Information Security Awareness Training Gramm-Leach-Bliley Act (GLB Act)
|
|
|
- Loren Phillips
- 8 years ago
- Views:
Transcription
1 Information Security Awareness Training Gramm-Leach-Bliley Act (GLB Act) The GLB Act training packet is part of the Information Security Awareness Training that must be completed by employees. Please visit the Human Resources website at to take the full training and to receive credit.
2 Information Security Awareness Training Lesson Two Gramm-Leach-Bliley Act (GLB Act) Purpose of the Gramm-Leach-Bliley Act (GLB Act) The Gramm-Leach-Bliley Act (GLB Act) is a federal law which mandates that financial institutions, including institutions of higher education, protect the security, confidentiality and integrity of customer information. 16 CFR 314.1(a). In this regard, the Federal Trade Commission has issued safeguarding rules that implement the GLB Act. These rules establish standards related to administrative, technical and physical safeguards. The objectives of the GLB Act training are to educate employees on: (1) the requirements of the GLB Act; (2) how to identify customer information; and (3) how to safeguard customer information. The training information was derived, in part, from the GLB Act, the Code of Federal Regulations (16 CFR 314) and the Federal Trade Commission. What is the GLB Act? The GLB Act is a federal law, also known as the Financial Modernization Act of The GLB Act applies to financial institutions, including institutions of higher education such as the University of Houston System ( UHS ) and component universities. The GLB Act directs appropriate agencies, such as the Federal Trade Commission ( FTC ) to establish standards by which financial institutions must develop information security programs. The FTC has established safeguarding rules mandating that UHS and component universities protect the security, confidentiality and integrity of customer information. 16 CFR 314.1(a). What are the objectives of the safeguarding rules? The objectives of the safeguarding rules are to: Insure the security and confidentiality of customer information; Protect against any anticipated threats or hazards to the security or integrity of such information; and Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. 16 CFR (b)(1-3).
3 Who must abide by the GLB Act? UHS and component universities must abide by the GLB Act. All employees of UHS and component universities must abide by the GLB Act. What does the GLB Act require? The GLB Act mandates that UHS and component universities safeguard financial information that is collected or maintained in connection with its financial institution activities. UHS and component universities must protect financial information in paper, electronic and other forms. What is customer information? Customer information is defined as any record containing nonpublic personal information... about a customer of a financial institution, whether in paper, electronic, or other form, that is handled or maintained by or on behalf of [UHS, its component universities or its] affiliates. 16 CFR (b). Whose information must be safeguarded under the GLB Act? UHS and component universities must safeguard all financial information in their possession, regardless of whether such information pertains to individuals with whom [UHS or component universities have] a customer relationship, or pertains to the customers of other financial institutions that have provided such information to [another financial institution]. 16 CFR (b). Examples include: applicants parents staff faculty donors What type of information must be safeguarded under the GLB Act? Generally, all customer information must be safeguarded. Examples include: credit card account numbers bank account numbers
4 income histories credit histories What are the potential risks of not safeguarding information? Potential risks of not safeguarding information are: unauthorized access of financial information by third parties unauthorized transfer of data to third parties interception of data during transmission physical loss of data due to disaster or theft compromise of computer system security identity theft How can employees avoid risks in daily operations? Employee Training and Management To avoid risks in operations concerning employee training and management, the FTC suggests, in part, that UHS and component universities: Check references before hiring new employees; Train employees to identify and properly collect and maintain customer information. Basic steps include: o using password protected screensavers; o changing passwords frequently (and not posting passwords at or near computers); o locking rooms and file cabinets where paper records are maintained; o encrypting customer information if it must be ed; o recognizing fraudulent attempts to obtain customer information; o referring requests for customer information to designated employees; Limit access to customer information to only those employees who have a business reason for handling the information and to only such an extent that they need it to do their jobs.
