I. Introduction Purpose and Scope of the Guide This small-entity compliance guide
1 is intended
to help financial institutions
2 comply with the Interagency Guidelines Establishing
Information Security Standards (security guidelines) (at
3-1571 and
4-863).
3 The guide summarizes the obligations of
financial institutions to protect customer information and illustrates
how certain provisions of the security guidelines apply to specific
situations. The appendix lists resources that may be helpful in assessing
risks and designing and implementing information security programs.
Although this guide was designed to help financial institutions
identify and comply with the requirements of the security guidelines,
it is not a substitute for the security guidelines. Moreover, this
guide only addresses obligations of financial institutions under the
security guidelines and does not address the applicability of any
other federal or state laws or regulations that may pertain to policies
or practices for protecting customer records and information.
Background and Overview of Security Guidelines The security guidelines implement section
501(b) of the Gramm-Leach-Bliley Act (GLB Act)
4 and section 216 of the Fair and Accurate Credit
Transactions Act of 2003 (FACT Act).
5 The security guidelines establish standards
relating to administrative, technical, and physical safeguards to
ensure the security, confidentiality, integrity, and the proper disposal
of customer information.
Each of the requirements in the security guidelines regarding
the proper disposal of customer information also apply to personal
information a financial institution obtains about individuals regardless
of whether they are the institution’s customers (“consumer information”).
Consumer information includes, for example, a credit report about
(1) an individual who applies for but does not obtain a loan; (2)
an individual who guarantees a loan; (3) an employee; or (4) a prospective
employee. A financial institution must require, by contract, its service
providers that have access to consumer information to develop appropriate
measures for the proper disposal of the information.
Under the security guidelines, each financial
institution must—
- develop and maintain an effective information security
program tailored to the complexity of its operations, and
- require, by contract, service providers that have
access to its customer information to take appropriate steps to protect
the security and confidentiality of this information.
The standards set forth in the security guidelines are
consistent with the principles the agencies follow when examining
the secu
rity programs of financial institutions.
6 Each financial institution must identify and evaluate risks to its
customer information, develop a plan to mitigate the risks, implement
the plan, test the plan, and update the plan when necessary. If an
agency finds that a financial institution’s performance is deficient
under the security guidelines, the agency may take action, such as
requiring that the institution file a compliance plan.
7The requirements of the security guidelines
and the interagency regulations regarding financial privacy (privacy
rule)
8 both relate to the confidentiality of customer information. However,
they differ in the following key respects:
- The security guidelines address safeguarding the confidentiality and security of customer information and ensuring
the proper disposal of customer information. They are directed toward
preventing or responding to foreseeable threats to, or unauthorized
access or use of, that information. The security guidelines provide
that financial institutions must contractually require their affiliated
and nonaffiliated third-party service providers that have access to
the financial institution’s customer information to protect that information.
- The privacy rule limits a financial institution’s disclosure of nonpublic personal information to unaffiliated
third parties, such as by selling the information to unaffiliated
third parties. Subject to certain exceptions, the privacy rule prohibits
disclosure of a consumer’s nonpublic personal information to a nonaffiliated
third party unless certain notice requirements are met and the consumer
does not elect to prevent, or “opt out of,” the disclosure.9 The privacy rule requires that privacy notices
provided to customers and consumers describe the financial institution’s
policies and practices to protect the confidentiality and security
of that information. It does not impose any other obligations with
respect to safeguarding customers’ or consumers’ information.
II. Important Terms Used in the
Security GuidelinesCustomer Information The security
guidelines require financial institutions to safeguard and properly
dispose of customer information. Customer information is any record
containing nonpublic personal information about an individual who
has obtained a financial product or service from the institution that
is to be used primarily for personal, family, or household purposes
and who has an ongoing relationship with the institution.
Customer Information Systems Customer information systems means any method
used to access, collect, store, use, transmit, protect, or dispose
of customer information (¶ I.C.2 of the security guidelines). Customer
information systems encompass all the physical facilities and electronic
facilities a financial institution uses to access, collect, store,
use, transmit, protect, or dispose of customer information. The security
guidelines apply specifically to customer information systems because
customer information will be at risk if one or more of the components
of these systems are compromised.
