General Comments

The proposed rule, in large measure, articulate appropriate and effective standards for financial institutions to establish information security programs. Based upon our experience in servicing the loss, theft or disruption of data transmissions over the Internet, we believe that an effective risk assessment process requires more than evaluating data security risks and developing appropriate controls, as the rule currently contemplates.

It has been our experience that an effective risk assessment process must also consider the financial implications of any property loss incurred when data is compromised during a transmission over the Internet. Losses caused by data transmission failures can be substantial. Not only does information have intrinsic property value that must be considered, but remediation following a loss also has financial implication for a financial institution.

An effective risk management process should identify the value of data and assess the necessary remediation costs if a transmission is compromised. This process should also ensure that an institution has considered and addressed the financing of these risks, either by consciously retaining the costs for these exposures or transferring these costs to a third-party. An assessment of risk financing issues effectively complements a risk assessment process by evaluating the value of data typically transmitted, ensuring financial recourse for losses incurred, providing for forensic recovery of lost, stolen or compromised data and establishing investigative protocols for identifying the source of such losses. Quite simply, a risk management process is not complete if it does not consider an institution's capacity to finance and remediate the risk of unauthorized disclosure, misuse, alternation, destruction or other compromises of nonpublic financial information. Congress' directive to the Commission and other federal agencies to establish standards for safeguarding customer information appears to contemplate this point. One of the stated objectives of these standards is to "insure the security and confidentiality of customer records and information." 15 U.S.C. 6805(b)(2) (emphasis supplied). We are not suggesting that Congress, by use of the highlighted term, necessarily intended that financial institutions must insure their customer information risks. We do believe, however, that Congress intended that an effective risk management process should identify and address the financial implications of these risks.