5 Information Systems To avoid risks in operations concerning information systems (including network and software design, as well as information processing, storage, transmission and disposal), the FTC suggests, in part, that UHS and component universities: Store records in a secure area. For example: o Store paper records in a locked room when such records are unattended; o Keep archived data secure by keeping them in a physically secure area or storing them off-line; o Ensure that storage areas are protected against physical hazards such as floods and fire; o Don t store customer information on a computer with an internet connection. If you are connected the internet, encrypt and password protect the file. When collecting or transmitting customer information, provide for easy to understand and secure data transmission o Use a Secure Sockets Layer (SSL) or other secure connection for transmitting and collecting sensitive financial information (such as credit card information); o If an employee must use to transmit sensitive financial information, ensure that the content is encrypted and password protected; o Caution customers against transmitting sensitive financial information via electronic mail. Dispose of customer information appropriately and securely. For example: o Shred customer information and store it in a secure area until it is disposed of; o Erase all customer information from computers, diskettes, hard drives or other electronic media when disposing of these items; o Destroy all hardware that is to be disposed of. Managing Information System Failures To avoid risks in operations concerning information system failures (including the prevention, detection and response to attacks and intrusions), the FTC suggests, in part, that UHS and component universities:
6 Maintain current controls by: o Installing anti-virus software that updates automatically; o Maintain current firewalls; o Regularly check with software vendors to install patches that correct software vulnerabilities; o Follow a written plan to address any breaches of physical, administrative or technical safeguards; Other suggestions for managing system failures are: o Back up all customer information regularly; o Combine the use of passwords and personal identifiers to authenticate the identity of customers who attempt to transact business electronically. o Notify the Information Security Program Coordinator so that he/she may notify customers if their nonpublic personal information is subject to unauthorized access, loss or damage. For more information about the GLB Act safeguarding rules, please see the FTC s website at: Who do I contact if I do not know what to do? If you receive a request for a customer's financial information, refer the requestor to those university employees who have undergone information security training. If you suspect an attempt to fraudulently obtain a customer's financial information, immediately report the attempt to the Information Security Program Coordinator. Please refer to the UHS Resource page for contact information System Wide Security Contacts. The Information Security Officer (ISO) will serve as the Information Security Program Coordinator. The Coordinator will interact with the Office of the General Counsel to implement the information security program. The Coordinator will also interact with appropriate University departments to facilitate safeguarding procedures.
7 GLB Quiz 1. The GLB Act mandates that financial institutions safeguard customers financial information. 2. According to the GLB Act, UHS and component universities must protect customers financial information that is maintained on floppy disks, cds and on computers. 3. According to the GLB Act, UHS and component universities must protect customers financial information that is printed on paper. 4. An employee should place paper listings of customers financial information in campus trash cans when he/she no longer uses the information contained in the paper listing. 5. An employee should place diskettes that contain customers financial information in campus trash cans when he/she no longer uses the information contained on the diskette? 6. Customer information may be appropriately stored in an area which has flooded several times in the past, but which has been properly cleaned each time. 7. Employees may freely transmit financial information to customers and other employees via If customers financial information is stolen, then an employee should keep this occurrence to him/herself so as not to cause disruption to UHS or component universities. 9. Employees should take affirmative steps to avoid risks in UHS and component university operations.
8 10. If an employee believes that customers financial information has been or may be inappropriately released, then the employee should contact the Information Security Program Coordinator for his/her component university.
9 Answers 1. The correct answer is true. The GLB Act mandates that financial institutions take affirmative steps to safeguard customers financial information. The GLB Act applies to UHS and component universities because these entities regularly engage in financial institution activities in their daily operations. 2. The correct answer is true. The GLB Act mandates that UHS and component universities safeguard customers financial information no matter the form that it is in. So, items such as floppy disks and cds that contain customers financial information should be locked in file cabinets and/or rooms when not in use. Computers should be password protected and otherwise secured against damage or loss. Floppy disks, cds and computer hardware that contain customers financial information, should be deleted, stored in a secure area until destroyed, then disposed of. 3. The correct answer is true. The GLB Act mandates that UHS and component universities safeguard customers financial information no matter the form that it is in. So, customers financial information that is printed on paper should be locked in file cabinets and/or rooms when not in use. Paper copies should be shredded, then stored in a secure area until they are disposed of. 4. The correct answer is false. It is not appropriate to dispose of paper listings of customers financial information by simply placing the hardcopies in campus trash cans. Paper listings of customers financial information should be shredded, then stored in a secure area until they are disposed of. 5. The correct answer is false. It is not appropriate to dispose of diskettes, cds or computers that contain customers financial information by simply placing these items in campus trash cans. Hardware that contains customers financial information should be deleted, stored in a secure area until destroyed, then disposed of. 6. The correct answer is false. Customers financial information must be safeguarded against damage and loss. Therefore, items containing customers financial information (such as floppy disks, cds, computers, paper copies), should be stored in areas that are secured against hazards such as fire or flooding and in areas that are secured against theft. 7. The correct answer is false. Employees must take affirmative steps to ensure the confidentiality of customers financial information. Therefore, if must be used, then some steps that employees should take to ensure the confidentiality of information are: to password protect the content of the s and to combine the use of passwords and personal identifiers to authenticate the identity of customers who attempt to transact business electronically. 8. The correct answer is false. If customer information is stolen or if an employee suspects that such information is subject to unauthorized access, loss or damage, then the employee should immediately contact his/her component s Information Security Officer
10 who serves as the Information Security Program Coordinator. Compromised computer system security, identity theft and other risks could result if an employee does not report unauthorized access, loss or damage (or threats of access, loss or damage) to the Information Security Program Coordinator. 9. The correct answer is true. The safeguarding rules, in part, require UHS and component universities to avoid risks in operations by, maintaining current controls such as installing anti-virus software that updates automatically, maintaining firewalls and regularly checking with vendors to install patches that correct software vulnerabilities. Employees should also regularly back up customers financial information contained in computer systems. 10. The correct answer is true. The Information Security Officer (ISO) for a component university serves as the Information Security Program Coordinator for that component university. If an employee suspects that customers financial information has been or may be inappropriately released, then he/she should immediately contact the Information Security Program Coordinator.
