Financial Industry Compliance: Part 1, Survey of Regulations
by Val Hetrick, Fiberlink
The financial industry is of course highly regulated. But what financial industry regulations and standards apply specifically to endpoints, and to data stored on mobile and distributed devices?
We did a little research on the subject, and would like to share our findings.
In this post we will survey several of the relevant laws.
In the next two posts we will look at the endpoint-related content in two excellent comprehensive guides, the Information Security Handbook from the Federal Financial Institutions Examination Council (FFIEC), and the Data Security in Financial Services report from the UK Financial Services Authority (FSA).
In the fourth post we will discuss a new MaaS360® offering designed specifically to address the endpoint compliance requirements of financial firms.
So here is a quick survey of key regulations that specifically address protecting data on endpoints or protecting data transmitted wirelessly to and from mobile devices.
Massachusetts 201 CMR 17.00
Massachusetts law 201 CMR 17.00, states that laptops containing confidential information about Massachusetts residents must be protected by data encryption, firewalls, and up-to-date anti-virus files.
http://www.mass.gov/Eoca/docs/idtheft/201CMR1700reg.pdf
Nevada NRS 603A
Nevada NRS 603A specifies that personal data transmitted electronically must be encrypted. It also specifies that organizations that accept payment cards must comply with the Payment Card Industry Data Security Standard (PCI DSS).
http://www.leg.state.nv.us/NRs/NRS-603A.html
The “Safeguards Rule” (Regulation S-P)
The “Safeguards Rule,” Rule 30(a) of Regulation S-P (17 C.F.R. § 248), applies to brokers, dealers, investment companies, and investment advisers registered with the Securities and Exchange Commission (SEC). These firms must: “adopt written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information.” Further, “These written policies and procedures must be reasonably designed to… Protect against any anticipated threats or hazards to the security or integrity of customer records and information.”
This regulation clearly covers data stored on distributed computers. The SEC recently fined a firm $100,000 because the company did not require its registered representatives to have anti-virus software on their computers.
California SB 1386
Forty-five of the fifty U.S. states have data breach laws that require the notification of potential victims of security breaches. One of the best known and most stringent is California SB 1386.
Fortunately, many of these laws include a “safe harbor” clause for encrypted data. If a laptop or mobile device is lost or stolen, the requirement to notify potential victims can be eliminated if the organization proves that lost information was encrypted.
http://info.sen.ca.gov/pub/01-02/bill/sen/sb_1351-1400/sb_1386_bill_20020926_chaptered.html
H.R. 2221
In 2009 the U.S. House of Representatives passed H.R. 2221, the “Data Accountability and Trust Act.” If enacted by the U.S. Senate, this legislation would create a national standard for protecting personal information and require firms to safeguard personal data against reasonably foreseeable attacks.
http://www.govtrack.us/congress/billtext.xpd?bill=h111-2221
PCI DSS
To protect payment card data, the Payment Card Industry Data Security Standard (PCI DSS) requires the use of personal firewalls, anti-virus and anti-spyware software, and virtual private networks on all computers containing credit card related information.
https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml
Our quick survey has turned up two types of mandates:
- Requirements for specific technologies (encryption, virtual private networks, firewalls, and anti-virus packages).
- More general guidelines such as “protecting against foreseeable risks.”
How can financial firms respond to such vague guidelines? We’ll take that up in our next post.
