3.1.1 Interagency Guidelines

Agencies that regulate banks and related financial institutions have collaborated to develop Interagency Guidelines to implement the Safeguards Rule. The agencies that have adopted the Interagency Guidelines into their regulations, and the types of institutions that they regulate, are as follows:

• Office of the Comptroller of the Currency. Regulates national banks, federal branches and federal agencies of foreign banks, and any subsidiaries of these entities (other than brokers, dealers, insurers, investment companies, and investment advisers).
• Federal Reserve Board. Regulates member banks, branches and agencies of foreign banks, commercial lending companies owned or controlled by foreign banks, Edge and Agreement Act Corporations, bank holding companies and their nonbank subsidiaries or affiliates (other than brokers, dealers, insurers, investment companies, and investment advisers).
• Federal Deposit Insurance Corporation. Regulates state nonmember banks, insured state branches of foreign banks, and any subsidiaries of such entities, except brokers, dealers, insurers, investment companies, and investment advisers.
• Office of Thrift Supervision. Regulates insured savings associations and any subsidiaries, except brokers, insurers, investment companies, and investment advisers.³

The Interagency Guidelines require covered institutions to implement a “comprehensive written information security program” to safeguard nonpublic personal information.⁴ The agencies stated that financial institutions must take the following steps while developing and implementing their programs:

• Involve the board of directors. The board or a board committee should approve the security program and oversee its development, implementation, and maintenance.
• Assess risk. The institutions should conduct an “assessment of reasonably foreseeable risks” involving the security of customer information.
• Manage and control risk. The institutions should design their programs to control the risks by considering measures such as access controls, restrictions on physical locations where customer information is stored, encryption of information in transit and at rest, segregation of duties, background checks for employees, and system monitoring.
  • Train employees on the information security program.
  • Maintain regular testing of controls and systems.
  • Properly dispose of customer information.
  • Provide adequate oversight of service providers' information security measures.
  • Adjust information security programs as new threats arise.
  • Report to board of directors any material matters related to the information security program at least once a year.⁵

The Interagency Guidelines further require financial institutions to maintain incident response programs for sensitive customer information, which the guidelines define as a customer's name, address, or phone number in combination with at least one of the following:

• Social Security number,
• driver's license number,
• account number,
• credit or debit card number, or
• personal identification number or password that permits access to a customer's account.

Sensitive customer information includes any additional information that would enable an unauthorized user to access a customer's account (i.e., username and password).

Incident response programs for sensitive information must contain procedures to:

• assess “the nature and scope of the incident and identification of what customer information has been accessed or misused”;
• determine what information types have been accessed;
• notify its primary federal regulator (e.g., the Office of the Comptroller of the Currency) as soon as possible after the institution becomes aware of an incident;
• notify appropriate law enforcement authorities consistent with requirements to file Suspicious Activity Reports;
• take steps “to contain and control the incident to prevent further unauthorized access to or misuse of customer information, while preserving records and other evidence”; and
• notify the customer as soon as possible if the institution, after investigation, determines that sensitive customer information likely was misused, or that the unauthorized access likely will result in misuse or harm to individuals (the institution may delay notification if law enforcement provides a written request for a delay because notice would interfere with a law enforcement investigation).⁶ Note that this requirement is similar to the state laws that take a “risk-of-harm” approach to notification requirements, as it allows financial institutions to conduct a balancing test to determine whether to issue notifications.

The notices must contain: a description, in general, of the data breach, the types of information that were accessed without authorization, and mitigation steps taken by the financial institution; a telephone number for further information about the breach; and a reminder to “remain vigilant” and report apparent identity theft. ⁷

Although the Interagency Guidelines are comprehensive, the banking regulators have not focused on enforcement of their data security regulations as much as many other regulators, such as the Securities and Exchange Commission and the FTC.

3.1.2 Securities and Exchange Commission Regulation S-P

The Securities and Exchange Commission's Regulation S-P sets the GLBA Safeguards Rule requirements for brokers, dealers, investment companies, and investment advisers that are registered with the SEC.⁸ The SEC's version of the Safeguards Rule is not as detailed as the Interagency Guidelines, though the SEC has been fairly aggressive in its enforcement of the rule in recent years.