Gramm Leach Bliley Act. GLBA/HIPAA Information Security Program Committee GLBA, Safeguards Rule Training, Rev. 7/1/2007
Gramm Leach Bliley Act 15 U.S.C. 6801-6809 6809 GLBA/HIPAA Information Security Program Committee GLBA, Safeguards Rule Training, Rev. 7/1/2007 1 Objectives for GLBA Training GLBA Overview Safeguards Rule
California State University, Sacramento INFORMATION SECURITY PROGRAM
California State University, Sacramento INFORMATION SECURITY PROGRAM 1 I. Preamble... 3 II. Scope... 3 III. Definitions... 4 IV. Roles and Responsibilities... 5 A. Vice President for Academic Affairs...
College of DuPage Information Technology. Information Security Plan
College of DuPage Information Technology Information Security Plan April, 2015 TABLE OF CONTENTS Purpose... 3 Information Security Plan (ISP) Coordinator(s)... 4 Identify and assess risks to covered data
Valdosta Technical College. Information Security Plan
Valdosta Technical College Information Security 4.4.2 VTC Information Security Description: The Gramm-Leach-Bliley Act requires financial institutions as defined by the Federal Trade Commision to protect
FINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information
FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1
INFORMATION SECURITY PROGRAM
Approved 1/30/15 by Dr. MaryLou Apple, President MSCC Policy No. 1:08:00:02 MSCC Gramm-Leach-Bliley INFORMATION SECURITY PROGRAM January, 2015 Version 1 Table of Contents A. Introduction Page 1 B. Security
by: Scott Baranowski Community Bank Auditors Group Best Practices in Auditing Record Retention, Safeguarding Paper Documents, GLBA and Privacy
Community Bank Auditors Group Best Practices in Auditing Record Retention, Safeguarding Paper Documents, GLBA and Privacy June 10, 2015 MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT
PROPOSED PROCEDURES FOR AN IDENTITY THEFT PROTECTION PROGRAM Setoff Debt Collection and GEAR Collection Programs
PROPOSED PROCEDURES FOR AN IDENTITY THEFT PROTECTION PROGRAM Setoff Debt Collection and GEAR Collection Programs The Identity Theft and Fraud Protection Act (Act No. 190) allows for the collection, use
DEALERSHIP IDENTITY THEFT RED FLAGS AND NOTICES OF ADDRESS DISCREPANCY POLICY
DEALERSHIP IDENTITY THEFT RED FLAGS AND NOTICES OF ADDRESS DISCREPANCY POLICY This Plan we adopted by member, partner, etc.) on Our Program Coordinator (date). (Board of Directors, owner, We have appointed
Privacy Data Loss. Privacy Data Loss. Identity Theft. The Legal Issues
Doing Business in Oregon Under the Oregon Consumer Identity Theft Protection Act and Related Privacy Risks Privacy Data Loss www.breachblog.com Presented by: Mike Porter March 10, 2009 2 Privacy Data Loss
POLICIES. Campus Data Security Policy. Issued: September, 2009 Responsible Official: Director of IT Responsible Office: IT Central.