Information Security Program An information security program is the written
plan created and implemented by a financial institution to identify
and control risks to customer information and customer information
systems and to properly dispose of customer information. The plan
includes policies and procedures regarding the institution’s risk
assessment, controls, testing, service-provider oversight, periodic
review and updating, and reporting to its board of directors.
Service Providers Service provider means any party, whether affiliated
or not, that is permitted access to a financial institution’s customer
information through the provision of services directly to the institution (¶ I.C.2 of the security guidelines).
For example, a processor that directly obtains,
processes, stores, or transmits customer information on an institution’s
behalf is its service provider. Similarly, an attorney, accountant,
or consultant who performs services for a financial institution and
has access to customer information is a service provider for the institution.
III. Developing and Implementing an
Information Security ProgramParagraphs
II.A-B of the security guidelines require financial institutions to
implement an information security program that includes administrative,
technical, and physical safeguards designed to achieve the following
objectives:
- ensure the security and confidentiality of their
customer information;
- protect against any anticipated threats or hazards
to the security or integrity of their customer information;
- protect against unauthorized access to or use of
such information that could result in substantial harm or inconvenience
to any customer; and
- ensure the proper disposal of customer information.
To achieve these objectives, an information security
program must suit the size and complexity of a financial institution’s
operations and the nature and scope of its activities.
The various business units or divisions
of the institution are not required to create and implement the same
policies and procedures. If the business units have different security
controls, the institution must include them in its written information
security program and coordinate the implementation of the controls
to safeguard and ensure the proper disposal of customer information
throughout the institution.
Implementing an information security program begins with
conducting an assessment of reasonably foreseeable risks. Like other
elements of an information security program, risk-assessment procedures,
analysis, and results must be written.
Under the security guidelines, a risk assessment must
include the following four steps:
- identifying reasonably foreseeable internal and external
threats that could result in unauthorized disclosure, misuse, alteration,
or destruction of customer information or customer information systems;
- assessing the likelihood and potential damage of identified
threats, taking into consideration the sensitivity of the customer
information;
- assessing the sufficiency of the policies, procedures,
customer information systems, and other arrangements in place to control
the identified risks; and
- applying each of the foregoing steps in connection
with the disposal of customer information.
Identifying Reasonably Foreseeable
Internal and External Threats A risk
assessment must be sufficient in scope to identify the reasonably
foreseeable threats from within and outside a financial institution’s
operations that could result in unauthorized disclosure, misuse, alteration,
or destruction of customer information or customer information systems,
as well as the reasonably foreseeable threats due to the disposal
of customer information. The scale and complexity of its operations
and the scope and nature of an institution’s activities will affect
the nature of the threats an institution will face.
For example, a financial institution should review
the structure of its computer network to determine how its computers
are accessible from outside the institution. If the computer systems
are connected to the Internet or any outside party, an institution’s
assessment should address the reasonably foreseeable threats posed
by that connectivity.
The risk assessment also should address the reasonably
foreseeable risks to—
- customer information stored on systems owned or managed
by service providers, and
- customer information disposed of by the institution’s
service providers.
Assessing the Likelihood
and Potential Damage of Identified Threats In addition to identifying reasonably foreseeable threats to customer
information, customer information systems, and customer information
that a financial institution disposes of, a risk assessment must evaluate
the potential damage from these threats. The security guidelines allow
latitude to determine the sensitivity of customer information in the
course of assessing the likelihood of and potential damage from the
identified threats.
For example, to determine the sensitivity of customer
information, an institution could develop a framework that analyzes
the relative value of this information to its customers based on whether
improper access to or loss of the information would result in harm
or inconvenience to them.
In the course of assessing the potential threats identified,
an institution should consider its ability to identify unauthorized
changes to customer records. In addition, it should take into consideration
its ability to reconstruct the records from duplicate records or backup
information systems.
Assessing
the Sufficiency of Policies and Procedures Evaluating the sufficiency of policies and procedures is a key element
of a financial institution’s risk assessment. The evaluation process
includes identifying weaknesses or other deficiencies in existing
security controls and assessing the extent to which customer information
and customer information systems are at risk as a result of those
weaknesses. It should also identify the extent to which customer information
is at risk as a result of improper methods of disposal.
The risk assessment may include
an automated analysis of the vulnerability of certain customer information
systems. However, an automated analysis likely will not address manual
processes and controls, detection of and response to intrusions into
information systems, physical security, employee training, and other
key controls. Accordingly, an automated analysis of vulnerabilities
should be only one tool used in conducting a risk assessment.