The SEC's regulations broadly require institutions to adopt written information security policies and procedures that contain administrative, technical, and physical safeguards that meet the three goals of the GLBA Safeguards Rule: insuring security and confidentiality of customer information, protecting the information from anticipated threats or hazards, and protecting the information from unauthorized access that could substantially harm or inconvenience the customer.⁹ Regulation S-P also requires institutions to properly dispose of consumer report information and take steps to protect against unauthorized access.¹⁰

Despite the relative lack of specificity in the SEC's version of the Safeguards Rule, the agency has indicated that cybersecurity is a high priority, and that it will use the regulation to pursue institutions that do not adequately protect customer information. In September 2015, the SEC announced a settlement of an administrative proceeding with R.T. Jones Capital Equities Management, an investment adviser that experienced a data breach, originating in China, and exposed the personal information of approximately 100,000 people.¹¹ Although R.T. Jones notified affected individuals and there were no reports of harm, the SEC brought the administrative action because the company did not have a written information security program. In the settlement order, the SEC noted that the company failed to conduct periodic risk assessments, use a firewall to protect the web server that contains client information, encrypt customer information, or develop an incident response plan.¹² The no-fault settlement required the company to cease future violations of the SEC's Safeguards Rule and to pay a $75,000 penalty. In announcing the settlement, Marshall S. Sprung, Co-Chief of the SEC Enforcement Division's Asset Management Unit, warned that firms “must adopt written policies to protect their clients' private information and they need to anticipate potential cybersecurity events and have clear procedures in place rather than waiting to react once a breach occurs.”¹³

3.1.3 FTC Safeguards Rule

The FTC regulates financial institutions that are not regulated by one of the banking agencies or the SEC. Among the types of financial institutions that the FTC regulates are consumer reporting agencies, retailers that offer credit to customers, and mortgage brokers.

Like the SEC, the FTC did not pass an incredibly detailed Safeguards Rule. Nonetheless, the FTC has been quite aggressive in its enforcement of the Safeguards Rule, partly due to the key role that customer information plays for consumer reporting agencies and other financial institutions regulated by the FTC.

The FTC's Safeguards Rule, like those of the other agencies, requires financial institutions to develop, implement, and maintain a comprehensive written information security program that contains administrative, technical, and physical safeguards that meet the GLBA Safeguards Rule's three key objectives listed at the start of this chapter.

The FTC's regulations require information security programs to be carried out and protected as follows:

• Designate employees to coordinate the program.
• Identify “reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information.” The assessment should consider, at minimum, workforce training, information systems, intrusion detection and prevention programs, and incident response plans.
• Based on this assessment, companies should implement safeguards, and conduct regular assessments of the strength and viability of those safeguards.
• Contractually require service providers to comply with the Safeguards Rule and oversee their compliance.
• Regularly evaluate and adjust information security policies and procedures.

The FTC has brought a number of enforcement actions against companies that failed to develop information security programs that meet these requirements. Typically, the FTC brings cases after a financial institution has experienced a data breach. The summaries that follow are a few of the most prominent settlements of enforcement actions that the FTC has brought under the Safeguards Rule.

In the Matter of Goal Financial, LLC, Docket No. C-4216 (2008)

The FTC also expects companies to adequately oversee their employees' handling of personal information. In such a case, employees of Goal Financial, a marketer and originator of student loans, transferred more than 7000 consumer files to third parties. Additionally, a Goal Financial employee sold hard drives that had not yet been wiped of approximately 34,000 customers' sensitive personal information. In its complaint against Goal Financial, the FTC alleged that the company violated the Safeguards Rule by failing to: identify reasonably foreseeable risks, design and implement safeguards to control those risks, develop a written information security program, and require contractors to safeguard customer information.

3.2.1 Financial Institutions or Creditors

The FTC and banking regulators issued their first iteration of the Red Flag regulations in 2007, but the regulations' implementation was delayed after an outcry from the business community about the lack of clarity in the regulations. Although “financial institution” is clearly defined, the regulations contained a broad definition of “creditor” that could have included professionals such as doctors and lawyers because they bill clients after they perform the services. Many such professionals argued that their operations do not pose a substantial risk of identity theft, and therefore they should not be required to develop comprehensive identity theft prevention programs.

