These include physical security, separation of duties, quality control, hardware and software access controls, and audit. Computer hardware and software technologies can help protect information resources. Although they vary, security features usually are available at each level of computer sophistication. Regardless of the controls adopted, they should apply to information produced and stored by both automated and manual methods. The appendix to this issuance provides additional detail on some areas of risk and some technology controls.
Information security is a functional responsibility.
And as a means to protect assets, it must be a strategic objective of the business. A sound system of internal controls and management policies must be established and enforced to satisfy this objective. The Board of Directors should require that information security policies exist throughout the bank corporation. These policies must be in writing and communicated to all personnel and other authorized users of bank information systems. Examiners may periodically target reviews of information security in the bank's supervisory strategy.