It must document compliance with guidelines set by 501b and inform the board of the effectiveness and current status of the security program. Implement a risk assessment process that is commensurate with the size and complexity of bank. Determine the sensitivity of customer information. Assess the adequacy of the security program including policies, procedures, customer information systems, and other controls. Monitor and adjust the program based on internal and external factors.
Authentication controls that grant access to only authorized individuals and companies.
Physical security controls to buildings, computer facilities and information storage facilities. Protective controls against physical hazards such as fire or water damage. Encryption of information including in transit data or data stored on networks and critical computer systems. Change control processes that ensure system modifications comply with the defined security policies. Controls for internal employee risk.