# SR 01-11 (SUP): Identity Theft and Pretext Calling

> Federal · Agency guidance · In force

URL: https://www.frixlaw.com/law-library/statutes/FRB_SR0111

## Section

- **Citation:** SR 01-11 (SUP)
- **Heading:** Identity Theft and Pretext Calling
- **Jurisdiction:** Federal
- **Kind:** Agency guidance
- **Status:** In force
- **Text as of:** August 14, 2026
- **Source:** Compiled text
- **Location:** Federal Reserve SR/CA Letters / Identity Theft and Pretext Calling

## Text

DEPARTMENT OF THE TREASURY
Office of the Comptroller of the Currency
12 CFR Part 30
Docket No. 00-35
RIN 1557-AB84
FEDERAL RESERVE SYSTEM
12 CFR Parts 208, 211, 225, and 263
Docket No. R-1073
FEDERAL DEPOSIT INSURANCE CORPORATION
12 CFR Parts 308 and 364
RIN 3064-AC39
DEPARTMENT OF THE TREASURY
Office of Thrift Supervision
12 CFR Parts 568 and 570
Docket No. 2000-112
RIN 1550-AB36
Interagency Guidelines Establishing Standards for Safeguarding Customer Information and
Rescission of Year 2000 Standards for Safety and Soundness.
AGENCIES: The Office of the Comptroller of the Currency (OCC), Treasury; Board of
Governors of the Federal Reserve System (Board); Federal Deposit Insurance Corporation
(FDIC); and Office of Thrift Supervision (OTS), Treasury.
ACTION: Joint final rule.
SUMMARY: The Office of the Comptroller of the Currency, Board of Governors of the Federal
Reserve System, Federal Deposit Insurance Corporation, and Office of Thrift Supervision
(collectively, the Agencies) are publishing final Guidelines establishing standards for safeguarding
customer information that implement sections 501 and 505(b) of the Gramm-Leach-Bliley Act (the
G-L-B Act or Act).
Section 501 of the G-L-B Act requires the Agencies to establish appropriate standards for
the financial institutions subject to their respective jurisdictions relating to administrative,
technical, and physical safeguards for customer records and information. As described in the Act,
these safeguards are to: insure the security and confidentiality of customer records and
information; protect against any anticipated threats or hazards to the security or integrity of such
records; and protect against unauthorized access to or use of such records or information that could
result in substantial harm or inconvenience to any customer. The Agencies are to implement these
standards in the same manner, to the extent practicable, as standards prescribed pursuant to section
39(a) of the Federal Deposit Insurance Act (FDI Act)
hazards to the security or integrity of such
records; and protect against unauthorized access to or use of such records or information that could
result in substantial harm or inconvenience to any customer. The Agencies are to implement these
standards in the same manner, to the extent practicable, as standards prescribed pursuant to section
39(a) of the Federal Deposit Insurance Act (FDI Act). These final Guidelines implement the

requirements described above.
The Agencies previously issued guidelines establishing Year 2000 safety and soundness
standards for insured depository institutions pursuant to section 39 of the FDI Act. Since the
events for which these guidelines were issued have passed, the Agencies have concluded that the
guidelines are no longer necessary and are rescinding these guidelines.
EFFECTIVE DATE: The joint Guidelines are effective July 1, 2001. The rescission of the Year
2000 Standards for Safety and Soundness is effective [INSERT DATE 30 DAYS AFTER
PUBLICATION IN THE FEDERAL REGISTER].
FOR FURTHER INFORMATION CONTACT:
OCC:
John Carlson, Deputy Director for Bank Technology, (202) 874-5013; or Deborah Katz,
Senior Attorney, Legislative and Regulatory Activities Division, (202) 874-5090.
Board:
Heidi Richards, Assistant Director, Division of Banking Supervision and Regulation,
(202) 452-2598; Stephanie Martin, Managing Senior Counsel, Legal Division, (202) 452-3198; or
Thomas E. Scanlon, Senior Attorney, Legal Division, (202) 452-3594. For the hearing impaired
only, contact Janice Simms, Telecommunication Device for the Deaf (TDD) (202) 452-3544,
Board of Governors of the Federal Reserve System, 20th and C Streets, NW, Washington, DC
20551.
FDIC:
Thomas J. Tuzinski, Review Examiner, Division of Supervision, (202) 898-6748; Jeffrey
M. Kopchik, Senior Policy Analyst, Division of Supervision, (202) 898-3872; or Robert A.
Patrick, Counsel, Legal Division, (202) 898-3757
e Simms, Telecommunication Device for the Deaf (TDD) (202) 452-3544,
Board of Governors of the Federal Reserve System, 20th and C Streets, NW, Washington, DC
20551.
FDIC:
Thomas J. Tuzinski, Review Examiner, Division of Supervision, (202) 898-6748; Jeffrey
M. Kopchik, Senior Policy Analyst, Division of Supervision, (202) 898-3872; or Robert A.
Patrick, Counsel, Legal Division, (202) 898-3757.
OTS:
Jennifer Dickerson, Manager, Information Technology, Examination Policy, (202) 906-
5631; or Christine Harrington, Counsel, Banking and Finance, Regulations and Legislation
Division, (202) 906-7957.
SUPPLEMENTARY INFORMATION:
The contents of this preamble are listed in the following outline:
I. Background
II. Overview of Comments Received
III. Section-by-Section Analysis
IV. Regulatory Analysis
A. Paperwork Reduction Act
B. Regulatory Flexibility Act
2

C. Executive Order 12866
D. Unfunded Mandates Act of 1995
I. Background
On November 12, 1999, President Clinton signed the G-L-B Act (Pub. L. 106-102) into
law. Section 501, titled “Protection of Nonpublic Personal Information”, requires the Agencies,
the National Credit Union Administration, the Securities and Exchange Commission, and the
Federal Trade Commission to establish appropriate standards for the financial institutions subject
to their respective jurisdictions relating to the administrative, technical, and physical safeguards
for customer records and information. As stated in section 501, these safeguards are to: (1) insure
the security and confidentiality of customer records and information; (2) protect against any
anticipated threats or hazards to the security or integrity of such records; and (3) protect against
unauthorized access to or use of such records or information that would result in substantial harm
or inconvenience to any customer
mation. As stated in section 501, these safeguards are to: (1) insure
the security and confidentiality of customer records and information; (2) protect against any
anticipated threats or hazards to the security or integrity of such records; and (3) protect against
unauthorized access to or use of such records or information that would result in substantial harm
or inconvenience to any customer.
Section 505(b) of the G-L-B Act provides that these standards are to be implemented by
the Agencies in the same manner, to the extent practicable, as standards prescribed pursuant to
section 39(a) of the FDI Act.[See Footnote 1] Section 39(a) of the FDI Act authorizes the Agencies to establish
operational and managerial standards for insured depository institutions relative to, among other
things, internal controls, information systems, and internal audit systems, as well as such other
operational and managerial standards as the Agencies determine to be appropriate.[See Footnote 2]
II. Overview of Comments Received
On June 26, 2000, the Agencies published for comment the proposed Interagency
Guidelines Establishing Standards for Safeguarding Customer Information and Rescission of Year
2000 Standards for Safety and Soundness in the Federal Register (65 FR 39472). The public
comment period closed August 25, 2000. The Agencies collectively received a total of 206
Footnote 1 -- Section 39 applies only to insured depository institutions, including insured branches of
foreign banks. The Guidelines, however, will also apply to certain uninsured institutions, such as
bank holding companies, certain nonbank subsidiaries of bank holding companies and insured
depository institutions, and uninsured branches and agencies of foreign banks. See sections 501
and 505(b) of the G-L-B Act. [End of Footnote 1]
Footnote 2 -- OTS has placed its information security guidelines in appendix B to 12 CFR part 570,
with the provisions implementing section 39 of the FDI Act
s
bank holding companies, certain nonbank subsidiaries of bank holding companies and insured
depository institutions, and uninsured branches and agencies of foreign banks. See sections 501
and 505(b) of the G-L-B Act. [End of Footnote 1]
Footnote 2 -- OTS has placed its information security guidelines in appendix B to 12 CFR part 570,
with the provisions implementing section 39 of the FDI Act. At the same time, OTS has adopted a
regulatory requirement that the institutions OTS regulates comply with the proposed Guidelines.
Because information security guidelines are similar to physical security procedures, OTS has
included a provision in 12 CFR part 568, which covers primarily physical security procedures,
requiring compliance with the Guidelines in appendix B to part 570. [End of Footnote 2]
3

comments in response to the proposal, although many commenters sent copies of the same letter to
each of the Agencies. Those combined comments included 49 from banks, 7 from savings
associations, 60 from financial institution holding companies; 50 from financial institution trade
associations; 33 from other business entities; and four from state regulators. The Federal Reserve
also received comments from three Federal Reserve Banks.
The Agencies invited comment on all aspects of the proposed Guidelines, including
whether the rules should be issued as guidelines or as regulations. Commenters overwhelmingly
supported the adoption of guidelines, with many commenters offering suggestions for ways to
improve the proposed Guidelines as discussed below. Many commenters cited the benefits of
flexibility and the drawbacks of prescriptive requirements that could become rapidly outdated as a
result of changes in technology.
The Agencies also requested comments on the impact of the proposal on community banks,
recognizing that community banks operate with more limited resources than larger institutions and
may present a different risk profile
ow. Many commenters cited the benefits of
flexibility and the drawbacks of prescriptive requirements that could become rapidly outdated as a
result of changes in technology.
The Agencies also requested comments on the impact of the proposal on community banks,
recognizing that community banks operate with more limited resources than larger institutions and
may present a different risk profile. In general, community banks urged the Agencies to issue
guidelines that are not prescriptive, that do not require detailed policies or reporting by banks that
share little or no information outside the bank, and that provide flexibility in the design of an
information security program. Some community banks indicated that the Guidelines are
unnecessary because they already have information security programs in place. Others requested
clarification of the impact of the Guidelines on banks that do not share any information in the
absence of a customer’s consent.
In light of the comments received, the Agencies have decided to adopt the Guidelines, with
several changes as discussed below to respond to the commenters’ suggestions. The respective
texts of the Agencies’ Guidelines are substantively identical. In directing the Agencies to issue
standards for the protection of customer records and information, Congress provided that the
standards apply to all financial institutions, regardless of the extent to which they may disclose
information to affiliated or nonaffiliated third parties, electronically transfer data with customers
or third parties, or record data electronically. Because the requirements of the Act apply to a
broad range of financial institutions, the Agencies believe that the Guidelines must establish
appropriate standards that allow each institution the discretion to design an information security
program that suits its particular size and complexity and the nature and scope of its activities
customers
or third parties, or record data electronically. Because the requirements of the Act apply to a
broad range of financial institutions, the Agencies believe that the Guidelines must establish
appropriate standards that allow each institution the discretion to design an information security
program that suits its particular size and complexity and the nature and scope of its activities. In
many instances, financial institutions already will have information security programs that are
consistent with these Guidelines, because key components of the Guidelines were derived from
security-related supervisory guidance previously issued by the Agencies and the Federal Financial
Institutions Examination Council (FFIEC). In such situations, little or no modification to an
institution’s program will be required.
Below is a section-by-section analysis of the final Guidelines.
III. Section-by-Section Analysis
The discussion that follows applies to each Agency’s Guidelines.
4

