They need to designate a Security Program Coordinator to oversee the information security program and conduct a comprehensive risk assessment to identify and evaluate risks. Financial institutions must develop and implement a written data security program that includes policies and procedures to safeguard customer NPI, provide comprehensive employee training, and exercise oversight of employees and service providers. Regular evaluation and adjustments to the program are necessary, along with proper oversight of service providers. By following these steps, financial institutions can establish a robust data security program, protect customer NPI, and demonstrate compliance with the GLBA Safeguards Rule.