When performing a risk assessment,
an institution may want to consult the resources and standards listed
in the appendix to this guide and consider incorporating the practices
developed by the listed organizations when developing its information
security program.
10A financial
institution may decide to hire an outside consultant to conduct the
risk assessment of its information security program, but it nevertheless
remains responsible for the adequacy of the assessment. Therefore,
the institution must ensure that the assessment specifically examines
the risks that relate to its customer information, customer information
systems, and systems for disposal of customer information.
For example, a generic assessment
that describes vulnerabilities commonly associated with the various
systems and applications used by the institution is inadequate. The
assessment should take into account the particular configuration of
the institution’s systems and the nature of its business.
If an outside consultant only examines
a subset of the institution’s risks, such as risks to
computer systems, that is insufficient to meet the requirement of
the security guidelines. The institution will need to supplement the
outside consultant’s assessment by examining other risks, such as
risks to customer records maintained in paper form.
For example, a financial institution
should also evaluate the physical controls put into place, such as
the security of customer information in cabinets and vaults.
Management must review the risk
assessment and use that assessment as an integral component of its
information security program to guide the development of, or adjustments
to, the institution’s information security program.
Engaging in an Ongoing Risk-Assessment Process Risk assessment is an ongoing process.
Financial institutions should continually review their current policies
and procedures to make certain they are adequate to safeguard customer
information and customer information systems. The review of policies
and procedures should also ensure the proper disposal of customer
information. Financial institutions should also include their review
and findings in their written information security program. The institution
must also update the risk assessment, as necessary, to account for
system changes before they are implemented, or new products or services
before they are offered.
IV. Designing
Security Controls The security guidelines
require a financial institution to design an information security
program to control the risks identified through its assessment, commensurate
with the sensitivity of the information and the complexity and scope
of its activities. Thus, an institution must consider a variety of
policies, procedures, and technical controls and adopt those measures
that it determines appropriately address the identified risks.
The security guidelines provide a list of measures that
an institution must consider and, if appropriate, adopt. These are—
- access controls on customer information systems, including
controls to authenticate and permit access only to authorized individuals
and controls to prevent employees from providing customer information
to unauthorized individuals who may seek to obtain this information
through fraudulent means;
- access restrictions at physical locations containing
customer information, such as buildings, computer facilities, and
records storage facilities to permit access only to authorized individuals;
- encryption of electronic customer information, including
while in transit or in storage on networks or systems to which unauthorized
individuals may have access;
- procedures designed to ensure that customer information
system modifications are consistent with the institution’s information
security program;
- dual control procedures, segregation of duties, and
employee background checks for employees with responsibilities for
or access to customer information;
- monitoring systems and procedures to detect actual
and attempted attacks on or intrusions into customer information systems;
- response programs that specify actions to be taken
when the institution suspects or detects that unauthorized individuals
have gained access to customer information systems, including appropriate
reports to regulatory and law enforcement agencies; and
- measures to protect against destruction, loss, or
damage of customer information due to potential environmental hazards,
such as fire and water damage or technological failures (¶ III.C.1.a-h
of the security guidelines).
For example, the security guidelines require
a financial institution to consider whether it should adopt controls
to authenticate and permit only authorized individuals access to certain
forms of customer information (¶ III.C.1.a of the security guidelines).
Under this security control, a financial institution also should consider
the need for a firewall for electronic records. If an institution
maintains any sort of Internet or other external connectivity, its
systems may require multiple firewalls with adequate
capacity, proper placement, and appropriate configurations.
Similarly, an institution must consider
whether the risk assessment warrants encryption of electronic customer
information. If it does, the institution must adopt appropriate encryption
measures that protect information in transit, in storage, or both
(¶ III.C.1.c of the security guidelines). However, the security guidelines
do not impose any specific authentication
11 or
encryption standards.
12A financial institution must consider the use of an intrusion
detection system to alert it to attacks on computer systems that store
customer information (¶ III.C.1.f. of the security guidelines). In
assessing the need for such a system, an institution should evaluate
the ability of its staff to rapidly and accurately identify an intrusion.
It should also assess the damage that could occur between the time
an intrusion occurs and the time the intrusion is recognized and action
is taken.