I. Introduction
Paragraph I. of the proposal set forth the general purpose of the Guidelines, which is to
provide guidance to each financial institution in establishing and implementing administrative,
technical, and physical safeguards to protect the security, confidentiality, and integrity of customer
information. This paragraph also set forth the statutory authority for the Guidelines, including
section 39(a) of the FDI Act (12 U.S.C. 1831p-1) and sections 501 and 505(b) of the G-L-B Act
(15 U.S.C. 6801 and 6805(b) ). The Agencies received no comments on this paragraph, and have
adopted it as proposed.
I.A. Scope
Paragraph I.A. of the proposal described the scope of the Guidelines. Each Agency
defined specifically those entities within its particular scope of coverage in this paragraph of the
Guidelines.
The Agencies received no comments on the issue of which entities are covered by the
Guidelines, and have adopted paragraph I.A. as proposed.
I.B. Preservation of Existing Authority
Paragraph I.B
ope
Paragraph I.A. of the proposal described the scope of the Guidelines. Each Agency
defined specifically those entities within its particular scope of coverage in this paragraph of the
Guidelines.
The Agencies received no comments on the issue of which entities are covered by the
Guidelines, and have adopted paragraph I.A. as proposed.
I.B. Preservation of Existing Authority
Paragraph I.B. of the proposal made clear that in issuing these Guidelines none of the
Agencies is, in any way, limiting its authority to address any unsafe or unsound practice, violation
of law, unsafe or unsound condition, or other practice, including any condition or practice related
to safeguarding customer information. As noted in the preamble to the proposal, any action taken
by any Agency under section 39(a) of the FDI Act and these Guidelines may be taken
independently of, in conjunction with, or in addition to any other enforcement action available to
the Agency. The Agencies received no comments on this paragraph, and have adopted paragraph
I.B. as proposed.
I.C.1. Definitions
Paragraph I.C. set forth the definitions of various terms for purposes of the Guidelines.[See Footnote 3] It
also stated that terms used in the Guidelines have the same meanings as set forth in sections 3 and
39 of the FDI Act (12 U.S.C. 1813 and 1831p-1).
The Agencies received several comments on the proposed definitions, and have made
certain changes as discussed below. The Agencies also have reordered proposed paragraph I.C.
so that the statement concerning the reliance on sections 3 and 39(a) of the FDI Act is now in
paragraph I.C.1., with the definitions appearing in paragraphs I.C.2.a.-e. The defined terms have
been placed in alphabetical order in the final Guidelines
comments on the proposed definitions, and have made
certain changes as discussed below. The Agencies also have reordered proposed paragraph I.C.
so that the statement concerning the reliance on sections 3 and 39(a) of the FDI Act is now in
paragraph I.C.1., with the definitions appearing in paragraphs I.C.2.a.-e. The defined terms have
been placed in alphabetical order in the final Guidelines.
Footnote 3 -- In addition to the definitions discussed below, the Board’s Guidelines in 12 CFR parts
208 and 225 contain a definition of “subsidiary”, which describes the state member bank and bank
holding company subsidiaries that are subject to the Guidelines. [End of Footnote 3]
5

I.C.2.a. Board of directors
The proposal defined “board of directors” to mean, in the case of a branch or agency of a
foreign bank, the managing official in charge of the branch or agency.[See Footnote 4] The Agencies received no
comments on this proposed definition, and have adopted it without change.
I.C.2.b. Customer
The proposal defined “customer” in the same way as that term is defined in section __.3(h)
of the Agencies’ rule captioned “Privacy of Consumer Financial Information” (Privacy Rule).[See Footnote 5]
The Agencies proposed to use this definition in the Guidelines because section 501(b) refers to
safeguarding the security and confidentiality of “customer” information. Given that Congress used
the same term for both the 501(b) standards and for the sections concerning financial privacy, the
Agencies have concluded that it is appropriate to use the same definition in the Guidelines that was
adopted in the Privacy Rule.
Under the Privacy Rule, a customer is a consumer who has established a continuing
relationship with an institution under which the institution provides one or more financial products
or services to the consumer to be used primarily for personal, family or household purposes
have concluded that it is appropriate to use the same definition in the Guidelines that was
adopted in the Privacy Rule.
Under the Privacy Rule, a customer is a consumer who has established a continuing
relationship with an institution under which the institution provides one or more financial products
or services to the consumer to be used primarily for personal, family or household purposes.
“Customer” does not include a business, nor does it include a consumer who has not established an
ongoing relationship with a financial institution (e.g., an individual who merely uses an
institution’s ATM or applies for a loan). See sections __.3(h) and (i) of the Privacy Rule. The
Agencies solicited comment on whether the definition of “customer” should be broadened to
provide a common information security program for all types of records under the control of a
financial institution.
The Agencies received many comments on this definition, almost all of which agreed with
the proposed definition. Although a few commenters indicated they would apply the same security
program to both business and consumer records, the vast majority of commenters supported the use
of the same definition of “customer” in the Guidelines as is used in the Privacy Rule. They
observed that the use of the term “customer” in section 501 of the G-L-B Act, when read in the
context of the definitions of “consumer” and “customer relationship” in section 509, reflects the
Congressional intent to distinguish between certain kinds of consumers for the information security
standards and the other privacy provisions established under subtitle A of Title V.
Footnote 4 -- The OTS version of the Guidelines does not include this definition because OTS does
not regulate foreign institutions. Paragraph I of the OTS Guidelines has been renumbered
accordingly. [End of Footnote 4]
Footnote 5 -- See 65 FR 35162 (June 1, 2000)
inds of consumers for the information security
standards and the other privacy provisions established under subtitle A of Title V.
Footnote 4 -- The OTS version of the Guidelines does not include this definition because OTS does
not regulate foreign institutions. Paragraph I of the OTS Guidelines has been renumbered
accordingly. [End of Footnote 4]
Footnote 5 -- See 65 FR 35162 (June 1, 2000). Citations to the interagency Privacy Rule in this
preamble are to sections only, leaving blank the citations to the part numbers used by each agency. [End of Footnote 5
6

The Agencies have concluded that the definition of “customer” used in the Guidelines
should be consistent with the definition established in section __.3(h) of the Privacy Rule. The
Agencies believe, therefore, that the most reasonable interpretation of the applicable provisions of
subtitle A of Title V of the Act is that a financial institution is obligated to protect the security and
confidentiality of the nonpublic personal information of its consumers with whom it has a customer
relationship. As a practical manner, a financial institution may also design or implement its
information security program in a manner that encompasses the records and information of its other
consumers and its business clients.[See Footnote 6]
I.C.2.c. Customer information
The proposal defined “customer information” as any records containing nonpublic personal
information, as defined in section __.3(n) of the Privacy Rule, about a customer. This included
records, data, files, or other information in paper, electronic, or other form that are maintained by
any service provider on behalf of an institution. Although section 501(b) of the G-L-B Act refers
to the protection of both customer “records” and “information”, for the sake of simplicity, the
proposed Guidelines used the term “customer information” to encompass both information and
records.
The Agencies received several comments on this definition
ronic, or other form that are maintained by
any service provider on behalf of an institution. Although section 501(b) of the G-L-B Act refers
to the protection of both customer “records” and “information”, for the sake of simplicity, the
proposed Guidelines used the term “customer information” to encompass both information and
records.
The Agencies received several comments on this definition. The commenters suggested
that the proposed definition was too broad because it included files “containing” nonpublic
personal information. The Agencies believe, however, that a financial institution’s security
program must apply to files that contain nonpublic personal information in order to adequately
protect the customer’s information. In deciding what level of protection is appropriate, a financial
institution may consider the fact that a given file contains very little nonpublic personal
information, but that fact would not render the file entirely beyond the scope of the Guidelines.
Accordingly, the Agencies have adopted a definition of “customer record” that is substantively the
Footnote 6 -- The Agencies recognize that “customer” is defined more broadly under Subtitle B of
Title V of the Act, which, in general, makes it unlawful for any person to obtain or attempt to
obtain customer information of a financial institution by making false, fictitious, or fraudulent
statements. For the purposes of that subtitle, the term “customer” means “any person (or
authorized representative of a person) to whom the financial institution provides a product or
service, including that of acting as a fiduciary.” (See section 527(1) of the Act.) In light of the
statutory mandate to “prescribe such revisions to such regulations and guidelines as may be
necessary to ensure that such financial institutions have policies, procedures, and controls in place
to prevent the unauthorized disclosure of customer financial information” (section 525), the
Agencies considered modifying these Guidelines to cover other customers,
527(1) of the Act.) In light of the
statutory mandate to “prescribe such revisions to such regulations and guidelines as may be
necessary to ensure that such financial institutions have policies, procedures, and controls in place
to prevent the unauthorized disclosure of customer financial information” (section 525), the
Agencies considered modifying these Guidelines to cover other customers, namely, business
entities and individuals who obtain financial products and services for purposes other than
personal, family, or household purposes. The Agencies have concluded, however, that defining
“customer” to accommodate the range of objectives set forth in Title V of the Act is unnecessary.
Instead, the Agencies have included a new paragraph III.C.1.a, described below, and plan to issue
guidance and other revisions to the applicable regulations, as may be necessary, to satisfy the
requirements of section 525 of the Act. [End of Footnote 6]
7

same as the proposed definition. The Agencies have, however, deleted the reference to “data,
files, or other information” from the final Guidelines, since each is included in the term “records”
and also is covered by the reference to “paper, electronic, or other form”.
I.C.2.d. Customer information system
The proposal defined “customer information system” to be electronic or physical methods
used to access, collect, store, use, transmit, or protect customer information. The Agencies
received a few comments on this definition, mostly from commenters who stated that it is too
broad. The Agencies believe that the definition needs to be sufficiently broad to protect all
customer information, wherever the information is located within a financial institution and
however it is used
ods
used to access, collect, store, use, transmit, or protect customer information. The Agencies
received a few comments on this definition, mostly from commenters who stated that it is too
broad. The Agencies believe that the definition needs to be sufficiently broad to protect all
customer information, wherever the information is located within a financial institution and
however it is used. Nevertheless, the broad scope of the definition of “customer information
system” should not result in an undue burden because, in other important respects, the Guidelines
allow a high degree of flexibility for each institution to design a security program that suits its
circumstances.
For these reasons, the Agencies have adopted the definition of “customer information
system” largely as proposed. However, the phrase “electronic or physical” in the proposal has
been deleted because each is included in the term “any methods”. The Agencies also have added a
specific reference to records disposal in the definition of “customer information system.” This is
consistent with the proposal’s inclusion of access controls in the list of items a financial institution
is to consider when establishing security policies and procedures (see discussion of paragraph
III.C.1.a., below), given that inadequate disposal of records may result in identity theft or other
misuse of customer information. Under the final Guidelines, a financial institution’s responsibility
to safeguard customer information continues through the disposal process.
I.C.2.e. Service provider
The proposal defined a “service provider” as any person or entity that maintains or
processes customer information for a financial institution, or is otherwise granted access to
customer information through its provision of services to an institution. One commenter urged the
Agencies to modify this definition so that it would not include a financial institution’s attorneys,
accountants, and appraisers
osal defined a “service provider” as any person or entity that maintains or
processes customer information for a financial institution, or is otherwise granted access to
customer information through its provision of services to an institution. One commenter urged the
Agencies to modify this definition so that it would not include a financial institution’s attorneys,
accountants, and appraisers. Others suggested deleting the phrase “or is otherwise granted access
to customer information through its provision of services to an institution”.
The Agencies believe that the Act requires each financial institution to adopt a
comprehensive information security program that is designed to protect against unauthorized
access to or use of customers’ nonpublic personal information. Disclosing information to a person
or entity that provides services to a financial institution creates additional risks to the security and
confidentiality of the information disclosed. In order to protect against these risks, a financial
institution must take appropriate steps to protect information that it provides to a service provider,
regardless of who the service provider is or how the service provider obtains access. The fact
that an entity obtains access to customer information through, for instance, providing professional
services does not obviate the need for the financial institution to take appropriate steps to protect
the information. Accordingly, the Agencies have determined that, in general, the term “service
8
regardless of who the service provider is or how the service provider obtains access. The fact
that an entity obtains access to customer information through, for instance, providing professional
services does not obviate the need for the financial institution to take appropriate steps to protect
the information. Accordingly, the Agencies have determined that, in general, the term “service
8