POLICIES Campus Data Security Policy Issued: September, 2009 Responsible Official: Director of IT Responsible Office: IT Central Policy Statement Policy In the course of its operations, Minot State University
BERKELEY COLLEGE DATA SECURITY POLICY
BERKELEY COLLEGE DATA SECURITY POLICY BERKELEY COLLEGE DATA SECURITY POLICY TABLE OF CONTENTS Chapter Title Page 1 Introduction 1 2 Definitions 2 3 General Roles and Responsibilities 4 4 Sensitive Data
Cyber Self Assessment
Cyber Self Assessment According to Protecting Personal Information A Guide for Business 1 a sound data security plan is built on five key principles: 1. Take stock. Know what personal information you have
SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)
UNIVERSITY OF PITTSBURGH POLICY SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) DATE: March 18, 2005 I. SCOPE This
INFORMATION SECURITY PROGRAM
WSCC Gramm-Leach-Bliley INFORMATION SECURITY PROGRAM November 30, 2012 Version 5.2 Table of Contents A. Introduction.Page 1 B. Program Coordinators..Page 2 C. Security Risk Assessment.Page 3 1. Employee
EAA Policy for Accepting and Handling Credit and Debit Card Payments ( Policy )
EAA Policy for Accepting and Handling Credit and Debit Card Payments ( Policy ) Background Due to increased threat of identity theft, fraudulent credit card activity and other instances where cardholder
Appendix 4-2: Sample HIPAA Security Risk Assessment For a Small Physician Practice
Appendix 4-2: Administrative, Physical, and Technical Safeguards Breach Notification Rule How Use this Assessment The following sample risk assessment provides you with a series of sample questions help
UF IT Risk Assessment Standard
UF IT Risk Assessment Standard Authority This standard was enacted by the UF Senior Vice President for Administration and the UF Interim Chief Information Officer on July 10, 2008 [7]. It was approved
787 Wye Road, Akron, Ohio 44333 P 330-666-6200 F 330-666-7801 www.keystonecorp.com
Introduction Keystone White Paper: Regulations affecting IT This document describes specific sections of current U.S. regulations applicable to IT governance and data protection and maps those requirements
County Identity Theft Prevention Program
INTRODUCTION CHAPTER OSCEOLA COUNTY IDENTITY THEFT PREVENTION PROGRAM The Osceola County Board of County Commissioners is committed to protecting consumers who do business with Osceola County, and as such
Responsible Access and Use of Information Technology Resources and Services Policy
Responsible Access and Use of Information Technology Resources and Services Policy Functional Area: Information Technology Services (IT Services) Applies To: All users and service providers of Armstrong
Information Security Plan effective March 1, 2010
Information Security Plan effective March 1, 2010 Section Coverage pages I. Objective 1 II. Purpose 1 III. Action Plans 1 IV. Action Steps 1-5 Internal threats 3 External threats 3-4 Addenda A. Document
MONTSERRAT COLLEGE OF ART WRITTEN INFORMATION SECURITY POLICY (WISP)
MONTSERRAT COLLEGE OF ART WRITTEN INFORMATION SECURITY POLICY (WISP) 201 CMR 17.00 Standards for the Protection of Personal Information Of Residents of the Commonwealth of Massachusetts Revised April 28,
ensure prompt restart of critical applications and business activities in a timely manner following an emergency or disaster
Security Standards Symantec shall maintain administrative, technical, and physical safeguards for the Symantec Network designed to (i) protect the security and integrity of the Symantec Network, and (ii)
Protecting. Personal Information A Business Guide. Division of Finance and Corporate Securities
Protecting Personal Information A Business Guide Division of Finance and Corporate Securities Oregon Identity Theft Protection Act Collecting, keeping, and sharing personal data is essential to all types
Privacy Policy & Identity Theft Prevention Program
Privacy Policy & Identity Theft Prevention Program Orcam Financial Group LLC PO Box 91098 4640 Cass St San Diego, CA 92109 (858) 220-5383 Orcam Financial Group LLC Privacy Policy February, 2014 Page 1
Protecting Personal Information: The Massachusetts Data Security Regulation (201 CMR 17.00)
Protecting Personal Information: The Massachusetts Data Security Regulation (201 CMR 17.00) May 15, 2009 LLP US Information Security Framework Historically industry-specific HIPAA Fair Credit Reporting
DRAFT National Rural Water Association Identity Theft Program Model September 22, 2008
DRAFT National Rural Water Association Identity Theft Program Model September 22, 2008 This model has been designed to help water and wastewater utilities comply with the Federal Trade Commission s (FTC)
Identity Theft Prevention Program Compliance Model
September 29, 2008 State Rural Water Association Identity Theft Prevention Program Compliance Model Contact your State Rural Water Association www.nrwa.org Ed Thomas, Senior Environmental Engineer All
Computing Services Information Security Office. Security 101
Computing Services Information Security Office Security 101 Definition of Information Security Information security is the protection of information and systems from unauthorized access, disclosure, modification,
