The SEC's rule simply requires firms to adopt policies and procedures addressing administrative, technical, and physical safeguards to protect customer records and information. The SEC's approach avoided rigid, proscriptive rules that would likely have caused firms to adopt procedures that lacked the flexibility to adapt to changes in technology, in their business, and their own information security requirements. Our recommendation is that the FTC's rule should follow along the lines of the SEC's rule. However, we believe that whatever form it takes, the FTC's rule should allow financial institutions the utmost flexibility in satisfying the GLB's safeguarding requirements. It is crucial that the rule's requirements be flexible because financial institutions are varied in their kinds and size of operations, structure and lines of business, types of services and products offered, customer base and personnel.
Institutions also differ in their risk profiles.
The rules must also account for technology, which is changing the way financial services firms to do business almost on a daily basis. In short, the rule's requirements must be flexible enough to allow financial institutions to structure their compliance efforts to best suit their businesses, and to adapt to ever advancing technology. Protecting customer records and information is extremely important for financial institutions and we appreciate the FTC's efforts to obtain public comment on the most appropriate way to satisfy the GLB's goals. We hope that our comments are helpful. SIA member firms are active in U.S. and foreign markets and in all phases of corporate and public finance.