provider” should be broadly defined to encompass a variety of individuals or companies that
provide services to the institution.
This does not mean, however, that a financial institution’s methods for overseeing its
service provider arrangements will be the same for every provider. As explained in the
discussion of paragraph III.D., a financial institution’s oversight responsibilities will be shaped by
the institution’s analysis of the risks posed by a given service provider. If a service provider is
subject to a code of conduct that imposes a duty to protect customer information consistent with the
objectives of these Guidelines, a financial institution may take that duty into account when deciding
what level of oversight it should provide.
Moreover, a financial institution will be responsible under the final Guidelines for
overseeing its service provider arrangements only when the service is provided directly to the
financial institution. The Agencies clarified this point by amending the definition of “service
provider” in the final Guidelines to state that it applies only to a person or entity that maintains,
processes, or otherwise is permitted access to customer information through its provision of
services directly to the financial institution. Thus, for instance, a payment intermediary involved
in the collection of a check but that has no correspondent relationship with a financial institution
would not be considered a service provider of that financial institution under this rule. By
contrast, a financial institution’s correspondent bank would be considered its service provider
ion of
services directly to the financial institution. Thus, for instance, a payment intermediary involved
in the collection of a check but that has no correspondent relationship with a financial institution
would not be considered a service provider of that financial institution under this rule. By
contrast, a financial institution’s correspondent bank would be considered its service provider.
Nevertheless, the financial institution may take into account the fact that the correspondent bank is
itself a financial institution that is subject to security standards under section 501(b) when it
determines the appropriate level of oversight for that service provider.[See Footnote 7]
In situations where a service provider hires a subservicer,[See Footnote 8] the subservicer would not be a
“service provider” under the final Guidelines. The Agencies recognize that it would be
inappropriate to impose obligations on a financial institution to select and monitor subservicers in
situations where the financial institution has no contractual relationship with that person or entity.
When conducting due diligence in selecting its service providers (see discussion of paragraph
III.D., below), however, a financial institution must determine that the service provider has
adequate controls to ensure that the subservicer will protect the customer information in a way that
meets the objectives of these Guidelines.
II. Standards for Safeguarding Customer Information
Footnote 7 -- Similarly, in the case of a service provider that is not subject to these Guidelines but is
subject to standards adopted by its primary regulator under section 501(b) of the G-L-B Act, a
financial institution may take that fact into consideration when deciding what level of oversight is
appropriate for that service provider
es.
II. Standards for Safeguarding Customer Information
Footnote 7 -- Similarly, in the case of a service provider that is not subject to these Guidelines but is
subject to standards adopted by its primary regulator under section 501(b) of the G-L-B Act, a
financial institution may take that fact into consideration when deciding what level of oversight is
appropriate for that service provider. [End of Footnote 7]
Footnote 8 -- The term “subservicer” means any person who has access to an institution’s customer
information through its provision of services to the service provider and is not limited to mortgage
subservicers. [End of Footnote 8]
9

II.A. Information Security Program
The proposed Guidelines described the Agencies’ expectations for the creation,
implementation, and maintenance of a comprehensive information security program. As noted in
the proposal, this program must include administrative, technical, and physical safeguards
appropriate to the size and complexity of the institution and the nature and scope of its activities.
Several commenters representing large and complex organizations were concerned that the
term “comprehensive information security program” required a single and uniform document that
must apply to all component parts of the organization. In response, the Agencies note that a
program that includes administrative, technical, and physical safeguards will, in many instances,
be composed of more than one document. Moreover, use of this term does not require that all
parts of an organization implement a uniform program. However, the Agencies will expect an
institution to coordinate all the elements of its information security program. Where the elements
of the program are dispersed throughout the institution, management should be aware of these
elements and their locations
osed of more than one document. Moreover, use of this term does not require that all
parts of an organization implement a uniform program. However, the Agencies will expect an
institution to coordinate all the elements of its information security program. Where the elements
of the program are dispersed throughout the institution, management should be aware of these
elements and their locations. If they are not maintained on a consolidated basis, management
should have an ability to retrieve the current documents from those responsible for the overall
coordination and ongoing evaluation of the program.
The Board received comment on its proposal to revise the appendix to Regulation Y
regarding the provision that would require a bank holding company to ensure that each of its
subsidiaries is subject to a comprehensive information security program.[See Footnote 9] This comment urged the
Board to eliminate that provision and argued, in part, that the requirement assumes that a bank
holding company has the power to impose such controls upon its subsidiary companies.
These commenters recommended, instead, that the standards should be limited to customer
information in the possession or control of the bank holding company.
Under the Bank Holding Company Act of 1956 and the Board’s Regulation Y, a subsidiary
is presumed to be controlled directly or indirectly by the holding company. 12 U.S.C. 1841(d); 12
CFR 225.2(o). Moreover, the Board believes that a bank holding company is ultimately
responsible for ensuring that its subsidiaries comply with the standards set forth under these
Guidelines. The Board recognizes, however, that a bank holding company may satisfy its
obligations under section 501 of the GLB Act through a variety of measures, such as by including
a subsidiary within the scope of its information security program or by causing the subsidiary to
implement a separate information security program in accordance with these Guidelines.
II.B
set forth under these
Guidelines. The Board recognizes, however, that a bank holding company may satisfy its
obligations under section 501 of the GLB Act through a variety of measures, such as by including
a subsidiary within the scope of its information security program or by causing the subsidiary to
implement a separate information security program in accordance with these Guidelines.
II.B. Objectives
Footnote 9 -- The appendix provided that the proposed Guidelines would be applicable to customer
information maintained by or on behalf of bank holding companies and their nonbank subsidiaries
or affiliates (except brokers, dealers, persons providing insurance, investment companies, and
investment advisors) for which the Board has supervisory authority. See 65 FR 39484 (June 26,
2000). [End of Footnote 9]
10

Paragraph II.B. of the proposed Guidelines described the objectives that each financial
institution’s information security program should be designed to achieve. These objectives
tracked the objectives as stated in section 501(b)(1)-(3), adding only that the security program is
to protect against unauthorized access that could risk the safety and soundness of the institution.
The Agencies requested comment on whether there are additional or alternative objectives that
should be included in the Guidelines.
The Agencies received several comments on this proposed paragraph, most of which
objected to language that, in the commenters’ view, required compliance with objectives that were
impossible to meet. Many commenters stated, for instance, that no information security program
can ensure that there will be no problems with the security or confidentiality of customer
information. Others criticized the objective that required protection against any anticipated threat
or hazard
objected to language that, in the commenters’ view, required compliance with objectives that were
impossible to meet. Many commenters stated, for instance, that no information security program
can ensure that there will be no problems with the security or confidentiality of customer
information. Others criticized the objective that required protection against any anticipated threat
or hazard. A few commenters questioned the objective of protecting against unauthorized access
that could result in inconvenience to a customer, while others objected to the addition of the safety
and soundness standard noted above.
The Agencies do not believe the statute mandates a standard of absolute liability for a
financial institution that experiences a security breach. Thus, the Agencies have clarified these
objectives by stating that each security program is to be designed to accomplish the objectives
stated. With the one exception discussed below, the Agencies have otherwise left unchanged the
statement of the objectives, given that these objectives are identical to those set out in the statute.
In response to comments that objected to the addition of the safety and soundness standard,
the Agencies have deleted that reference in order to make the statement of objectives identical to
the objectives identified in the statute. The Agencies believe that risks to the safety and soundness
of a financial institution may be addressed through other supervisory or regulatory means, making
it unnecessary to expand the statement of objectives in this rulemaking.
Some commenters asked for clarification of a financial institution’s responsibilities when a
customer authorizes a third party to access that customer’s information. For purposes of the
Guidelines, access to or use of customer information is not “unauthorized” access if it is done with
the customer’s consent
eans, making
it unnecessary to expand the statement of objectives in this rulemaking.
Some commenters asked for clarification of a financial institution’s responsibilities when a
customer authorizes a third party to access that customer’s information. For purposes of the
Guidelines, access to or use of customer information is not “unauthorized” access if it is done with
the customer’s consent. When a customer gives consent to a third party to access or use that
customer’s information, such as by providing the third party with an account number, PIN, or
password, the Guidelines do not require the financial institution to prevent such access or monitor
the use or redisclosure of the customer’s information by the third party. Finally, unauthorized
access does not mean disclosure pursuant to one of the exceptions in the Privacy Rule.
III. Develop and Implement Information Security Program
III.A. Involve the Board of Directors
Paragraph III.A. of the proposal described the involvement of the board and management in
the development and implementation of an information security program. As explained in the
proposal, the board’s responsibilities are to: (1) approve the institution’s written information
security policy and program; and (2) oversee efforts to develop, implement, and maintain an
11

effective information security program, including reviewing reports from management. The
proposal also laid out management’s responsibilities for developing, implementing, and
maintaining the security program.
The Agencies received a number of comments regarding the requirement of board approval
of the information security program. Some commenters stated that each financial institution should
be allowed to decide for itself whether to obtain board approval of its program. Others suggested
that approval by either a board committee or at the holding company level might be appropriate
security program.
The Agencies received a number of comments regarding the requirement of board approval
of the information security program. Some commenters stated that each financial institution should
be allowed to decide for itself whether to obtain board approval of its program. Others suggested
that approval by either a board committee or at the holding company level might be appropriate.
Still others suggested modifying the Guidelines to require only that the board approve the initial
information security program and delegate subsequent review and approval of the program to
either a committee or an individual.
The Agencies believe that a financial institution’s overall information security program is
critical to the safety and soundness of the institution. Therefore, the final Guidelines continue to
place responsibility on an institution’s board to approve and exercise general oversight over the
program. However, the Guidelines allow the entire board of a financial institution, or an
appropriate committee of the board to approve the institution’s written security program. In
addition, the Guidelines permit the board to assign specific implementation responsibilities to a
committee or an individual.
One commenter suggested that the Guidelines be revised to provide that if a holding
company develops, approves, and oversees the information security program that applies to its
bank and nonbank subsidiaries, there should be no separate requirement for each subsidiary to do
the same thing, as long as those subsidiaries agree to abide by the holding company’s security
program. The Agencies agree that subsidiaries within a holding company can use the security
program developed at the holding company level
and oversees the information security program that applies to its
bank and nonbank subsidiaries, there should be no separate requirement for each subsidiary to do
the same thing, as long as those subsidiaries agree to abide by the holding company’s security
program. The Agencies agree that subsidiaries within a holding company can use the security
program developed at the holding company level. However, if subsidiary institutions choose to
use a security program developed at the holding company level, the board of directors or an
appropriate committee at each subsidiary institution must conduct an independent review to ensure
that the program is suitable and complies with the requirements prescribed by the subsidiary’s
primary regulator. See 12 U.S.C. 505. Once the subsidiary institution’s board, or a committee
thereof, has approved the security program, it must oversee the institution’s efforts to implement
and maintain an effective program.
The Agencies also received comments suggesting that use of the term “oversee” conveyed
the notion that a board is expected to be involved in day-to-day monitoring of the development,
implementation, and maintenance of an information security program. The Agencies’ use of the
term “oversee” is meant to convey a board’s conventional supervisory responsibilities. Day-to-
day monitoring of any aspect of an information security program is a management responsibility.
The final Guidelines reflect this by providing that the board must oversee the institution’s
information security program but may assign specific responsibility for its implementation.
The Agencies invited comment on whether the Guidelines should require that the board
designate a Corporate Information Security Officer or other responsible individual who would
have the authority, subject to the board’s approval, to develop and administer the institution’s
information security program
information security program but may assign specific responsibility for its implementation.
The Agencies invited comment on whether the Guidelines should require that the board
designate a Corporate Information Security Officer or other responsible individual who would
have the authority, subject to the board’s approval, to develop and administer the institution’s
information security program. The Agencies received a number of comments suggesting that the
Agencies should not require the creation of a new position for this purpose. Some financial
12

