And as a means to protect assets, it must be a strategic objective of the business. A sound system of internal controls and management policies must be established and enforced to satisfy this objective. The Board of Directors should require that information security policies exist throughout the bank corporation. These policies must be in writing and communicated to all personnel and other authorized users of bank information systems. Examiners may periodically target reviews of information security in the bank's supervisory strategy.
Some risk exists in every system and operation of the bank, whether manual or automated.
Management must recognize the types of systems and operations that pose greater risks to information security. This helps prevent unauthorized viewing and altering of electronic data transactions during transmission or storage. This code is used with data encryption to further secure transmission of large dollar payments. Some systems can control access by user, by transaction, and by terminal. Security violations, including attempts can be reported.