I. Background This guidance
1 interprets section 501(b) of
the Gramm-Leach-Bliley Act (GLBA) and the In
teragency
Guidelines Establishing Information Security Standards (the security
guidelines)
2 and describes response programs, including
customer-notification procedures, that a financial institution should
develop and implement to address unauthorized access to or use of
customer information that could result in substantial harm or inconvenience
to a customer. The scope of, and definitions of terms used in, this
guidance are identical to those of the security guidelines. For example,
the term
customer information is the same term used in the
security guidelines, and means any record containing nonpublic personal
information about a customer, whether in paper, electronic, or other
form, maintained by or on behalf of the institution.
Section 501(b) of the GLBA required the agencies
to establish appropriate standards for financial institutions subject
to their jurisdiction that include administrative, technical, and
physical safeguards, to protect the security and confidentiality of
customer information. Accordingly, the agencies issued security guidelines
requiring every financial institution to have an information security
program designed to—
1.
ensure the security and confidentiality of customer information;
2.
protect
against any anticipated threats or hazards to the security or integrity
of such information; and
3.
protect
against unauthorized access to or use of such information that could
result in substantial harm or inconvenience to any customer.
B. Risk Assessment and Controls 1. The security guidelines direct every
financial institution to assess the following risks, among others,
when developing its information security program:
a.
reasonably foreseeable internal and external threats that could
result in unauthorized disclosure, misuse, alteration, or destruction
of customer information or customer information systems;
b.
the
likelihood and potential damage of threats, taking into consideration
the sensitivity of customer information; and
c.
the
sufficiency of policies, procedures, customer information systems,
and other arrangements in place to control risks.
3
2. Following the assessment of these risks, the
security guidelines require a financial institution to design a program
to address the identified risks. The particular security measures
an institution should adopt will depend upon the risks presented by
the complexity and scope of its business. At a minimum, the financial
institution is required to consider the specific security measures
enumerated in the security guidelines,
4 and adopt those that are appropriate for
the institution,
including—
a.
access
controls on customer information systems, including controls to authenticate
and permit access only to authorized individuals and controls to prevent
employees from providing customer information to unauthorized individuals
who may seek to obtain this information through fraudulent means;
b.
background
checks for employees with responsibilities for access to customer
information; and
c.
response programs that specify actions to be taken when the financial
institution suspects or detects that unauthorized individuals have
gained access to customer information systems, including appropriate
reports to regulatory and law enforcement agencies.
5
C. Service Providers The security guidelines direct every
financial institution to require its service providers by
contract
to implement appropriate measures designed to protect against unauthorized
access to or use of customer information that could result in substantial
harm or inconvenience to any customer.
6Millions of Americans, throughout the country, have been victims
of identity theft.
7 Identity thieves misuse personal information they obtain from
a number of sources, including financial institutions, to perpetrate
identity theft. Therefore, financial institutions should take preventative
measures to safeguard customer information against attempts to gain
unauthorized access to the information. For example, financial institutions
should place access controls on customer information systems and conduct
background checks for employees who are authorized to access customer
information.
8 However, every financial institution should also develop and
implement a risk-based response program to address incidents of unauthorized
access to customer information in customer information systems
9 that occur nonetheless. A response program
should be a key part of an institution’s information security program.
10 The program should be appropriate
to the size and complexity of the institution and the nature and scope
of its activities.
In addition, each institution should be able to address
incidents of unauthorized access to customer information in customer
information systems maintained by its domestic and foreign service
providers. Therefore, consistent with the obligations in the Guidelines
that relate to these arrangements, and with existing guidance on this
topic issued by the agencies,
11 an institution’s contract with its service provider
should require the service provider to take appropriate actions to
address incidents of unauthorized access to the financial institution’s
customer information, including notification to the institution as
soon as possible of any such incident, to enable the institution to
expeditiously implement its response program.
1. At a minimum, an institution’s response program
should contain procedures for the following:
a.
assessing
the nature and scope of an incident, and identifying what customer
information systems and types of customer information have been accessed
or misused;
b.
notifying
its primary federal regulator as soon as possible when the institution
becomes aware of an incident involving unauthorized access to or use
of sensitive customer information, as defined below;
c.
consistent
with the agencies’ suspicious-activity report (SAR) regulations,
12 notify
ing appropriate law enforcement authorities, in addition to
filing a timely SAR in situations involving federal criminal violations
requiring immediate attention, such as when a reportable violation
is ongoing;
d.
taking
appropriate steps to contain and control the incident to prevent further
unauthorized access to or use of customer information, for example,
by monitoring, freezing, or closing affected accounts, while preserving
records and other evidence;
13 and
e.
notifying
customers when warranted.
