Information Security Program

Gramm-Leach-Bliley Act (GLBA)Federal Deposit Insurance Corporation (FDIC)
Federal Financial Institutions Examination Council (FFIEC)
National Credit Union Administration (NCUA)
Office of Thrift Supervision (OTS)Identity Theft
Risk Management

On January 17, 2001, the banking regulatory agencies adopted guidelines implementing Section 501 of the Gramm-Leach-Bliley Act (GLBA). The guidelines require financial institutions to establish a comprehensive and coordinated information security program, appropriate to the size of the bank and the complexity of its operations.

The guidelines require financial institutions to establish an information security program to: (1) identify and assess the risks that may threaten customer information; (2) develop a written plan containing policies and procedures to manage and control these risks; (3) implement and test the plan; and (4) adjust the plan on a continuing basis to account for changes in technology, the sensitivity of customer information, and internal or external threats to information security. Each institution may implement a security program appropriate to its size and complexity and the nature and scope of its operations.

> Read entire regulation (log in required - registration is free)