Congress responded to the industry concerns in 2010 by passing the Red Flag Program Clarification Act of 2010.¹⁵ The law defines “creditor” as a company that, in the ordinary course of business:

1. obtains or uses consumer reports, directly or indirectly, in connection with a credit transaction;
2. furnishes information to consumer reporting agencies … in connection with a credit transaction; or
3. advances funds to or on behalf of a person, based on an obligation of the person to repay the funds or repayable from specific property pledged by or on behalf of the person.²¹

The Clarification Act explicitly states that the term “creditor” does not include an entity that “advances funds on behalf of a person for expenses incidental to a service provided by the creditor to that person.”²²

The new definition clarifies that the Red Flag Rule applies to financial institutions; companies that obtain, use, or provide information for credit reports; or companies that lend money to people, provided that the loan is for something other than the lender's own services. Accordingly, under the clarified Red Flag Rule, a doctor or lawyer does not become subject to the Red Flag Rule merely by billing a customer after providing the service.

3.2.2 Covered Accounts

Not all financial institutions and creditors are covered by the Red Flag Rule. The requirements only apply if the company offers a “covered account.” The Red Flag Rule regulations define “covered accounts” as including two types of accounts:

1. [a]n account that a financial institution or creditor offers or maintains, primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions, such as a credit card account, mortgage loan, automobile loan, margin account, cell phone account, utility account, checking account, or savings account; and
2. [a]ny other account that the financial institution or creditor offers or maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness of the financial institution or creditor from identity theft, including financial, operational, compliance, reputation, or litigation risks.²³

To determine whether an account falls within either definition, the regulations instruct the financial institution or creditor to consider the methods that the company provides to open its accounts, the methods that the company provides to access the accounts, and the company's previous experience with identity theft.²⁴ Keep in mind that the regulations apply as long as the financial institution or creditor has at least one covered account.

In other words, financial institutions and creditors must conduct a balancing test to determine whether the risk of identity theft to its customers is reasonably foreseeable. They are only required to develop an identity theft prevention plan if they determine that the risk is reasonably foreseeable and, therefore, they offer covered accounts. The regulators expect the companies to periodically reassess this risk. Companies should make an honest assessment of the risk. If a company obtains highly sensitive personal information via an unencrypted Internet connection, it is difficult to conceive of how a company could find that there is not a reasonably foreseeable risk of identity theft. It is a best practice to document the reasoning behind the determination of whether a company offers a covered account.

3.2.3 Requirements for a Red Flag Identity Theft Prevention Program

The Red Flag regulations require financial institutions and creditors that offer at least one covered account to develop a written identity theft prevention program designed “to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account.”²⁵

The written program must explain how the financial institution or creditor will accomplish four goals:

1. Identify “red flags,” which the regulations define as a “pattern, practice, or specific activity that indicates the possible existence of identity theft.”²⁶ Among the red flags that the regulators have stated companies should consider are risk factors (e.g., the types of covered accounts and the methods through which customers can access these accounts), the sources of the red flags, and categories of red flags (e.g., alerts that have been provided to the businesses by law enforcement agencies, victims, and others).
2. Detect the red flags that the financial institution or creditor has identified. Companies should obtain identifying information about and verify the identities of people opening covered accounts, authenticate those customers, monitor their transactions, and verify the validity of address change requests.
3. Appropriately respond to red flags that are detected to prevent and mitigate identity theft. The regulators wrote that appropriate responses may include continued monitoring of customers' accounts, contacting customers or law enforcement to inform them of red flags, modifying log-in credentials to customer accounts, or closing accounts that appear to have been compromised.²⁷
4. Periodically update the Red Flag program to reflect changes in risk. When updating the program, the regulation states, financial institutions and creditors should consider, among other things, recent incidents of identity theft that the company has experienced, changes to identity theft mitigation practices, new types of identity theft, and changes to the company's structure or ownership that might increase the likelihood of identity theft.²⁸

3.5.1 CIP-003-6: Cybersecurity – Security Management Controls

At least every fifteen months, utilities' senior managers should approve cybersecurity policies that address:

• employee training;
• electronic security perimeters, including remote access;
• cyber system physical security;
• system security management;
• incident response planning;
• incident recovery plans;
• configuration change management;
• information protection; and
• response to exceptional circumstances.