institutions also stated that hiring one or more additional staff for this purpose would impose a
significant burden. The Agencies believe that a financial institution will not need to create a new
position with a specific title for this purpose, as long as the institution has adequate staff in light of
the risks to its customer information. Regardless of whether new staff are added, the lines of
authority and responsibility for development, implementation, and administration of a financial
institution’s information security program need to be well defined and clearly articulated.[See Footnote 10]
The proposal identified three responsibilities of management in the development of an
information security program. They were to: (1) evaluate the impact on a financial institution’s
security program of changing business arrangements and changes to customer information systems;
nancial
institution’s information security program need to be well defined and clearly articulated.[See Footnote 10]
The proposal identified three responsibilities of management in the development of an
information security program. They were to: (1) evaluate the impact on a financial institution’s
security program of changing business arrangements and changes to customer information systems;
(2) document compliance with these Guidelines; and (3) keep the board informed of the overall
status of the institution’s information security program. A few commenters objected to the
Agencies assigning specific tasks to management. These commenters did not object to the tasks
per se, but suggested that the Agencies allow an institution’s board and management to decide who
within the institution is to carry out the tasks.
The Agencies agree that a financial institution is in the best position to determine who
should be assigned specific roles in implementing the institution’s security program. Accordingly,
the Agencies have deleted the separate provision assigning specific roles to management. The
responsibilities that were contained in this provision are now included in other paragraphs of the
Guidelines.
III.B. Assess Risk
Paragraph III.B. of the proposal described the risk assessment process to be used in the
development of the information security program. Under the proposal, a financial institution was
to identify and assess the risks to customer information. As part of that assessment, the institution
was to determine the sensitivity of the information and the threats to the institution’s systems. The
institution also was to assess the sufficiency of its policies, procedures, systems, and other
arrangements in place to control risk. Finally, the institution was to monitor, evaluate, and adjust
its risk assessment in light of changes in areas identified in the proposal
sment, the institution
was to determine the sensitivity of the information and the threats to the institution’s systems. The
institution also was to assess the sufficiency of its policies, procedures, systems, and other
arrangements in place to control risk. Finally, the institution was to monitor, evaluate, and adjust
its risk assessment in light of changes in areas identified in the proposal.
The Agencies received several comments on these provisions, most of which focused on
the requirement that financial institutions do a sensitivity analysis. One commenter noted that
“customer information” is defined to mean “nonpublic personal information” as defined in the
G-L-B Act, and that the G-L-B Act provides the same level of coverage for all nonpublic personal
information. The commenter stated that it is therefore unclear how the level of sensitivity would
affect an institution’s obligations with respect to the security of this information.
While the Agencies agree that all customer information requires protection, the Agencies
Footnote 10 -- The Agencies note that other regulations already require a financial institution to
designate a security officer for different purposes. See 12 CFR 21.2; 12 CFR 208.61(b). [End of Footnote 10]
13

believe that requiring all institutions to afford the same degree of protection to all customer
information may be unnecessarily burdensome in many cases. Accordingly, the final Guidelines
continue to state that institutions should take into consideration the sensitivity of customer
information. Disclosure of certain information (such as account numbers or access codes) might
be particularly harmful to customers if the disclosure is not authorized. Individuals who try to
breach the institution’s security systems may be likely to target this type of information
e final Guidelines
continue to state that institutions should take into consideration the sensitivity of customer
information. Disclosure of certain information (such as account numbers or access codes) might
be particularly harmful to customers if the disclosure is not authorized. Individuals who try to
breach the institution’s security systems may be likely to target this type of information. When such
information is housed on systems that are accessible through public telecommunications networks,
it may require more and different protections, such as encryption, than if it were located in a
locked file drawer. To provide flexibility to respond to these different security needs in the way
most appropriate, the Guidelines confer upon institutions the discretion to determine the levels of
protection necessary for different categories of information. Institutions may treat all customer
information the same, provided that the level of protection is adequate for all the information.
Other commenters suggested that the risk assessment requirement be tied to reasonably
foreseeable risks. The Agencies agree that the security program should be focused on reasonably
foreseeable risks and have amended the final Guidelines accordingly.
The final Guidelines make several other changes to this paragraph to improve the order of
the Guidelines and to eliminate provisions that were redundant in light of responsibilities outlined
elsewhere. For instance, while the proposal stated that the risk assessment function included the
need to monitor for relevant changes to technology, sensitivity of customer information, and threats
to information security and make adjustments as needed, that function has been incorporated into
the discussion of managing and controlling risk in paragraphs III.C.3. and III.E
sibilities outlined
elsewhere. For instance, while the proposal stated that the risk assessment function included the
need to monitor for relevant changes to technology, sensitivity of customer information, and threats
to information security and make adjustments as needed, that function has been incorporated into
the discussion of managing and controlling risk in paragraphs III.C.3. and III.E.
Thus, under the Guidelines as adopted, a financial institution should identify the reasonably
foreseeable internal and external threats that could result in unauthorized disclosure, misuse,
alteration, or destruction of customer information or customer information systems. Next, the risk
assessment should consider the potential damage that a compromise of customer information from
an identified threat would have on the customer information, taking into consideration the
sensitivity of the information to be protected in assessing the potential damage. Finally, a financial
institution should conduct an assessment of the sufficiency of existing policies, procedures,
customer information systems, and other arrangements intended to control the risks it has
identified.
III.C. Manage and Control Risk
Paragraph III.C. describes the steps an institution should take to manage and the control
risks identified in paragraph III.B.
Establish policies and procedures (III.C.1.) . Paragraph III.C.1 of the proposal described
the elements of a comprehensive risk management plan designed to control identified risks and to
achieve the overall objective of ensuring the security and confidentiality of customer information.
It identified eleven factors an institution should consider in evaluating the adequacy of its policies
and procedures to effectively manage these risks.
14
ragraph III.C.1 of the proposal described
the elements of a comprehensive risk management plan designed to control identified risks and to
achieve the overall objective of ensuring the security and confidentiality of customer information.
It identified eleven factors an institution should consider in evaluating the adequacy of its policies
and procedures to effectively manage these risks.
14

The Agencies received a large number of comments on this paragraph. Most of the
comments were based on a perception that every institution would have to adopt every security
measure listed in proposed III.C.1.a.-k. as part of the institution’s policies and procedures. In
particular, a number of commenters were concerned that the proposed Guidelines would require
the encryption of all customer data.
The Agencies did not intend for the security measures listed in paragraph III.C.1. to be seen
as mandatory for all financial institutions and for all data. Rather, the Agencies intended only that
an institution would consider whether the protections listed were appropriate for the institution’s
particular circumstances, and, if so, adopt those identified as appropriate. The Agencies continue
to believe that these elements may be adapted by institutions of varying sizes, scope of operations,
and risk management structures. Consistent with that approach, the manner of implementing a
particular element may vary from institution to institution. For example, while a financial
institution that offers Internet-based transaction accounts may conclude that encryption is
appropriate, a different institution that processes all data internally and does not have a
transactional web site may consider other kinds of access restrictions that are adequate to maintain
the confidentiality of customer information. To underscore this point, the final Guidelines have
been amended to state that each financial institution must consider whether the security elements
discussed in paragraphs III.C.1.a.-h
titution that processes all data internally and does not have a
transactional web site may consider other kinds of access restrictions that are adequate to maintain
the confidentiality of customer information. To underscore this point, the final Guidelines have
been amended to state that each financial institution must consider whether the security elements
discussed in paragraphs III.C.1.a.-h. are appropriate for the institution and, if so, adopt those
elements an institution concludes are appropriate.
The Agencies invited comment on the degree of detail that should be included in the
Guidelines regarding the risk management program, including which elements should be specified
in the Guidelines, and any other components of a risk management program that should be listed.
With the exception of those commenters who thought some or all of the elements of the risk
management program were intended to be mandatory for all financial institutions, the comments
supported the level of detail conveyed in the proposed Guidelines. The Agencies have adopted
the provision regarding management and control of risks with the changes discussed below.
Comments addressing proposed security measures that have been adopted without change also are
discussed below.
Access rights. The Agencies received a number of comments suggesting that the reference
to “access rights to customer information” in paragraph III.C.1.a. of the proposal could be
interpreted to mean providing customers with a right of access to financial information. The
reference was intended to refer to limitations on employee access to customer financial
information, not to customer access to financial information. However, this element has been
deleted since limitations on employee access are covered adequately in other parts of paragraph
III.C.1. (See discussion of “access controls” in paragraph III.C.1.a. of the final Guidelines,
below.)
Access controls. Paragraph III.C.1.b
d to refer to limitations on employee access to customer financial
information, not to customer access to financial information. However, this element has been
deleted since limitations on employee access are covered adequately in other parts of paragraph
III.C.1. (See discussion of “access controls” in paragraph III.C.1.a. of the final Guidelines,
below.)
Access controls. Paragraph III.C.1.b. of the proposed Guidelines required a financial
institution to consider appropriate access controls when establishing its information security
policies and procedures. These controls were intended to address unauthorized access to an
institution’s customer information by anyone, whether or not employed by the institution.
15

