格雷姆-里奇-比利雷法案 (GLBA)

法规

要求

Section 501(b) of the Gramm-Leach-Bliley Act requires financial institutions to protect the security, confidentiality and integrity of non-public customer information through “administrative, technical and physical safeguards”. The Gramm-Leach-Bliley Act also requires each financial institution to implement a comprehensive written information security program that includes administrative, technical and physical safeguards appropriate to the size, complexity and scope of activities of the institution. These include:

• 确保客户记录和信息的安全性和机密性
• 防止此类记录的安全性或完整性受到任何预期威胁或危害
• 防止未经授权访问或使用此类记录或信息，避免对任何客户造成重大伤害或不便

启示

对于受该标准影响的组织，格雷姆-里奇-比利雷法案中这些隐私条例，结合《联邦存款保险法》第 36 节的参考要求，需要：

• 保存和监控客户记录和信息
• 创建和维护有效风险评估
• 识别、实施并审计用于保护这些数据的特定内部安全控制措施