HIPAA Security Alert
Shipman & Goodwin LLP HIPAA Security Alert July 2008 EXECUTIVE GUIDANCE HIPAA SECURITY COMPLIANCE How would your organization s senior management respond to CMS or OIG inquiries about health information
SAMPLE TEMPLATE. Massachusetts Written Information Security Plan
SAMPLE TEMPLATE Massachusetts Written Information Security Plan Developed by: Jamy B. Madeja, Esq. Erik Rexford 617-227-8410 jmadeja@buchananassociates.com Each business is required by Massachusetts law
Montclair State University. HIPAA Security Policy
Montclair State University HIPAA Security Policy Effective: June 25, 2015 HIPAA Security Policy and Procedures Montclair State University is a hybrid entity and has designated Healthcare Components that
Hamilton College Administrative Information Systems Security Policy and Procedures. Approved by the IT Committee (December 2004)
Hamilton College Administrative Information Systems Security Policy and Procedures Approved by the IT Committee (December 2004) Table of Contents Summary... 3 Overview... 4 Definition of Administrative
TOOLBOX. ABA Financial Privacy
ABA Financial Privacy TOOLBOX This tool will help ensure that privacy remains a core value in all corners of your institution. The success of your privacy program depends upon your board s and your management
Information Technology Security Policies
Information Technology Security Policies Randolph College 2500 Rivermont Ave. Lynchburg, VA 24503 434-947- 8700 Revised 01/10 Page 1 Introduction Computer information systems and networks are an integral
Introduction. Purpose. Reference. Applicability. HIPAA Policy 7.1. Safeguards to Protect the Privacy of PHI
Office of Regulatory Compliance 13001 E. 17 th Place, Suite W1124 Mail Stop F497 Aurora, CO 80045 Main Office: 303-724-1010 Main Fax: 303-724-1019 HIPAA Policy 7.1 Title: Source: Prepared by: Approved
Wellesley College Written Information Security Program
Wellesley College Written Information Security Program Introduction and Purpose Wellesley College developed this Written Information Security Program (the Program ) to protect Personal Information, as
Cultural Human Resources Council (CHRC) Personal Information Protection and Electronic Documents Act (PIPEDA) Privacy Policy
Cultural Human Resources Council (CHRC) Personal Information Protection and Electronic Documents Act (PIPEDA) Privacy Policy September 2004 1.0 INTRODUCTION... 3 2.0 CHRC POLICY STATEMENT... 3 3.0 PRIVACY
INFORMATION SECURITY AND SECURITY BREACH NOTIFICATION GUIDANCE Preventing, Preparing for, and Responding to Breaches of Information Security
INFORMATION SECURITY AND SECURITY BREACH NOTIFICATION GUIDANCE Preventing, Preparing for, and Responding to Breaches of Information Security The Office of Illinois Attorney General Lisa Madigan has created
UIT Security is responsible for developing security best practices, promoting security awareness, coordinating security issues, and conducting
SECURITY HANDBOOK Mission Statement: UIT Security is responsible for developing security best practices, promoting security awareness, coordinating security issues, and conducting investigations. UIT Security
HIPAA SECURITY RISK ASSESSMENT SMALL PHYSICIAN PRACTICE
HIPAA SECURITY RISK ASSESSMENT SMALL PHYSICIAN PRACTICE How to Use this Assessment The following risk assessment provides you with a series of questions to help you prioritize the development and implementation
SECTION-BY-SECTION ANALYSIS
INTRODUCED BY CONGRESSMAN RANDY NEUGEBAUER (R-TX) AND CONGRESSMAN JOHN CARNEY (D-DE) SECTION-BY-SECTION ANALYSIS Section 1: Short Title The Data Security Act of 2015. Section 2: Purposes The purposes of
TYPES OF POSSIBLE IDENTITY THEFT
Identity Theft What is Identity Theft? Identity theft occurs when someone uses your personal information such as your name, social security number, and or other identifying information without your permission
FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY
FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY Page 1 of 6 Summary The Payment Card Industry Data Security Standard (PCI DSS), a set of comprehensive requirements for enhancing payment account
HIPAA Security. 2 Security Standards: Administrative Safeguards. Security Topics
HIPAA Security SERIES Security Topics 1. Security 101 for Covered Entities 5. 2. Security Standards - Organizational, Security Policies Standards & Procedures, - Administrative and Documentation Safeguards
CYBERSECURITY POLICY
* CYBERSECURITY POLICY THE CYBERSECURITY POLICY DEFINES THE DUTIES EMPLOYEES AND CONTRACTORS OF CU*ANSWERS MUST FULFILL IN SECURING SENSITIVE INFORMATION. THE CYBERSECURITY POLICY IS PART OF AND INCORPORATED
HOW TO COMPLY WITH THE NEW INFORMATION SECURITY STANDARDS: A DO IT YOURSELF MANUAL FOR COMMUNITY BANKS AND THRIFTS PREPARED FOR THE CONFERENCE OF STATE BANK EXAMINERS By THE CODA GROUP, INC. BARNETT SIVON
MIT s Information Security Program for Protecting Personal Information Requiring Notification. (Revision date: 2/26/10)
MIT s Information Security Program for Protecting Personal Information Requiring Notification (Revision date: 2/26/10) Table of Contents 1. Program Summary... 3 2. Definitions... 4 2.1 Identity Theft...