The Agencies believe that this element sufficiently addresses the concept of unauthorized
access, regardless of who is attempting to obtain access. This would cover, for instance, attempts
through pretext calling to gather information about a financial institution’s customers.[See Footnote 11] The
Agencies have amended the final Guidelines to refer specifically to pretext calling in new
III.C.1.a. The Agencies do not intend for the final Guidelines to require a financial institution to
provide its customers with access to information the institution has gathered. Instead, the
provision in the final Guidelines addressing access is limited solely to the issue of preventing
unauthorized access to customer information.
The Agencies have deleted the reference in the proposed paragraph III.C.1.b. to providing
access to authorized companies. This change was made partly in response to commenters who
objected to what they perceived to be an inappropriate expansion of the scope of the Guidelines to
include company records and partly in recognition of the fact that access to records would be
obtained, in any case, only through requests by individuals
nce in the proposed paragraph III.C.1.b. to providing
access to authorized companies. This change was made partly in response to commenters who
objected to what they perceived to be an inappropriate expansion of the scope of the Guidelines to
include company records and partly in recognition of the fact that access to records would be
obtained, in any case, only through requests by individuals. The final Guidelines require an
institution to consider the need for access controls in light of the institution’s various customer
information systems and adopt such controls as appropriate.
Dual control procedures. Paragraph III.C.1.f. of the proposed Guidelines stated that
financial institutions should consider dual control procedures, segregation of duties, and employee
background checks for employees with responsibility for, or access to, customer information.
Most of the comments on this paragraph focused on dual control procedures, which refers to a
security technique that uses two or more separate persons, operating together to protect sensitive
information. Both persons are equally responsible for protecting the information and neither can
access the information alone.
According to one commenter, dual controls are part of normal audit procedures and did not
need to be restated. Other commenters suggested that dual control procedures are not always
necessary, implying that these procedures are not the norm. The Agencies recognize that dual-
control procedures are not necessary for all activities, but might be appropriate for higher-risk
activities. Given that the Guidelines state only that dual control procedures should be considered
by a financial institution and adopted only if appropriate for the institution, the Agencies have
retained a reference to dual control procedures in the items to be considered (paragraph III.C.1.e).
Oversight of servicers. Paragraph III.C.1.g. of the proposal was deleted
propriate for higher-risk
activities. Given that the Guidelines state only that dual control procedures should be considered
by a financial institution and adopted only if appropriate for the institution, the Agencies have
retained a reference to dual control procedures in the items to be considered (paragraph III.C.1.e).
Oversight of servicers. Paragraph III.C.1.g. of the proposal was deleted. Instead, the final
Guidelines consolidate the provisions related to service providers in paragraph III.D.
Physical hazards and technical failures. The paragraphs of the proposed Guidelines
addressing protection against destruction due to physical hazards and technological failures
(paragraphs III.C.1.j. and k., respectively, of the proposal) have been consolidated in paragraph
III.C.1.h. of the final Guidelines. The Agencies believe that this change improves clarity and
recognizes that disaster recovery from environmental and technological failures often involve the
Footnote 11 -- Pretext calling is a fraudulent means of obtaining an individual’s personal information
by persons posing as bank customers. [End of Footnote 11]
16

same considerations.
Training (III.C.2.). Paragraph III.C.2. of the proposed Guidelines provided that an
institution’s information security program should include a training component designed to train
employees to recognize, respond to, and report unauthorized attempts to obtain customer
information. The Agencies received several comments suggesting that this provision directed staff
of financial institutions to report suspected attempts to obtain customer information to law
enforcement agencies rather than to the management of the financial institution. The Agencies did
not intend that result, and note that nothing in the Guidelines alters other applicable requirements
and procedures for reporting suspicious activities
omments suggesting that this provision directed staff
of financial institutions to report suspected attempts to obtain customer information to law
enforcement agencies rather than to the management of the financial institution. The Agencies did
not intend that result, and note that nothing in the Guidelines alters other applicable requirements
and procedures for reporting suspicious activities. For purposes of these Guidelines, the Agencies
believe that, as part of a training program, staff should be made aware both of federal reporting
requirements and an institution’s procedures for reporting suspicious activities, including attempts
to obtain access to customer information without proper authority.
The final Guidelines amend the provision governing training to state that a financial
institution’s information security program should include a training component designed to
implement the institution’s information security policies and procedures. The Agencies believe
that the appropriate focus for the training should be on compliance with the institution’s security
program generally and not just on the limited aspects identified in proposed III.C.2. The
provisions governing reporting have been moved to paragraph III.C.1.g., which addresses
response programs in general.
Testing (III.C.3.). Paragraph III.C.3. of the proposed Guidelines provided that an
information security program should include regular testing of key controls, systems, and
procedures. The proposal provided that the frequency and nature of the testing should be
determined by the risk assessment and adjusted as necessary to reflect changes in both internal and
external conditions. The proposal also provided that the tests are to be conducted, where
appropriate, by independent third parties or staff independent of those that develop or maintain the
security program. Finally, the proposal stated that test results are to be reviewed by independent
third parties or staff independent of those that conducted the test
o reflect changes in both internal and
external conditions. The proposal also provided that the tests are to be conducted, where
appropriate, by independent third parties or staff independent of those that develop or maintain the
security program. Finally, the proposal stated that test results are to be reviewed by independent
third parties or staff independent of those that conducted the test. The Agencies requested
comment on whether specific types of security tests, such as penetration tests or intrusion detection
tests, should be required.
The most frequent comment regarding testing of key controls was that the Agencies should
not require specific tests. Commenters noted that because technology changes rapidly, the tests
specified in the Guidelines will become obsolete and other tests will become the standard.
Consequently, according to these commenters, the Guidelines should identify areas where testing
may be appropriate without requiring a financial institution to implement a specific test or testing
procedure. Several commenters noted that periodic testing of information security controls is a
sound idea and is an appropriate standard for inclusion in these Guidelines.
The Agencies believe that a variety of tests may be used to ensure the controls, systems,
and procedures of the information security program work properly and also recognize that such
tests will progressively change over time. The Agencies believe that the particular tests that may
be applied should be left to the discretion of management rather than specified in advance in these
17
delines.
The Agencies believe that a variety of tests may be used to ensure the controls, systems,
and procedures of the information security program work properly and also recognize that such
tests will progressively change over time. The Agencies believe that the particular tests that may
be applied should be left to the discretion of management rather than specified in advance in these
17

Guidelines. Accordingly, the final Guidelines do not require a financial institution to apply
specific tests to evaluate the key control systems of its information security program.
The Agencies also invited comment regarding the appropriate degree of independence that
should be specified in the Guidelines in connection with the testing of information security systems
and the review of test results. The proposal asked whether the tests or reviews of tests be
conducted by persons who are not employees of the financial institution. The proposal also asked
whether employees may conduct the testing or may review test results, and what measures, if any,
are appropriate to assure their independence.
Some commenters interpreted the proposal as requiring three separate teams of people to
provide sufficient independence to control testing: one team to operate the system; a second team
to test the system; and a third team to review test results. This approach, they argued, would be
too burdensome and expensive to implement. The Agencies believe that the critical need for
independence is between those who operate the systems and those who either test them or review
the test results. Therefore, the final Guidelines now require that tests should be conducted or
reviewed by persons who are independent of those who operate the systems, including the
management of those systems.
Whether a financial institution should use third parties to either conduct tests or review
their results depends upon a number of factors
ems and those who either test them or review
the test results. Therefore, the final Guidelines now require that tests should be conducted or
reviewed by persons who are independent of those who operate the systems, including the
management of those systems.
Whether a financial institution should use third parties to either conduct tests or review
their results depends upon a number of factors. Some financial institutions may have the capability
to thoroughly test certain systems in-house and review the test results but will need the assistance
of third party testers to assess other systems. For example, an institution’s internal audit
department may be sufficiently trained and independent for the purposes of testing certain key
controls and providing test results to decision makers independent of system managers. Some
testing may be conducted by third parties in connection with the actual installation or modification
of a particular program. In each instance, management needs to weigh the benefits of testing and
test review by third parties against its own resources in this area, both in terms of expense and
reliability.
Ongoing adjustment of program. Paragraph III.C.4. of the proposal required an institution
to monitor, evaluate and adjust, as appropriate, the information security program in light of any
relevant changes in technology, the sensitivity of its customer information, and internal or external
threats to information security. This provision was previously located in the paragraph titled
“Manage and Control Risk”. While there were no comments on this provision, the Agencies
wanted to highlight this concept and clarify that this provision is applicable to an institutions’s
entire information security program. Therefore, this provision is now separately identified as new
paragraph III.E. of the final Guidelines, discussed below.
III.D. Oversee Service Provider Arrangements
The Agencies’ proposal addressed service providers in two provisions
provision, the Agencies
wanted to highlight this concept and clarify that this provision is applicable to an institutions’s
entire information security program. Therefore, this provision is now separately identified as new
paragraph III.E. of the final Guidelines, discussed below.
III.D. Oversee Service Provider Arrangements
The Agencies’ proposal addressed service providers in two provisions. The Agencies
provided that an institution should consider contract provisions and oversight mechanisms to
protect the security of customer information maintained or processed by service providers as one
of the proposed elements to be considered in establishing risk management policies and
18

procedures (proposed paragraph III.C.1.g.). Additionally, proposed paragraph III.D. provided
that, when an institution uses an outsourcing arrangement, the institution would continue to be
responsible for safeguarding customer information that it gives to the service provider. That
proposed paragraph also provided that the institution must use due diligence in managing and
monitoring the outsourcing arrangement to confirm that its service providers would protect
customer information consistent with the Guidelines.
The Agencies requested comment on the appropriate treatment of outsourcing
arrangements, such as whether industry best practices are available regarding effective monitoring
of service provider security precautions, whether service providers accommodate requests for
specific contract provisions regarding information security, and, to the extent that service
providers do not accommodate these requests, whether financial institutions implement effective
information security programs. The Agencies also requested comment on whether institutions
would find it helpful if the Guidelines contained specific contract provisions requiring service
provider performance standards in connection with the security of customer information
o the extent that service
providers do not accommodate these requests, whether financial institutions implement effective
information security programs. The Agencies also requested comment on whether institutions
would find it helpful if the Guidelines contained specific contract provisions requiring service
provider performance standards in connection with the security of customer information.
The Agencies received one example of best practices, but the commenter did not
recommend that they be included in the Guidelines. While some commenters suggested that the
Guidelines include best practices, other commenters stated that, given the various types of
financial institutions, there could be a variety of best industry practices. Another commenter stated
that best practices could become minimum requirements that result in inappropriate burdens. The
Agencies recognize that information security practices are likely to evolve rapidly, and thus
believe that it is inappropriate to include best practices in the final Guidelines.
Commenters were mixed as to whether service providers are receptive to contract
modifications to protect customer information. Commenters were uniform, however, in stating that
an institution’s obligation to monitor service providers should not include on-site audits by the
institution or its agent. The commenters stated that, in addition to the expense for financial
institutions, the procedure would place an inordinate burden on many service providers that
process customer information for multiple institutions. Several commenters noted that the service
providers often contract for audits of their systems and that institutions should be able to rely upon
those testing procedures. Some commenters recommended that an institution’s responsibility for
information given to service providers require only that the institution enter into appropriate
contractual arrangements
ormation for multiple institutions. Several commenters noted that the service
providers often contract for audits of their systems and that institutions should be able to rely upon
those testing procedures. Some commenters recommended that an institution’s responsibility for
information given to service providers require only that the institution enter into appropriate
contractual arrangements. However, commenters also indicated that requiring specific contract
provisions would not be consistent with the development of flexible Guidelines and recommended
against the inclusion of specific provisions.
The Agencies believe that financial institutions should enter into appropriate contracts, but
also believe that these contracts, alone, are not sufficient. Therefore, the final Guidelines, in
paragraph III.D., include provisions relating to selecting, contracting with, and monitoring service
providers.
The final Guidelines require that an institution exercise appropriate due diligence in the
selection of service providers. Due diligence should include a review of the measures taken by a
19

