The agencies list proposed factors that an institution should consider when evaluating its security policies. The Roundtable and BITS believe that this is intended to ensure that financial institutions have appropriate security measures in place to prevent unauthorized access to customer information. However, this statement could be misinterpreted to apply to a customer's right to access financial information maintained by a financial institution under laws such as the Fair Credit Reporting Act. Accordingly, The Roundtable and BITS encourage the agencies to delete this factor. This language would require encryption in many cases where encryption is not appropriate.
Encryption can be a complex and sophisticated approach to protecting confidential data.
Requiring institutions to use encryption when it is not necessary could impair two-way electronic communication between financial institutions and their customers. The Roundtable and BITS recommend the agencies change this section to focus on protection of customer data rather than a particular methodology for doing so. The agencies invite comment on the degree of detail that should be included in the Guidelines regarding a risk management program. The Roundtable and BITS strongly encourage the agencies to adopt guidelines that provide institutions sufficient flexibility to adopt policies and procedures that best reflect appropriate business and risk management practices for each individual institution. The agencies ask for comment on whether specific types of security tests, such as penetration tests or intrusion detections, should be required.