• VP of IT designates a Manager responsible for overseeing, implementing, and maintaining the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)).
• Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)).
• Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8).
• Provides for the institution to continuously monitor vulnerabilities, or conduct annual penetration tests and systemic scans and reviews of known vulnerabilities at least every six months. (16 C.F.R. 314.4(d)).
• Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)).
• Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)).
• Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)).
• Address the establishment of a written incident response plan (16 C.F.R. 314.4(h)).
• Address the requirement for its Qualified Individual to report regularly and at least annually to The President and Board of Trustees on the institution’s information security program (16 C.F.R. 314.4(i)).