Utilities should name a responsible manager for leading the implementation of the cybersecurity standards, who is permitted to delegate authority to other employees, provided that this delegation has been approved by a senior manager of the utility. In practice, it is common for the responsible manager to be a Chief Information Security Officer or equivalent.

3.5.2 CIP-004-6: Personnel and Training

Utilities should implement quarterly training for security awareness that “reinforces cybersecurity practices (which may include associated physical security practices) for the [utilities'] personnel who have unauthorized electronic or authorized unescorted physical access” to the utilities' systems. These training sessions should be designed for individual jobs. For instance, a supervisor's training likely will differ from those of a line worker.

Utilities should review employees' criminal history at least once every seven years, and conduct other “personnel risk assessment” programs for individuals who need access to utilities' cyber systems.

In addition to training, utilities should ensure that employees do not have access to cyber systems when they no longer need to have access (e.g., if they leave their jobs). Utilities also should develop processes to timely revoke access to cyber systems.

3.5.3 CIP-006-6: Physical Security of Cyber Systems

This guideline requires utilities to develop a comprehensive plan for the physical security of facilities that house the utilities' cyber systems. These plans should include controls such as intrusion alarms and logs of physical entries. The policies should require “continuous escorted access of visitors” within the physical perimeter of the utility's facilities, except under exceptional circumstances.

3.5.4 CIP-007-6: Systems Security Management

To minimize the attack surface, when technically feasible, utilities should enable only the logical network accessible ports that are needed for the utilities' operations. The utilities also should implement a patch management process. At least once every thirty-five days, the utilities should evaluate new security patches and take other steps to reduce the likelihood of harm from malicious code.

CIP-007-6 suggests that utilities maintain audit logs of failed log-in attempts, malicious code, and other potential cybersecurity events. Utilities should develop a process that alerts them to such events.

The guidelines also require utilities to pay close attention to log-in credentials. Utilities should inventory user accounts, change default passwords, establish standards for minimum password length, and, when possible, require authorized users to change passwords at least once every fifteen months. Utilities also should either impose a maximum number of failed login attempts, or implement a system that alerts the information security staff of unsuccessful login attempts.

3.5.5 CIP-009-6: Recovery Plans for Cyber Systems

CIP-009-6 provides a framework for utilities to create plans that enable them to respond to cyber incidents. Utilities should develop recovery plans that designate specific responsibilities for responders, describe how data will be stored, and provide plans for backing up and preserving data after an incident. At least once every fifteen months, utilities should test recovery plans by recovering from an incident that has occurred during that time period, conducting a paper drill or tabletop exercise, or conducting an operational exercise. The utilities should test the recovery plans at least once every thirty-six months through an “operational exercise of the recovery plans.”

Within ninety days of a recovery plan test or actual recovery, utilities should document “lessons learned,” update the recovery plan, and notify relevant individuals of the updates.

3.5.6 CIP-010-2: Configuration Change Management and Vulnerability Assessments

Utilities must develop configuration change management processes to “prevent unauthorized modifications” to cyber systems. Change management processes should include a “baseline configuration” that identifies operating systems, installed software, accessible ports, and security patches. The processes also should authorize and document any changes that fail to comply with this baseline configuration.

At least once every thirty-five days, utilities should monitor for deviations from the baseline configuration. At least once every fifteen months, they should conduct a vulnerability assessment to ensure proper implementation of cybersecurity controls. At least every thirty-six months, when feasible, the utility should assess the vulnerabilities, based on this baseline configuration.

Utilities should authorize the use of transient cyber assets (e.g., removable media), except in exceptional circumstances. The authorization should specify the users, locations, defined acceptable use, operating system, firmware, and software on the removable media. Utilities must determine how to minimize threats to these transient assets. Within thirty-five days before use of a transient cyber asset, utilities must ensure that security patches to all transient cyber assets are updated.

3.5.7 CIP-011-2: Information Protection

Utilities should implement information protection programs that include procedures for securely handling information regardless of whether the data is at rest and in transit. Utilities should prevent the “unauthorized retrieval” of information from their systems and ensure that information is securely disposed.