service provider to protect customer information. As previously noted in the discussion of
“service provider”, it also should include a review of the controls the service provider has in
place to ensure that any subservicer used by the service provider will be able to meet the
objectives of these Guidelines.
The final Guidelines also require that a financial institution have a contract with each of its
service providers that requires each provider to implement appropriate measures designed to meet
the objectives of these Guidelines (as stated in paragraph II.B.). This provision does not require a
service provider to have a security program in place that complies with each paragraph of these
Guidelines
final Guidelines also require that a financial institution have a contract with each of its
service providers that requires each provider to implement appropriate measures designed to meet
the objectives of these Guidelines (as stated in paragraph II.B.). This provision does not require a
service provider to have a security program in place that complies with each paragraph of these
Guidelines. Instead, by stating that a service provider’s security measures need only achieve the
objectives of these Guidelines, the Guidelines provide flexibility for a service provider’s
information security measures to differ from the program that a financial institution implements.
The Agencies have provided a two-year transition period during which institutions may bring their
outsourcing contracts into compliance. (See discussion of paragraph III.F.) The Agencies have
not included model contract language, given our belief that the precise terms of service contracts
are best left to the parties involved.
Each financial institution must also exercise an appropriate level of oversight over each of
its service providers to confirm that the service provider is implementing the provider’s security
measures. The Agencies have amended the Guidelines as proposed to include greater flexibility
with regard to the monitoring of service providers. A financial institution need only monitor its
outsourcing arrangements if such oversight is indicated by an institution’s own risk assessment.
The Agencies recognize that not all outsourcing arrangements will need to be monitored or
monitored in the same fashion. Some service providers will be financial institutions that are
directly subject to these Guidelines or other standards promulgated by their primary regulator
under section 501(b). Other service providers may already be subject to legal and professional
standards that require them to safeguard the institution’s customer information
nts will need to be monitored or
monitored in the same fashion. Some service providers will be financial institutions that are
directly subject to these Guidelines or other standards promulgated by their primary regulator
under section 501(b). Other service providers may already be subject to legal and professional
standards that require them to safeguard the institution’s customer information. Therefore, the final
Guidelines permit an institution to do a risk assessment taking these factors into account and
determine for themselves which service providers will need to be monitored.
Even where monitoring is warranted, the Guidelines do not require on-site inspections.
Instead, the Guidelines state that this monitoring can be accomplished, for example, through the
periodic review of the service provider’s associated audits, summaries of test results, or
equivalent measures of the service provider. The Agencies expect that institutions will arrange,
when appropriate, through contracts or otherwise, to receive copies of audits and test result
information sufficient to assure the institution that the service provider implements information
security measures that are consistent with its contract provisions regarding the security of customer
information. The American Institute of Certified Public Accountants Statement of Auditing
Standards No. 70, captioned “Reports on the Processing of Transactions by Service
Organizations” (SAS 70 report), is one commonly used external audit tool for service providers.
Information contained in an SAS 70 report may enable an institution to assess whether its service
provider has information security measures that are consistent with representations made to the
institution during the service provider selection process.
III.E. Adjust the Program
20
ions by Service
Organizations” (SAS 70 report), is one commonly used external audit tool for service providers.
Information contained in an SAS 70 report may enable an institution to assess whether its service
provider has information security measures that are consistent with representations made to the
institution during the service provider selection process.
III.E. Adjust the Program
20

Paragraphs III.B.3 and III.C.4. of the proposed Guidelines both addressed a financial
institution’s obligations when circumstances change. Both paragraph III.B.3. (which set forth
management’s responsibilities with respect to its risk assessment) and paragraph III.C.4. (which
focused on the adequacy of an institution’s information security program) identified the possible
need for changes to an institution’s program in light of relevant changes to technology, the
sensitivity of customer information, and internal or external threats to the information security.
The Agencies received no comments objecting to the statements in these paragraphs of the
need to adjust a financial institution’s program as circumstances change. While the Agencies have
not changed the substance of these provisions in the final Guidelines, we have, however, made a
stylistic change to simplify the Guidelines. The final Guidelines combine, in paragraph III.E., the
provisions previously stated separately. Consistent with the proposal, this paragraph provides that
each financial institution must monitor, evaluate, and adjust its information security program in
light of relevant changes in technology, the sensitivity of its customer information, internal or
external threats to information, and the institution’s own changing business arrangements
II.E., the
provisions previously stated separately. Consistent with the proposal, this paragraph provides that
each financial institution must monitor, evaluate, and adjust its information security program in
light of relevant changes in technology, the sensitivity of its customer information, internal or
external threats to information, and the institution’s own changing business arrangements. This
would include an analysis of risks to customer information posed by new technology (and any
needed program adjustments) before a financial institution adopts the technology in order to
determine whether a security program remains adequate in light of the new risks presented.[See Footnote 12]
III.F. Report to the board.
Paragraph III.A.2.c. of the proposal set out management’s responsibilities for reporting to
its board of directors. As previously discussed, the final Guidelines have removed specific
requirements for management, but instead allow a financial institution to determine who within the
organization should carry out a given responsibility. The board reporting requirement thus has
been amended to require that a financial institution report to its board, and that this report be at
least annual. Paragraph III.F. of the final Guidelines sets out this requirement.
The Agencies invited comment regarding the appropriate frequency of reports to the board,
including whether reports should be monthly, quarterly, or annually. The Agencies received a
number of comments recommending that no specific frequency be mandated by the Guidelines and
that each financial institution be permitted to establish its own reporting period
Guidelines sets out this requirement.
The Agencies invited comment regarding the appropriate frequency of reports to the board,
including whether reports should be monthly, quarterly, or annually. The Agencies received a
number of comments recommending that no specific frequency be mandated by the Guidelines and
that each financial institution be permitted to establish its own reporting period. Several
Footnote 12 -- For additional information concerning how a financial institution should identify,
measure, monitor, and control risks associated with the use of technology, see OCC Bulletin 98-3
concerning technology risk management, which may be obtained on the Internet at
http://www.occ.treas.gov/ftp/bulletin/98-3.txt.; Federal Reserve SR Letter 98-9 on Assessment of
Information Technology in the Risk-Focused Frameworks for the Supervision of Community Banks
and Large Complex Banking Organizations, April 20, 1998,
http://www.federalreserve.gov/boarddocs/SRLETTERS/1998/SR9809.HTM; FDIC FIL 99-68
concerning risk assessment tools and practices for information security systems at
http://www.fdic.gov/news/news/financial/1999/fil9968.html.; OTS’s CEO Letter 70, Statement
on Retail On-Line Personal Computer Banking, (June 23, 1997), available at
http://www.ots.treas.gov/docs/25070.pdf. [End of Footnote 12]
21

commenters stated that if a reporting period is required, then it should be not less than annually
unless some material event triggers the need for an interim report.
The Agencies expect that in all cases, management will provide its board (or the
appropriate board committee) a written report on the information security program consistent with
the Guidelines at least annually. Management of financial institutions with more complex
information systems may find it necessary to provide information to the board (or a committee) on
a more frequent basis
report.
The Agencies expect that in all cases, management will provide its board (or the
appropriate board committee) a written report on the information security program consistent with
the Guidelines at least annually. Management of financial institutions with more complex
information systems may find it necessary to provide information to the board (or a committee) on
a more frequent basis. Similarly, more frequent reporting will be appropriate whenever a material
event affecting the system occurs or a material modification is made to the system. The Agencies
expect that the content of these reports will vary for each financial institution, depending upon the
nature and scope of its activities as well as the different circumstances that it will confront as it
implements and maintains its program.
III.G. Implement the Standards
Paragraph III.E. of the proposal described the timing requirements for the implementation
of these standards. It provided that each financial institution is to take appropriate steps to fully
implement an information security program pursuant to these Guidelines by July 1, 2001.
The Agencies received several comments suggesting that the proposed effective date be
extended for a period of 12 to 18 months because financial institutions are currently involved in
efforts to meet the requirements of the final Privacy Rule by the compliance deadline, July 1, 2001.
The Agencies believe that the dates for full compliance with these Guidelines and the Privacy Rule
should coincide. Financial institutions are required, as part of their initial privacy notices, to
disclose their policies and practices with respect to protecting the confidentiality and security of
nonpublic personal information. See §___.6(a)(8)
y Rule by the compliance deadline, July 1, 2001.
The Agencies believe that the dates for full compliance with these Guidelines and the Privacy Rule
should coincide. Financial institutions are required, as part of their initial privacy notices, to
disclose their policies and practices with respect to protecting the confidentiality and security of
nonpublic personal information. See §___.6(a)(8). Each Agency has provided in the appendix to
its Privacy Rule that a financial institution may satisfy this disclosure requirement by advising its
customers that the institution maintains physical, electronic, and procedural safeguards that comply
with federal standards to guard customers’ nonpublic personal information. See appendix A-7.
The Agencies believe that this disclosure will be meaningful only if the final Guidelines are
effective when the disclosure is made. If the effective date of these Guidelines is extended beyond
July 1, 2001, then a financial institution may be placed in the position of providing an initial notice
regarding confidentiality and security and thereafter amending the privacy policy to accurately
refer to the federal standards once they became effective. For these reasons, the Agencies have
retained July 1, 2001, as the effective date for these Guidelines.
However, the Agencies have included a transition rule for contracts with service
providers. The transition rule, which parallels a similar provision in the Privacy Rule, provides a
two-year period for grandfathering existing contracts. Thus a contract entered into on or before the
date that is 30 days after publication of the final Guidelines in the Federal Register satisfies the
provisions of this part until July 1, 2003, even if the contract does not include provisions
delineating the servicer’s duties and responsibilities to protect customer information described in
paragraph III.D.
22
grandfathering existing contracts. Thus a contract entered into on or before the
date that is 30 days after publication of the final Guidelines in the Federal Register satisfies the
provisions of this part until July 1, 2003, even if the contract does not include provisions
delineating the servicer’s duties and responsibilities to protect customer information described in
paragraph III.D.
22

Location of Guidelines. These guidelines have been published as an appendix to each
Agency’s Standards for Safety and Soundness. For the OCC, those regulations appear at 12 CFR
part 30; for the Board, at 12 CFR part 208; for the FDIC, at 12 CFR part 364; and for the OTS, at
12 CFR part 570. The Board also is amending 12 CFR parts 211 and 225 to apply the Guidelines
to other institutions that it supervises.
The Agencies will apply the rules already in place to require the submission of a
compliance plan in appropriate circumstances. For the OCC, those regulations appear at 12 CFR
part 30; for the Board at 12 CFR part 263; for the FDIC at 12 CFR part 308, subpart R; and for the
OTS at 12 CFR part 570. The final rules make conforming changes to the regulatory text of these
parts.
Rescission of Year 2000 Standards for Safety and Soundness. The Agencies previously
issued guidelines establishing Year 2000 safety and soundness standards for insured depository
institutions pursuant to section 39 of the FDI Act. Because the events for which these standards
were issued have passed, the Agencies have concluded that the guidelines are no longer necessary
and proposed to rescind the standards as part of this rulemaking. The Agencies requested
comment on the whether rescission of these standards is appropriate. Those commenters
responding to this request were unanimous in recommending the rescission of the Year 2000
Standards, and the Agencies have rescinded these standards
the Agencies have concluded that the guidelines are no longer necessary
and proposed to rescind the standards as part of this rulemaking. The Agencies requested
comment on the whether rescission of these standards is appropriate. Those commenters
responding to this request were unanimous in recommending the rescission of the Year 2000
Standards, and the Agencies have rescinded these standards. These standards appeared for the
OCC at 12 CFR part 30, appendix B and C; for the Board at 12 CFR part 208, appendix D-2; for
the FDIC at 12 CFR part 364, appendix B; and for the OTS at 12 CFR part 570, appendix B.
Accordingly, the Agencies hereby rescind the Year 2000 Standards for Safety and Soundness,
effective thirty (30) days after the publication date of this notice of the joint final rule.
IV. Regulatory Analysis
A. Paperwork Reduction Act
The Agencies have determined that this rule does not involve a collection of information
pursuant to the provisions of the Paperwork Reduction Act (44 U.S.C. 3501 et seq.).
B. Regulatory Flexibility Act
OCC: Under the Regulatory Flexibility Act (RFA), the OCC must either provide a Final
Regulatory Flexibility Analysis (FRFA) with these final Guidelines or certify that the final
Guidelines “will not, if promulgated”, have a significant economic impact on a substantial number
of small entities.[See Footnote 13] The OCC has evaluated the effects of these Guidelines on small entities and is
providing the following FRFA.
Footnote 13 -- The RFA defines the term “small entity” in 5 U.S.C. 601 by reference to a definition
published by the Small Business Administration (SBA). The SBA has defined a “small entity” for
banking purposes as a national or commercial bank, or savings institution with less than $100
million in assets. See 13 CFR 121.201. [End of Footnote 13]
23
ties and is
providing the following FRFA.
Footnote 13 -- The RFA defines the term “small entity” in 5 U.S.C. 601 by reference to a definition
published by the Small Business Administration (SBA). The SBA has defined a “small entity” for
banking purposes as a national or commercial bank, or savings institution with less than $100
million in assets. See 13 CFR 121.201. [End of Footnote 13]
23