PCI Data Security and Classification Standards Summary
PCI Data Security and Classification Standards Summary Data security should be a key component of all system policies and practices related to payment acceptance and transaction processing. As customers
WHITE PAPER. HIPPA Compliance and Secure Online Data Backup and Disaster Recovery
WHITE PAPER HIPPA Compliance and Secure Online Data Backup and Disaster Recovery January 2006 HIPAA Compliance and the IT Portfolio Online Backup Service Introduction October 2004 In 1996, Congress passed
This policy applies to all GPC units that process, transmit, or handle cardholder information in a physical or electronic format.
Policy Number: 339 Policy Title: Credit Card Processing Policy, Procedure, & Standards Review Date: 07-23-15 Approval Date: 07-27-15 POLICY: All individuals involved in handling credit and debit card transactions
Utica College. Information Security Plan
Utica College Information Security Plan Author: James Farr (Information Security Officer) Version: 1.0 November 1 2012 Contents Introduction... 3 Scope... 3 Information Security Organization... 4 Roles
Title: Data Security Policy Code: 1-100-200 Date: 11-6-08rev Approved: WPL INTRODUCTION
Title: Data Security Policy Code: 1-100-200 Date: 11-6-08rev Approved: WPL INTRODUCTION The purpose of this policy is to outline essential roles and responsibilities within the University community for
Statement of Policy. Reason for Policy
Table of Contents Statement of Policy 2 Reason for Policy 2 HIPAA Liaison 2 Individuals and Entities Affected by Policy 2 Who Should Know Policy 3 Exclusions 3 Website Address for Policy 3 Definitions
Control the Risk of Identity Theft
Control the Risk of Identity Theft Guidance for Your Business R NORTH AMERICAN EQUIPMENT DEALERS ASSOCIATION This information was compiled from Protecting Personal Information: A Guide for Business, a
Austin Peay State University
1 Austin Peay State University Identity Theft Operating Standards (APSUITOS) I. PROGRAM ADOPTION Austin Peay State University establishes Identity Theft Operating Standards pursuant to the Federal Trade
8.03 Health Insurance Portability and Accountability Act (HIPAA)
Human Resource/Miscellaneous Page 1 of 5 8.03 Health Insurance Portability and Accountability Act (HIPAA) Policy: It is the policy of Licking/Knox Goodwill Industries, Inc., to maintain the privacy of
WHAT IS SENSITIVE INFORMATION?
Disclaimer: This material is designed and intended for general informational purposes only, and is not intended, nor shall it be construed or relied upon, as specific legal advice. Nearly all companies
Earth-Life Science Institute Tokyo Institute of Technology. Operating Guidelines for Information Security
Earth-Life Science Institute Tokyo Institute of Technology Operating Guidelines for Information Security 2013 1. Purpose The Operating Guidelines for Information Security (hereinafter, the Operating Guidelines
COLUMBUS STATE COMMUNITY COLLEGE POLICY AND PROCEDURES MANUAL
PAYMENT CARD INDUSTRY COMPLIANCE (PCI) Effective June 1, 2011 Page 1 of 6 (1) Definitions a. Payment Card Industry Data Security Standards (PCI-DSS): A set of standards established by the Payment Card
NC DPH: Computer Security Basic Awareness Training
NC DPH: Computer Security Basic Awareness Training Introduction and Training Objective Our roles in the Division of Public Health (DPH) require us to utilize our computer resources in a manner that protects
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable
HIPAA Security Series
7 Security Standards: Implementation for the Small Provider What is the Security Series? The security series of papers provides guidance from the Centers for Medicare & Medicaid Services (CMS) on the rule
Data Privacy and Gramm- Leach-Bliley Act Section 501(b)
Data Privacy and Gramm- Leach-Bliley Act Section 501(b) October 2007 2007 Enterprise Risk Management, Inc. Agenda Introduction and Fundamentals Gramm-Leach-Bliley Act, Section 501(b) GLBA Life Cycle Enforcement
Data Management Policies. Sage ERP Online
Sage ERP Online Sage ERP Online Table of Contents 1.0 Server Backup and Restore Policy... 3 1.1 Objectives... 3 1.2 Scope... 3 1.3 Responsibilities... 3 1.4 Policy... 4 1.5 Policy Violation... 5 1.6 Communication...
