Safeguards

Ergebnisse, die auf diesem Abschnitt ruhen

Die Regeln unten verweisen in ihrem Ergebnis auf diesen Abschnitt. Das Verdikt ist eine maschinelle Einordnung, kein Urteil über einen Einzelfall.

• glba-qualified

  No qualified individual is designated

  16 CFR 314.4(a) requires designating a qualified individual responsible for the program, and 16 CFR 314.4(i) requires reporting to the board or equivalent.

  Risiko, Die Anforderung gilt

• glba-encryption

  Encryption is required, or a documented equivalent control

  16 CFR 314.4(c)(3) requires encryption of customer information at rest and in transit, or an equivalent compensating control approved in writing by the qualified individual.

  Risiko, Die Anforderung gilt bedingt

• glba-small

  The full rule applies, including risk assessment and incident response

  16 CFR 314.6 exempts those maintaining information on fewer than 5,000 customers from certain parts. At 5,000 customers or more the written risk assessment in 16 CFR 314.4(b), the incident response plan in 314.4(h) and the board report in 314.4(i) also apply.

  Risiko, Die Anforderung gilt

Abschnittsknoten

• Information security program16 CFR 314.4(a)
• Risk assessment16 CFR 314.4(b)
• Notification of a security event16 CFR 314.5