Although the OCC specifically sought comment on the costs to small entities of
establishing and operating information security programs, no commenters provided specific cost
information. Instead, commenters confirmed the OCC’s conclusion that most if not all institutions
already have information security programs in place, because the standards reflect good business
practices and existing OCC and FFIEC guidance. Some comments indicated, however, that
institutions will have to formalize or enhance their information security programs. Accordingly,
the OCC considered certifying, under section 605(b) of the RFA, that these Guidelines will not
have a significant economic impact on a substantial number of small entities. However, given that
the guidance previously issued by the OCC and the FFIEC is not completely identical to the
Guidelines being adopted in this rulemaking, the Guidelines are likely to have some impact on all
affected institutions. While the OCC believes that this impact will not be substantial in the case of
most small entities, we nevertheless have prepared the following FRFA.
1. Reasons for Final Action
The OCC is issuing these Guidelines under section 501(b) of the G-L-B Act
etely identical to the
Guidelines being adopted in this rulemaking, the Guidelines are likely to have some impact on all
affected institutions. While the OCC believes that this impact will not be substantial in the case of
most small entities, we nevertheless have prepared the following FRFA.
1. Reasons for Final Action
The OCC is issuing these Guidelines under section 501(b) of the G-L-B Act. Section
501(b) requires the OCC to publish standards for financial institutions subject to its jurisdiction
relating to administrative, technical and physical standards to: (1) insure the security and
confidentiality of customer records and information; (2) protect against any anticipated threats or
hazards to the security or integrity of such records; and (3) protect against unauthorized access to
or use of such records or information which could result in substantial harm or inconvenience to
any customer.
2. Objectives of and Legal Basis for Final Action
The objectives of the Guidelines are described in the Supplementary Information section
above. The legal bases for the Guidelines are: 12 U.S.C. 93a, 1818, 1831p-1, and 3102(b) and 15
USC 6801 and 6805(b)(1).
3. Small Entities to Which the Rule Will Apply
The OCC’s final Guidelines will apply to approximately 2300 institutions, including
national banks, federal branches and federal agencies of foreign banks, and certain subsidiaries of
such entities. The OCC estimates that approximately 1125 of these institutions are small
institutions with assets less than $ 100 million.
4. Projected Reporting, Recordkeeping, and Other Compliance Requirements; Skills Required
The Guidelines do not require any reports to the OCC, however, they require all covered
institutions to develop and implement a written information security program comprised of several
elements. Institutions must assess the risks to their customer information and adopt appropriate
measures to control those risks
cted Reporting, Recordkeeping, and Other Compliance Requirements; Skills Required
The Guidelines do not require any reports to the OCC, however, they require all covered
institutions to develop and implement a written information security program comprised of several
elements. Institutions must assess the risks to their customer information and adopt appropriate
measures to control those risks. Institutions must then test these security measures and adjust their
information security programs in light of any relevant changes. In addition, institutions must use
appropriate due diligence in selecting service providers, and require service providers, by
contract, to implement appropriate security measures. The Guidelines also require institutions to
24

monitor their service providers, where appropriate, to confirm they have met their contractual
obligations. Finally, the Guidelines require the board of directors or an appropriate committee of
the board of each institution to approve the institution’s information security program and to
oversee its implementation. To facilitate board oversight, the institution must provide to the board
or to the board committee a report, at least annually, describing the overall status of the
institution’s information security program and the institution’s compliance with the Guidelines.
Because the information security program described above reflects existing supervisory
guidance, the OCC believes that most institutions already have the expertise to develop,
implement, and maintain the program. However, if they have not already done so, institutions will
have to retain the services of someone capable of assessing threats to the institution’s customer
information. Institutions that lack an adequate information security program also will have to have
personnel capable of developing, implementing and testing security measures to address these
threats
implement, and maintain the program. However, if they have not already done so, institutions will
have to retain the services of someone capable of assessing threats to the institution’s customer
information. Institutions that lack an adequate information security program also will have to have
personnel capable of developing, implementing and testing security measures to address these
threats. Institutions that use service providers may require legal skills to draft appropriate
language for contracts with service providers.
5. Public Comment and Significant Alternatives
The OCC did not receive any public comment on its initial regulatory flexibility analysis,
although it did receive comments on the proposed Guidelines, and on the impact of the Guidelines
on small entities in particular. The comments received by the OCC and the other Agencies are
discussed at length in the supplementary information above. While some commenters suggested
that the OCC exempt small institutions altogether, the OCC has no authority under the statute to do
so. The discussion below reviews the changes adopted in the final Guidelines that will minimize
the economic impact of the Guidelines on all businesses.
The OCC carefully considered comments from small entities that encouraged the Agencies
to issue guidelines that are not overly prescriptive, that provide flexibility in the design of an
information security program, but that still provide small entities with some guidance. After
considering these comments, the OCC determined that it is appropriate to issue the standards as
Guidelines that allow each institution the discretion to design an information security program that
suits its particular size and complexity and the nature and scope of its activities. The OCC
considered issuing broader Guidelines that would only identify objectives to be achieved while
leaving it up to each institution to decide what steps it should take to ensure that it meets these
objectives
delines that allow each institution the discretion to design an information security program that
suits its particular size and complexity and the nature and scope of its activities. The OCC
considered issuing broader Guidelines that would only identify objectives to be achieved while
leaving it up to each institution to decide what steps it should take to ensure that it meets these
objectives. However, the OCC concluded that such broad guidance ultimately would be less
helpful than would be guidelines that combine the flexibility sought by commenters with
meaningful guidance on factors that an institution should consider and steps that the institution
should take. The OCC also considered the utility of more prescriptive guidelines, but rejected that
approach out of concern that it likely would be more burdensome, could interfere with innovation,
and could impose requirements that would be inappropriate in a given situation. While the
Guidelines are not overly detailed, they provide guidance by establishing the process an institution
will need to follow in order to protect its customer information and by identifying security
measures that are likely to have the greatest applicability to national banks in general.
25

Most commenters supported the use of the more narrow definition of “customer” in the
Guidelines as is used in the Privacy Rule rather than a broad definition that would apply to all
records under the control of a financial institution. Commenters maintained that two different
definitions would be confusing and also inconsistent with the use of the term “customer” in section
501 of the G-L-B Act. The OCC considered using the broader definition, but determined that
information security could be addressed more broadly through other vehicles
definition that would apply to all
records under the control of a financial institution. Commenters maintained that two different
definitions would be confusing and also inconsistent with the use of the term “customer” in section
501 of the G-L-B Act. The OCC considered using the broader definition, but determined that
information security could be addressed more broadly through other vehicles. For the sake of
consistency, the final Guidelines adopt the narrower definition and apply only to records of
consumers who have established a continuing relationship with an institution under which the
institution provides one or more financial products or services to the consumer to be used
primarily for personal, family or household purposes, the definition used in the Privacy Rule.
Many commenters criticized the list of proposed objectives for each financial institution’s
information security program which generally reflected the statutory objectives in section 501(b).
According to these comments, the objectives were stated in a manner that made them absolute,
unachievable, and therefore burdensome. The final Guidelines have been drafted to clarify these
objectives by stating that each security program is to be “designed” to accomplish the objectives
stated.
Commenters wanted board involvement in the development and implementation of an
information security program left to the discretion of the financial institution. Commenters also
asked the OCC to clarify that the board may delegate to a committee responsibility for involvement
in the institution’s security program. While the final Guidelines as drafted continue to place
responsibility on an institution’s board to approve and exercise general oversight over the
program, they now clarify that a committee of the board may approve the institution’s written
security program. In addition, the Guidelines permit the board to assign specific implementation
responsibilities to a committee or an individual
program. While the final Guidelines as drafted continue to place
responsibility on an institution’s board to approve and exercise general oversight over the
program, they now clarify that a committee of the board may approve the institution’s written
security program. In addition, the Guidelines permit the board to assign specific implementation
responsibilities to a committee or an individual.
The OCC considered requiring an institution to designate a Corporate Security Officer.
However, the agency agreed with commenters that a financial institution is in the best position to
determine who should be assigned specific roles in implementing the institution’s security
program. Therefore, the Guidelines do not include this requirement.
The proposal identifying various security measures that an institution should consider in
evaluating the adequacy of its policies and procedures was criticized by many commenters. These
commenters misinterpreted the list of measures and believed each measure to be mandatory. Small
entities commented that these measures were overly comprehensive and burdensome. As
discussed previously in the preamble, the OCC did not intend to suggest that every institution must
adopt every one of the measures. To highlight the OCC’s intention that an institution must
determine for itself which measures will be appropriate for its own risk profile, the final
Guidelines now clearly state that each financial institution must consider whether the security
elements listed are appropriate for the institution and, if so, adopt those elements an institution
concludes are appropriate.
Commenters noted that testing could be burdensome and costly, especially for small
entities. The OCC considered mandating specific tests, but determined that with changes in
technology, such tests could become obsolete. Therefore, the final Guidelines permit management
26
nts listed are appropriate for the institution and, if so, adopt those elements an institution
concludes are appropriate.
Commenters noted that testing could be burdensome and costly, especially for small
entities. The OCC considered mandating specific tests, but determined that with changes in
technology, such tests could become obsolete. Therefore, the final Guidelines permit management
26