Financial institutions must develop, implement, and maintain
appropriate measures to properly dispose of customer information in
accordance with each of the requirements of paragraph III (¶ III.C.4.
of the security guidelines). Although the security guidelines do not
prescribe a specific method of disposal, the agencies expect institutions
to have appropriate risk-based disposal procedures for their records.
An institution should—
- ensure that paper records containing customer information
are rendered unreadable as indicated by its risk assessment, such
as by shredding or any other means; and
- recognize that computer-based records present unique
disposal problems. (Residual data frequently remains on media after
erasure. Since that data can be recovered, additional disposal techniques
should be applied to sensitive electronic data.)
In addition to considering the measures required
by the security guidelines, each institution may need to implement
additional procedures or controls specific to the nature of its operations.
An institution may implement safeguards designed to provide the same
level of protection to all customer information, provided that the
level is appropriate for the most sensitive classes of information.
Insurance coverage is not a substitute for an information
security program. Although insurance may protect an institution or
its customers against certain losses associated with unauthorized
disclosure, misuse, alteration, or destruction of customer information,
the security guidelines require a financial institution to implement
and maintain controls designed to prevent those acts from occurring.
Develop and Implement a Response
Program The agencies have issued an
interpretation of the security guidelines regarding programs to respond
to unauthorized access to customer information, the Interagency Guidance
on Response Programs for Unauthorized Access to Customer Information
and Customer Notice (incident response guidance) (at
3-1572).
13 According
to the incident response guidance, a financial institution should
develop and implement a response program as part of its information
security program. The response program should address unauthorized
access to or use of customer information that could result in substantial
harm or inconvenience to a customer.
The components of an effective response program include—
- assessment of the nature and scope of the incident
and identification of what customer information has been accessed
or misused;
- prompt notification to its primary federal regulator
once the institution becomes aware of an incident involving unauthorized
access to or use of sensitive customer information;
- notification to appropriate law enforcement authorities,
in addition to filing a timely suspicious-activity report, in situations
involving federal criminal violations requiring immediate attention;
- measures to contain and control the incident to prevent
further unauthorized access to or misuse of customer information,
while preserving records and other evidence; and
- notification to customers when warranted.
Circumstances for Customer
Notice The incident response guidance
describes when and how a financial institution should provide notice
to customers affected by unauthorized access or misuse of sensitive
customer information. In particular, it indicates that—
- once the institution becomes aware of an incident
of unauthorized access to sensitive customer information, it should
conduct a reasonable investigation to determine promptly the likelihood
that the information has been or will be misused.
- if the institution determines that misuse of customer
information has occurred or is reasonably possible, it should notify
any affected customer as soon as possible.14
Sensitive customer information means—
- a customer’s name, address, or telephone number,
in conjunction with the customer’s Social Security number, driver’s
license number, account number, credit or debit card number, or a
personal identification number or password that would permit access
to the customer’s account; or
- any combination of components of customer information
that would allow an unauthorized third party to access the customer’s
account electronically, such as user name and password or password
and account number.
V. Training Staff The security guidelines require a financial institution
to train staff to prepare and implement its information security program
(¶ III.C.2 of the security guidelines). The institution should consider
providing specialized training to ensure that personnel sufficiently
protect customer information in accordance with its information security
program.
For example, an institution should—
- train staff to recognize and respond to schemes to
commit fraud or identity theft, such as guarding against pretext calling;15
- provide staff members responsible for building or
maintaining computer systems and local and wide-area networks with
adequate training, including instruction about computer security;
and
- train staff to properly dispose of customer information.
VI. Testing Key Controls The security guidelines require a financial institution
to test the key controls, systems, and procedures of its information
security program (¶ III.C.3 of the security guidelines). The institution’s
risk assessment should determine the scope, sequence, and frequency
of testing.
The agencies expect an institution or its consultant to
regularly test key controls at a frequency that takes into account
the rapid evolution of threats to computer security. Testing may vary
over time depending, in part, on the adequacy of any improvements
an institution implements to prevent access after detecting an intrusion.
Independent third parties or staff members, other than those who develop or
maintain the institution’s security programs, must perform or review
the testing.
