In general. For purposes of the Guidelines, except as modified in the Guidelines or unless the context otherwise requires, the terms used have the same meanings as set forth in sections 3 and 39 of the Federal Deposit Insurance Act (12 U.S.C. 1813 and 1831p-1).

2. Customer information means any records, data, files, or other information containing nonpublic personal information, as defined in 12 CFR 573.3(n), about a customer, whether in paper, electronic or other form, that you maintain or that are maintained on your behalf.

3. Customer means any of your customers, as defined in 12 CFR 573.3(h).

4. Service provider means any person or entity that maintains or processes customer information on your behalf, or is otherwise granted access to customer information through its provision of services to you.

5. Customer information systems means the electronic or physical methods used to access, collect, store, use, transmit and protect customer information.

II. Standards for Safeguarding Customer Information

A. Information Security Program. You shall implement a comprehensive information security program that includes administrative, technical, and physical safeguards appropriate to your size and complexity and the nature and scope of your activities.

B. Objectives. Your information security program shall:

1. Ensure the security and confidentiality of customer information;

2. Protect against any anticipated threats or hazards to the security or integrity of such information; and

3. Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer or risk to your safety and soundness.

III. Development and Implementation of Information Security Program

A. Involve the Board of Directors and Management.

1. Your board of directors shall:

a. Approve your written information security policy and program that complies with these Guidelines; and

b. Oversee efforts to develop, implement, and maintain an effective information security program.

2. Your management shall develop, implement, and maintain an effective information security program. In conjunction with its responsibility to implement your information security program, your management shall regularly:

a. Evaluate the impact on your security program of changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems;

b. Document its compliance with these Guidelines; and

c. Report to your board on the overall status of the information security program, including material matters related to; risk assessment; risk management and control decisions; results of testing; attempted or actual security breaches or violations and responsive actions taken by management; and any recommendations for improvements in the information security program.

B. Assess Risk. To achieve the objectives of its information security program, you shall:

1. Identify and assess the risks that may threaten the security, confidentiality, or integrity of customer information systems. As part of the risk assessment, you shall determine the sensitivity of customer information and the internal or external threats to your customer information systems.

2. Assess the sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risks.

3. Monitor, evaluate, and adjust your risk assessment in light of any relevant changes to technology, the sensitivity of customer information, and internal or external threats to information security.

C. Manage and Control Risk. As part of a comprehensive risk management plan, you shall:

1. Establish written policies and procedures that are adequate to control the identified risks and achieve the overall objectives of your information security program. Policies and procedures shall be commensurate with the sensitivity of the information as well as the complexity and scope of you and your activities. In establishing the policies and procedures, you should consider appropriate:

a. Access rights to customer information;

b. Access controls on customer information systems, including controls to authenticate and grant access only to authorized individuals and companies;

c. Access restrictions at locations containing customer information, such as buildings, computer facilities, and records storage facilities;

d. Encryption of electronic customer information, including while in transit or in storage on networks or systems to which unauthorized individuals may have access;

e. Procedures to confirm that customer information system modifications are consistent with your information security program;

f. Dual control procedures, segregation of duties, and employee background checks for employees with responsibilities for or access to customer information;

g. Contract provisions and oversight mechanisms to protect the security of customer information maintained or processed by service providers;

h. Monitoring systems and procedures to detect actual and attempted attacks on or intrusions into customer information systems;

i. Response programs that specify actions to be taken when unauthorized access to customer information systems is suspected or detected;

j. Protection against destruction of customer information due to potential physical hazards, such as fire and water damage; and

k. Response programs to preserve the integrity and security of customer information in the event of computer or other technological failure, including, where appropriate, reconstructing lost or damaged customer information.

2. Train staff to recognize, respond to, and, where appropriate, report to regulatory and law enforcement agencies, any unauthorized or fraudulent attempts to obtain customer information.

3. Regularly test the key controls, systems and procedures of the information security program to confirm that they control the risks and achieve the overall objectives of your information security program. The frequency and nature of such tests should be determined by the risk assessment, and adjusted as necessary to reflect changes in internal and external conditions. Tests shall be conducted, where appropriate, by independent third parties or staff independent of those that develop or maintain the security programs. Test results shall be reviewed by independent third parties or staff independent of those that conducted the test.

4. Monitor, evaluate, and adjust, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of its customer information, and internal or external threats to information security.

D. Oversee Outsourcing Arrangements. You continue to be responsible for safeguarding customer information even when you give a service provider access to that information. You must exercise appropriate due diligence in managing and monitoring your outsourcing arrangements to confirm that your service providers have implemented an effective information security program to protect customer information and customer information systems consistent with these Guidelines.

E. Implement the Standards. You are to take appropriate steps to fully implement an information security program pursuant to these Guidelines by July 1, 2001.

Dated: June 9, 2000.

By the Office of Thrift Supervision.

Ellen Seidman,

Director.

Footnotes

1.  Section 39 applies only to insured depository institutions, including insured branches of foreign banks. The Guidelines, however, will also apply to certain uninsured institutions, such as bank holding companies, certain nonbank subsidiaries of bank holding companies and insured depository institutions, and uninsured branches and agencies of foreign banks. See section 501 and 505(b) of the G-L-B Act.

2.  The OTS proposes to place its information security guidelines in Appendix B to 12 CFR part 570, with the provisions implementing section 39 of the FDI Act. At the same time, the OTS proposes a regulatory requirement that the institutions the OTS regulates comply with the proposed guidelines. Because information security guidelines are similar to physical security procedures, the OTS proposes including a provision in 12 CFR part 568, which covers primarily physical security procedures, requiring compliance with the guidelines in Appendix B to part 570.

3.  Where the Supplementary Information refers to a section of the Privacy Rule, it will preface the common section number with “_”, as each Agency has a different part number.

4.  While the OTS generally regulates savings and loan holding companies under the Home Owners Loan Act (12 U.S.C. 1461 et seq.), a different Federal functional regulator, a state insurance authority, or the Federal Trade Commission may establish standards for safeguarding customer information as to that holding company under section 505 of the G-L-B Act, depending on the nature of the holding company's activities.

5.  In addition to the definitions discussed below, the Board's guidelines in 12 CFR parts 208 and 225 contain a definition of “subsidiary,” which describes the state member bank and bank holding company subsidiaries that are subject to the Guidelines.

6.  The OTS version of the guidelines does not include this definition because the OTS does not regulate foreign institutions. Section I of the OTS guidelines has been renumbered accordingly.

7.  For purposes of the Regulatory Flexibility Act, a small savings association is one with less that $100 million in assets. 13 CFR 121.201 (Division H).