SCHOOL DISTRICT OF BLACK RIVER FALLS HIPAA PRIVACY AND SECURITY POLICY
SCHOOL DISTRICT OF BLACK RIVER FALLS HIPAA PRIVACY AND SECURITY POLICY School Board Policy 523.5 The School District of Black River Falls ( District ) is committed to compliance with the health information
Written Information Security Plan (WISP) for. HR Knowledge, Inc. This document has been approved for general distribution.
Written Information Security Plan (WISP) for HR Knowledge, Inc. This document has been approved for general distribution. Last modified January 01, 2014 Written Information Security Policy (WISP) for HR
a) Access any information composed, created, received, downloaded, retrieved, stored, or sent using department computers.
CAYUGA COUNTY POLICY MANUAL Section 11 Subject: Electronic messaging and internet 1 Effective Date: 5/25/10; Res. 255-10 Supersedes Policy of: November 28, 2000 Name of Policy: County Computer Hardware-Software
PACIFIC EXPLORATION & PRODUCTION CORPORATION (the Corporation )
PRIVACY POLICY (Initially adopted by the Board of Directors on November 16, 2007) PACIFIC EXPLORATION & PRODUCTION CORPORATION (the Corporation ) The Corporation is committed to controlling the collection,
PROGRAM TO PREVENT, DETECT & MITIGATE IDENTITY THEFT
Office of Employee Benefits Administrative Manual PROGRAM TO PREVENT, DETECT & MITIGATE IDENTITY THEFT 150 EFFECTIVE DATE: AUGUST 1, 2009 REVISION DATE: PURPOSE: Ensure that the Office of Employee Benefits
Information Technology
Credit Card Handling Security Standards Overview Information Technology This document is intended to provide guidance to merchants (colleges, departments, organizations or individuals) regarding the processing
The New York Consumer Protection Board s Business Privacy Guide:
The New York Consumer Protection Board s Business Privacy Guide: How to Handle Personal Identifiable Information and Limit the Prospects of Identity Theft New York State Consumer Protection Board Advocating
Policy for Protecting Customer Data
Policy for Protecting Customer Data Store Name Store Owner/Manager Protecting our customer and employee information is very important to our store image and on-going business. We believe all of our employees
Data Security Incident Response Plan. [Insert Organization Name]
![Data Security Incident Response Plan. [Insert Organization Name]](/thumbs/34/17160420.jpg "Data Security Incident Response Plan. [Insert Organization Name]")
Data Security Incident Response Plan Dated: [Month] & [Year] [Insert Organization Name] 1 Introduction Purpose This data security incident response plan provides the framework to respond to a security
Why Lawyers? Why Now?
TODAY S PRESENTERS Why Lawyers? Why Now? New HIPAA regulations go into effect September 23, 2013 Expands HIPAA safeguarding and breach liabilities for business associates (BAs) Lawyer is considered a business
Dartmouth College Merchant Credit Card Policy for Processors
Mission Statement Dartmouth College Merchant Credit Card Policy for Processors Dartmouth College requires all departments that process, store or transmit credit card data remain in compliance with the
BALTIMORE CITY COMMUNITY COLLEGE INFORMATION TECHNOLOGY SECURITY PLAN
BALTIMORE CITY COMMUNITY COLLEGE INFORMATION TECHNOLOGY SECURITY PLAN FEBRUARY 2011 TABLE OF CONTENTS PURPOSE... 4 SCOPE... 4 INTRODUCTION... 4 SECTION 1: IT Security Policy... 5 SECTION 2: Risk Management
Data Privacy: What your nonprofit needs to know. Donna Balaguer and Ed Lavergne Washington, D.C. February 5, 2015
Data Privacy: What your nonprofit needs to know Donna Balaguer and Ed Lavergne Washington, D.C. February 5, 2015 Overview 2 Data privacy versus data security Privacy polices and best practices Data security
LANDER UNIVERSITY STUDENT INFORMATION SECURITY AND PRIVACY PROCEDURE
founded in 1872 LANDER UNIVERSITY Office of Information Technology Services LANDER UNIVERSITY STUDENT INFORMATION SECURITY AND PRIVACY PROCEDURE 2012 REVISION TABLE OF CONTENTS I. PRIVACY.....................................................
How To Protect Research Data From Being Compromised
University of Northern Colorado Data Security Policy for Research Projects Contents 1.0 Overview... 1 2.0 Purpose... 1 3.0 Scope... 1 4.0 Definitions, Roles, and Requirements... 1 5.0 Sources of Data...