VII. Overseeing Service
Providers The security guidelines set forth
specific requirements that apply to a financial institution’s arrangements
with service providers. An institution must—
- exercise appropriate due diligence in selecting its
service providers;
- require its service providers by contract to implement
appropriate measures designed to meet the objectives of the security
guidelines; and
- where indicated by its risk assessment, monitor its
service providers to confirm that they have satisfied their obligations
under the contract described above.
As stated in section II of this guide, a service
provider is any party that is permitted access to a financial
institution’s customer information through the provision of services directly to the institution . Examples of service providers include
a person or corporation that tests computer systems or processes customers’
transactions on the institution’s behalf, document-shredding firms,
transactional Internet banking service providers, and computer network
management firms.
Contracts
with Service Providers The contract
provisions in the security guidelines apply to
all of a financial
institution’s service providers. After exercising due diligence in
selecting a company, the institution must enter into and enforce a
contract with the company that requires it to implement appropriate
measures designed to implement the
objectives of the security
guidelines.
16In particular, financial institutions must
require their service providers by contract to—
- implement appropriate measures designed to protect
against unauthorized access to or use of customer information maintained
by the service provider that could result in substantial harm or inconvenience
to any customer; and
- properly dispose of customer information.
In addition, the incident response guidance states
that an institution’s contract with its service provider should require
the service provider to take appropriate actions to address incidents
of unauthorized access to the financial institution’s customer information,
including notification to the institution as soon as possible following
any such incident.
Monitoring
Service Providers A financial institution
must monitor each of its service providers in accordance with its
risk assessment. However, the security guidelines do not impose any
specific requirements regarding the methods or frequency of monitoring
service providers to ensure that they are fulfilling their contractual
obligations. Some service providers are financial institutions that
are subject to the security guidelines, or to other standards for
safeguarding information promulgated by their primary regulator, and
therefore may have implemented their own information security programs.
To the extent that monitoring is warranted, a financial
institution must confirm that the service provider is fulfilling its
obligations under its contract. Institutions may review audits, summaries
of test results, or equivalent evaluations of a service provider’s
work. These audits, tests, or evaluations should be conducted by a
qualified party independent of management and personnel responsible
for the development or maintenance of the service provider’s security
program.
The reports of test results may contain proprietary information
about the service provider’s systems or they may include non-public
personal information about customers of an other financial institution.
Under certain circumstances it may be appropriate for service providers
to redact confidential and sensitive information from audit reports
or test results before giving the institution a copy. Where this is
the case, an institution should make sure that the information is
sufficient for it to conduct an accurate review, that all material
deficiencies have been or are being corrected, and that the reports
or test results are timely and relevant.
The institution should include reviews of its service
providers in its written information security program.
VIII. Adjusting the Program A financial institution should adjust its information
security program to reflect the results of its ongoing risk assessment
and the key controls necessary to safeguard customer information and
ensure the proper disposal of customer information. It should adjust
the program to take into account changes in technology, the sensitivity
of its customer information, internal or external threats to information,
and the institution’s own changing business arrangement such as mergers,
acquisitions, alliances and joint ventures, outsourcing arrangements,
and changes in customer information systems.
For example, the institution should ensure that
its policies and procedures regarding the disposal of customer information
are adequate if it decides to close or relocate offices. A change
in business arrangements may involve disposal of a larger volume of
records than in the normal course of business.
IX. Responsibilities of and Reports to the Board
of DirectorsUnder the security guidelines,
a financial institution’s board of directors, or an appropriate committee
of the board, must satisfy specific requirements designed to ensure
that the institution’s information security program is developed,
implemented, and maintained under the supervision of those who are
ultimately responsible. At the outset, the board, or appropriate committee,
must approve the written information security program. Thereafter,
the board or appropriate committee must oversee the implementation
and maintenance of the program. These duties include assigning specific
responsibility for implementing the program and reviewing management
reports (¶ III.A of the security guidelines).
Correspondingly, management must
provide a report to the board, or an appropriate committee, at least
annually that describes the overall status of the information security
program and compliance with the security guidelines. The report should
describe material matters relating to the program.
For example, whether an institution
conducts its own risk assessment or hires another person to conduct
it, management should report the results of that assessment to the
board or an appropriate committee.
The security guidelines provide an illustrative list of
other material matters that may be appropriate to include in the report,
such as decisions about risk management and control, arrangements
with service providers, results of testing, security breaches or violations
and management’s responses, and recommendations for changes in an
information security program (¶ III.F of the security guidelines).