2. Where an incident of unauthorized access
to customer information involves customer information systems maintained
by an institution’s service providers, it is the responsibility of
the financial institution to notify the institution’s customers and
regulator. However, an institution may authorize or contract with
its service provider to notify the institution’s customers or regulator
on its behalf.
III. Customer Notice Financial institutions have an affirmative duty
to protect their customers’ information against unauthorized access
or use. Notifying customers of a security incident involving the unauthorized
access or use of the customer’s information in accordance with the
standard set forth below is a key part of that duty. Timely notification
of customers is important to manage an institution’s reputation risk.
Effective notice also may reduce an institution’s legal risk, assist
in maintaining good customer relations, and enable the institution’s
customers to take steps to protect themselves against the consequences
of identity theft. When customer notification is warranted, an institution
may not forgo notifying its customers of an incident because the institution
believes that it may be potentially embarrassed or inconvenienced
by doing so.
A. Standard for
Providing Notice When a financial institution
becomes aware of an incident of unauthorized access to sensitive customer
information, the institution should conduct a reasonable investigation
to promptly determine the likelihood that the information has been
or will be misused. If the institution determines that misuse of its
information about a customer has occurred or is reasonably possible,
it should notify the affected customer as soon as possible. Customer
notice may be delayed if an appropriate law enforcement agency determines
that notification will interfere with a criminal investigation and
provides the institution with a written request for the delay. However,
the institution should notify its customers as soon as notification
will no longer interfere with the investigation.
1. Sensitive customer information. Under the guidelines, an institution must protect against unauthorized
access to or use of customer information that could result in substantial
harm or inconvenience to any customer. Substantial harm or inconvenience
is most likely to result from improper access to sensitive customer
information because this type of information is most likely to be
misused, as in the commission of identity theft. For purposes of this
guidance, sensitive customer information means a customer’s name,
address, or telephone number, in conjunction with the customer’s Social
Security number, driver’s license number, account number, credit or
debit card number, or a personal identification number or password
that would permit access to the customer’s account. Sensitive customer
information also includes any combination of components of customer
information that would allow someone to log onto or access the customer’s
account, such as user name and password or password and account number.
2. Affected customers. If a financial institution, based upon its investigation, can determine
from its logs or other data precisely which customers’ information
has been improperly accessed, it may limit notification to those customers
with regard to whom the institution determines that misuse of their
information has occurred or is reasonably possible. However, there
may be situations where the institution determines that a group of
files has been accessed improperly, but is unable to identify which
specific customers’ information has been accessed. If the circumstances
of the unauthorized access lead the institution to determine that
misuse of the information is reasonably possible, it should notify
all customers in the group.
B. Content of Customer Notice 1. Customer
notice should be given in a clear and conspicuous manner. The notice
should describe the incident in general terms and the type of customer
information that was the subject of unauthorized access or use. It
also should generally describe what the institution has done to protect
the customers’ information from further unauthorized access. In addition,
it should include a telephone number that customers can call for further
information and assistance.
14 The notice
also should remind customers of the need to remain vigilant over the
next 12 to 24 months, and to promptly report incidents of suspected
identity theft to the institution. The notice should include the following
additional items, when appropriate:
a.
a
recommendation that the customer review account statements and immediately
report any suspicious activity to the institution;
b.
a
description of fraud alerts and an explanation of how the customer
may place a fraud alert in the customer’s consumer reports to put
the customer’s creditors on notice that the customer may be a victim
of fraud;
c.
a
recommendation that the customer periodically obtain credit reports
from each nationwide credit reporting agency and have information
relating to fraudulent transactions deleted;
d.
an
explanation of how the customer may obtain a credit report free of
charge; and
e.
information
about the availability of the FTC’s online guidance regarding steps
a consumer can take to protect against identity theft. The notice
should encourage the customer to report any incidents of identity
theft to the FTC, and should provide the FTC’s web site address and
toll-free telephone number that customers may use to obtain the identity
theft guidance and report suspected incidents of identity theft.
15
The agencies encourage financial institutions
to notify the nationwide consumer reporting agencies prior to sending
notices to a large number of customers that include contact information
for the reporting agencies.
C. Delivery of Customer Notice Customer
notice should be delivered in any manner designed to ensure that a
customer can reasonably be expected to receive it. For example, the
institution may choose to contact all customers affected by telephone
or by mail, or by electronic mail for those customers for whom it
has a valid e-mail address and who have agreed to receive communications
electronically.
12 CFR 208, appendix D-2, supplement
A; 12 CFR 225, appendix F, supplement A; effective March 29, 2005.