Information Security Plan
Information Security Plan In compliance with the Gramm Leach Bliley Act of 1999 Table of Contents Information Security Plan... 3 Identification and Assessment of Risks to Customer Information... 3 Information
INFORMATION TECHNOLOGY Policy 8400 (Regulation 8400) Data Security
INFORMATION TECHNOLOGY Policy 8400 (Regulation 8400) Data Security State Fair Community College shall provide a central administrative system for use in data collection and extraction. Any system user
Page 1 of 15. VISC Third Party Guideline
Page 1 of 15 VISC Third Party Guideline REVISION CONTROL Document Title: Author: File Reference: VISC Third Party Guidelines Andru Luvisi CSU Information Security Managing Third Parties policy Revision
Index .700 FORMS - SAMPLE INCIDENT RESPONSE FORM.995 HISTORY
Information Security Section: General Operations Title: Information Security Number: 56.350 Index POLICY.100 POLICY STATEMENT.110 POLICY RATIONALE.120 AUTHORITY.130 APPROVAL AND EFFECTIVE DATE OF POLICY.140
Protecting. PERSONAL INFORMATION A Guide for Business FEDERAL TRADE COMMISSION
Protecting PERSONAL INFORMATION A Guide for Business FEDERAL TRADE COMMISSION PROTECTING PERSONAL INFORMATION A Guide for Business Most companies keep sensitive personal information in their files names,
Data Security and Privacy Policy
Data Security and Privacy Policy Overview TRG is a data-driven consulting company that provides arts, cultural and entertainment organizations guidance and solutions for patron-based, sustainable income.
CHIS, Inc. Privacy General Guidelines
CHIS, Inc. and HIPAA CHIS, Inc. provides services to healthcare facilities and uses certain protected health information (PHI) in connection with performing these services. Therefore, CHIS, Inc. is classified
HIPAA Security. Jeanne Smythe, UNC-CH Jack McCoy, ECU Chad Bebout, UNC-CH Doug Brown, UNC-CH
HIPAA Security Jeanne Smythe, UNC-CH Jack McCoy, ECU Chad Bebout, UNC-CH Doug Brown, UNC-CH What is this? Federal Regulations August 21, 1996 HIPAA Became Law October 16, 2003 Transaction Codes and Identifiers
State HIPAA Security Policy State of Connecticut
Health Insurance Portability and Accountability Act State HIPAA Security Policy State of Connecticut Release 2.0 November 30 th, 2004 Table of Contents Executive Summary... 1 Policy Definitions... 3 1.
Estate Agents Authority
INFORMATION SECURITY AND PRIVACY PROTECTION POLICY AND GUIDELINES FOR ESTATE AGENTS Estate Agents Authority The contents of this document remain the property of, and may not be reproduced in whole or in
CREDIT CARD PROCESSING POLICY AND PROCEDURES
CREDIT CARD PROCESSING POLICY AND PROCEDURES Note: For purposes of this document, debit cards are treated the same as credit cards. Any reference to credit cards includes credit and debit card transactions.
The HIPAA Security Rule Primer A Guide For Mental Health Practitioners
The HIPAA Security Rule Primer A Guide For Mental Health Practitioners Distributed by NASW Printer-friendly PDF 2006 APAPO 1 Contents Click on any title below to jump to that page. 1 What is HIPAA? 3 2
The Internet and e-mail 2 Acceptable use 2 Unacceptable use 2 Downloads 3 Copyrights 3 Monitoring 3. Computer Viruses 3
Table of Contents 1 Acceptable use 1 Violations 1 Administration 1 Director and Supervisor Responsibilities 1 MIS Director Responsibilities 1 The Internet and e-mail 2 Acceptable use 2 Unacceptable use
Information Security Policy Manual
Information Security Policy Manual Latest Revision: May 16, 2012 1 Table of Contents Information Security Policy Manual... 3 Contact... 4 Enforcement... 4 Policies And Related Procedures... 5 1. ACCEPTABLE
Authorized. User Agreement
Authorized User Agreement CareAccord Health Information Exchange (HIE) Table of Contents Authorized User Agreement... 3 CareAccord Health Information Exchange (HIE) Polices and Procedures... 5 SECTION
Information Security Policy
Information Security Policy Touro College/University ( Touro ) is committed to information security. Information security is defined as protection of data, applications, networks, and computer systems
SAMPLE HIPAA/HITECH POLICIES AND PROCEDURES MANUAL FOR THE SECURITY OF ELECTRONIC PROTECTED HEALTH INFORMATION
SAMPLE HIPAA/HITECH POLICIES AND PROCEDURES MANUAL FOR THE SECURITY OF ELECTRONIC PROTECTED HEALTH INFORMATION Please Note: 1. THIS IS NOT A ONE-SIZE-FITS-ALL OR A FILL-IN-THE BLANK COMPLIANCE PROGRAM.