Interagency Guidelines Establishing Information Security Standards Small-Entity Compliance Guide

Guidance
Information Technology Risk Management Program (IT-RMP)Federal Deposit Insurance Corporation (FDIC)
Federal Reserve Board (FRB)
Federal Trade Commission (FTC)
Office of Thrift Supervision (OTS)Identity Theft
Patch Management
Phishing
Risk Management

I. INTRODUCTION

Purpose and Scope of the Guide

This Small-Entity Compliance Guide¹ is intended to help financial institutions² comply with the Interagency Guidelines Establishing Information Security Standards (Security Guidelines).³ The guide summarizes the obligations of financial institutions to protect customer information and illustrates how certain provisions of the Security Guidelines apply to specific situations. The appendix lists resources that may be helpful in assessing risks and designing and implementing information security programs.

Although this guide was designed to help financial institutions identify and comply with the requirements of the Security Guidelines, it is not a substitute for the Security Guidelines. Moreover, this guide only addresses obligations of financial institutions under the Security Guidelines and does not address the applicability of any other federal or state laws or regulations that may pertain to policies or practices for protecting customer records and information.