Appendix This list of resources is intended to further assist financial institutions
in complying with the Interagency Guidelines Establishing Information
Security Standards. The listed organizations provide information on
computer security, with a focus on risk-assessment methodologies and
the design and implementation of computer security programs. Any mention
of a commercial product is for information purposes only and does
not imply a recommendation or endorsement by the agencies.
Center for Internet Security
(CIS). A nonprofit cooperative enterprise that helps organizations
reduce the risk of business and e-commerce disruptions resulting from
inadequate security configurations. CIS develops security benchmarks
through a global consensus process. Its members include the American
Institute of Certified Public Accountants (AICPA), Financial Management
Service of the U.S. Department of the Treasury, and Institute for
Security Technology Studies (Dartmouth College). www.cisecurity.org
CERT Coordination Center. A center for Internet security expertise operated by Carnegie Mellon
University. CERT provides security-incident reports, vulnerability
reports, security-evaluation tools, security modules, and information
on business continuity planning, intrusion detection, and network
security. It also offers training programs at Carnegie Mellon. CERT
has developed an approach for self-directed evaluations of information
security risk called Operationally Critical Threat, Asset, and Vulnerability
Evaluation (OCTAVE). www.cert.org/octave/
Information Systems Audit and Control Association
(ISACA). An association that develops IT auditing and control
standards and administers the Certified Information Systems Auditor
(CISA) designation. ISACA developed Control Objectives for Information
and Related Technology (COBIT) as a standard for IT security and control
practices that provides a reference framework for management, users,
and IT audit, control, and security practitioners. www.isaca.org/cobit.htm
International Organization
for Standardization (ISO). A network of national standards institutes
from 140 countries. Published ISO/IEC 17799:2000, Code of Practice
for Information Security Management. www.iso.org. Interested parties
should also review the Common Criteria for Information Technology
Security Evaluation. http://csrc.nist.gov/cc/CC-v2.1.html
Internet Security Alliance (ISA). A collaborative effort between Carnegie Mellon University’s Software
Engineering Institute, the university’s CERT Coordination Center,
and the Electronic Industries Alliance (a federation of trade associations).
ISA provides access to information on threats and vulnerability, industry
best practices, and developments in Internet security policy. www.isalliance.org
Institute for Security
Technology Studies (Dartmouth College). An institute that studies
and develops technologies to be used in counter-terrorism efforts,
especially in the areas of threat characterization and intelligence
gathering, threat detection and interdiction, preparedness and protection,
response, and recovery. The institute publishes a daily news summary
titled Security in the News, offers on-line training courses,
and publishes papers on such topics as firewalls and virus scanning.
The web site includes worm-detection tools and analyses of system
vulnerabilities. www.ists.dartmouth.edu
National Institute of Standards and Technology
(NIST). An agency within the U.S. Commerce Department’s Technology
Administration that develops and promotes measurements, standards,
and technology to enhance productivity. NIST operates the Computer
Security Resource Center, which is dedicated to improving information
systems security by raising awareness of IT risks, researching vulnerabilities,
and developing standards and tests to validate IT security. Four particularly
helpful documents are Special Publication 800-14,Generally Accepted
Principles and Practices for Securing Information Technology Systems;
Special Publication 800-18, Guide for Developing Security Plans for
Information Technology Systems; Special Publication 800-26, Security
Self-Assessment Guide for Information Technology Systems; Special
Publication 800-30, Risk Management Guide for Information Technology
Systems; and Federal Information Processing Standards Publication
199, Standards for Security Categorization of Federal Information
and Information Systems. The web site provides links to a large
number of academic, professional, and government-sponsored web sites
that provide additional information on computer or system security.
http://csrc.nist.gov.
National Security Agency (NSA). The National Security Agency/Central
Security Service is America’s cryptologic organization. It coordinates,
directs, and performs highly specialized activities to protect U.S.
information systems and produce foreign intelligence information.
A high technology organization, NSA is on the frontiers of communications
and data processing. The web site includes links to NSA research on
various information security topics. www.nsa.gov
Issued jointly by the Board of Governors of the Federal Reserve
System, the Federal Deposit Insurance Corporation, the Office of the
Comptroller of the Currency, and the Office of Thrift Supervision
Dec. 14, 2005.