to exercise its discretion to determine the frequency and types of tests that need to be conducted.
The OCC considered required testing or the review of tests to be conducted by outside auditors.
The OCC determined that these duties could be performed effectively by an institution’s own staff,
if staff selected is sufficiently independent. Therefore, the Guidelines permit financial institutions
to determine for themselves whether to use third parties to either conduct tests or review their
results or to use staff independent of those that develop or maintain the institution’s security
program.
Many commenters objected to provisions in the proposal requiring institutions to monitor
their service providers. Commenters asserted that it would be burdensome to require them to
monitor the activities of their service providers and that information security of service providers
should be handled through contractual arrangements. The final Guidelines include greater
flexibility with regard to the monitoring of service providers than was provided in the proposal.
The final Guidelines recognize that some service providers will be financial institutions that are
directly subject to these Guidelines or other standards promulgated under section 501(b) and that
other service providers may already be subject to legal and professional standards that require
them to safeguard the institution’s customer information. Therefore, the final Guidelines permit an
institution to do a risk assessment taking these factors into account and to determine for themselves
which service providers will need to be monitored
ndards promulgated under section 501(b) and that
other service providers may already be subject to legal and professional standards that require
them to safeguard the institution’s customer information. Therefore, the final Guidelines permit an
institution to do a risk assessment taking these factors into account and to determine for themselves
which service providers will need to be monitored. Where monitoring is warranted, the
Guidelines now specify that monitoring can be accomplished, for example, through the periodic
review of the service provider’s associated audits, summaries of test results, or equivalent
measures of the service provider.
In addition, after considering the comments about contracts with service providers and the
effective date of the Guidelines, the OCC also adopted a transition rule, similar to a provision in
the Privacy Rule, that grandfathers existing contracts for a two-year period.
One commenter requested that smaller community banks be given additional time to
comply with the Guidelines because having to comply with the new Privacy Rule and these
Guidelines will put a strain on the resources of smaller banks. The OCC considered this request
but did not change the effective date of the Guidelines given the importance of safeguarding
customer information. In addition, most institutions already have information security programs in
place, and the OCC has addressed this concern by adding flexibility to the final Guidelines in a
variety of other areas as described above.
Board: The Regulatory Flexibility Act (5 U.S.C. 604) requires an agency to publish a final
regulatory flexibility analysis when promulgating a final rule that was subject to notice and
comment.
Need for and objectives of Guidelines. As discussed above, these Guidelines implement
section 501 of the GLB Act
ing flexibility to the final Guidelines in a
variety of other areas as described above.
Board: The Regulatory Flexibility Act (5 U.S.C. 604) requires an agency to publish a final
regulatory flexibility analysis when promulgating a final rule that was subject to notice and
comment.
Need for and objectives of Guidelines. As discussed above, these Guidelines implement
section 501 of the GLB Act. The objective of the Guidelines is to establish standards for financial
institutions that are subject to the Board’s jurisdiction to protect the security and confidentiality of
their customers’ information. In particular, the Guidelines require those financial institutions to
implement a comprehensive written information security program that includes:
27

(1) Assessing the reasonably foreseeable internal and external threats that could result in
unauthorized disclosure, misuse, alteration, or destruction of customer information;
(2) Adopting security measures that the financial institution concludes are appropriate for
it; and
(3) Overseeing its arrangements with its service provider(s).
Comments on the initial regulatory flexibility analysis. Although few commenters
addressed the initial regulatory flexibility analysis specifically, many commenters addressed the
regulatory burdens that were discussed in that analysis. Several commenters noted that certain
aspects of the proposal may tax the comparatively limited resources of small institutions, yet few
commenters quantified the potential costs of compliance. The comments received by the Board
and the other Agencies were discussed in the supplementary information above. Those comments
that are closely related to regulatory burden are highlighted below:
The Board requested comment on the scope of the term “customer” for purposes of the
Guidelines
mited resources of small institutions, yet few
commenters quantified the potential costs of compliance. The comments received by the Board
and the other Agencies were discussed in the supplementary information above. Those comments
that are closely related to regulatory burden are highlighted below:
The Board requested comment on the scope of the term “customer” for purposes of the
Guidelines. Many commenters opposed expanding the proposed scope of the Guidelines to apply
to information about business customers and consumers who have not established continuing
relationships with the financial institution. The commenters stated that an expanded scope would
impose higher costs of developing an information security program and would be inconsistent with
the use of the term “customer” in section 501 of the GLB Act and the Agencies’ Privacy Rule. As
explained in the supplementary information above, the Board has defined “customer” in the final
Guidelines in the same way as that term is defined in section __.3(h) of the Agencies’ Privacy
Rule.
Many commenters urged the Board to reduce the level of detail about the kinds of measures
that would be required to implement an information security program under the proposed
Guidelines. Commenters argued, for instance, that requiring particular testing procedures of
security systems would make the standards too onerous for those institutions for which other kinds
of tests and audits would be more suitable. In a similar vein, some commenters proposed that the
Board should issue examples that would illustrate the kinds of security measures that, if adopted,
would constitute compliance with the Guidelines.
The Board believes that many commenters may have misinterpreted the intent of the
original proposal regarding the particular safeguards that would be expected
s and audits would be more suitable. In a similar vein, some commenters proposed that the
Board should issue examples that would illustrate the kinds of security measures that, if adopted,
would constitute compliance with the Guidelines.
The Board believes that many commenters may have misinterpreted the intent of the
original proposal regarding the particular safeguards that would be expected. The provision that
requires each financial institution to consider a variety of security measures has been redrafted in
an effort to clarify that the institution must determine for itself which measures will be appropriate
to its own risk profile. Although an institution is required to consider each of the security
measures listed in paragraph III.C.1., it is not obligated to incorporate any particular security
measures or particular testing procedures into its information security program. Rather, the
institution may adopt those measures and use those tests that it concludes are appropriate. The
Board is mindful that institutions’ operations will vary in their complexity and scope of activities
and present different risk profiles to their customer information. Accordingly, the Board has not
established definitive security measures that, if adopted, would constitute compliance with the
28

Guidelines.
The Board asked for comments on several issues related to the appropriate security
standards pertaining to an institution’s arrangements with its service providers. As discussed
above, many comments addressed these issues and, notably, objected to a provision that would
require an institution to monitor its service providers through on-site audits. Several commenters
noted that the service providers often contract for audits of their systems and argued that an
institution should be able to rely upon those testing procedures
nts with its service providers. As discussed
above, many comments addressed these issues and, notably, objected to a provision that would
require an institution to monitor its service providers through on-site audits. Several commenters
noted that the service providers often contract for audits of their systems and argued that an
institution should be able to rely upon those testing procedures. Commenters also recommended
that an institution’s responsibility for information given to service providers require only that the
institution enter into appropriate contractual arrangements. The Board has modified the Guidelines
to clarify an institution’s responsibilities with respect to service providers. The Board has not
designed a standard that would require a financial institution to conduct an on-site audit of its
service provider’s security program. Instead, the Board adopted a standard that requires an
institution to monitor its service provider to confirm that it has satisfied its contractual obligations,
depending upon the institution’s risk assessment. In the course of conducting its risk assessment
and determining which service providers will need to be monitored, an institution may take into
account the fact that some of its service providers may be financial institutions that are directly
subject to these Guidelines or other standards promulgated by their primary regulator under section
501(b). Furthermore, after considering the comments about contracts with service providers and
the effective date of the Guidelines, the Board also adopted a transition rule, which parallels a
similar provision in the Privacy Rule, that provides a two-year period for grandfathering existing
contracts.
Many commenters addressed the burdens that would be imposed by the proposal due to the
effective date and urged the Board to extend the proposed July 1, 2001, effective date for period
ranging from one to two years
uidelines, the Board also adopted a transition rule, which parallels a
similar provision in the Privacy Rule, that provides a two-year period for grandfathering existing
contracts.
Many commenters addressed the burdens that would be imposed by the proposal due to the
effective date and urged the Board to extend the proposed July 1, 2001, effective date for period
ranging from one to two years. Most of these commenters argued that complying with the proposed
Guidelines by July 1, 2001, would place a considerable burden on their businesses, particularly
because the Guidelines would mandate changes to computer software, employee training, and
compliance systems. As discussed above, the Board believes that the dates for full compliance
with these Guidelines and the Privacy Rule should coincide. Financial institutions are required, as
part of their initial privacy notices, to describe their policies and practices with respect to
protecting the confidentiality and security of nonpublic personal information (12 CFR 216.6). The
Board believes that if the effective date of these Guidelines is extended beyond July 1, 2001, then
a financial institution may be placed in the position of providing an initial notice regarding
confidentiality and security and thereafter amending the privacy policy to accurately refer to the
federal standards once they became effective. Accordingly, the Board has adopted the proposed
effective date of July 1, 2001.
Institutions covered. The Board’s final Guidelines will apply to approximately 9,500
institutions, including state member banks, bank holding companies and certain of their nonbank
subsidiaries or affiliates, state uninsured branches and agencies of foreign banks, commercial
lending companies owned or controlled by foreign banks, and Edge and Agreement corporations.
The Board estimates that over 4,500 of the institutions are small institutions with assets less than
$100 million.
New compliance requirements. The final Guidelines contain new compliance
29
their nonbank
subsidiaries or affiliates, state uninsured branches and agencies of foreign banks, commercial
lending companies owned or controlled by foreign banks, and Edge and Agreement corporations.
The Board estimates that over 4,500 of the institutions are small institutions with assets less than
$100 million.
New compliance requirements. The final Guidelines contain new compliance
29

requirements for all covered institutions, many of which are contained in existing supervisory
guidance and examination

[Text truncated at 120,000 characters. The full text is on the page linked above.]

## Nearby sections

- [SR 00-3 (SUP) Information Technology Examination Frequency](https://www.frixlaw.com/law-library/statutes/FRB_SR0003.md)
- [SR 00-8 (SUP) Revised Uniform Retail Credit Classification and Account Management Policy](https://www.frixlaw.com/law-library/statutes/FRB_SR0008.md)
- [SR 00-9 (SPE) Supervisory Guidance on Equity Investment and Merchant Banking Activities](https://www.frixlaw.com/law-library/statutes/FRB_SR0009.md)
- [SR 00-13 (SUP) Framework for Financial Holding Company Supervision](https://www.frixlaw.com/law-library/statutes/FRB_SR0013.md)
- [SR 00-14 (SUP) Enhancements to the Interagency Program for Supervising the U.S. Operations of Foreign Banking Organizations](https://www.frixlaw.com/law-library/statutes/FRB_SR0014.md)
- [SR 01-4 (GEN) Subprime Lending](https://www.frixlaw.com/law-library/statutes/FRB_SR0104.md)
- [SR 01-5 (SUP) Examination of Fiduciary Activities](https://www.frixlaw.com/law-library/statutes/FRB_SR0105.md)
- [SR 01-11 (SUP) Identity Theft and Pretext Calling](https://www.frixlaw.com/law-library/statutes/FRB_SR0111.md)
- [SR 01-12 (SUP) Interagency Guidance on Loans Held for Sale](https://www.frixlaw.com/law-library/statutes/FRB_SR0112.md)
- [SR 01-14 (SUP) Joint Agency Advisory on Rate-Sensitive Deposits](https://www.frixlaw.com/law-library/statutes/FRB_SR0114.md)
- [SR 01-15 (SUP) Standards for Safeguarding Customer Information](https://www.frixlaw.com/law-library/statutes/FRB_SR0115.md)
- [SR 01-17 (SUP) Final Interagency Policy Statement on Allowance for Loan and Lease Losses (ALLL) Methodologies and Documentation for Banks and Savings Institutions](https://www.frixlaw.com/law-library/statutes/FRB_SR0117.md)
- [SR 01-21 (GEN) Communications with Foreign Bank Regulatory and Supervisory Authorities](https://www.frixlaw.com/law-library/statutes/FRB_SR0121.md)
- [SR 01-25 (GEN) Guidelines for Using External Experts on Examinations, Inspections, and Other Bank Supervision Matters](https://www.frixlaw.com/law-library/statutes/FRB_SR0125.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/FRB_SR0111. Check the current official text before relying on it. Not legal advice.