Website Launched:  12/26/1994 Last Update:  2/14/2013 The Integrity Center, Inc. "objective risk management services" (972) 484-6140 [ Since 1984 ] HOME Reference Articles   SCREENING Check List Backgrounds TUTORIALS SERVICE MENU FCRA THIS COMPANY Our Methods Why Use Us Myths Pitfalls CHECK MYSELF CHECK NANNY USEFUL LINKS Library Statistics PRESS RELEASE The Integrity News Vol. XII No. 30 ISSN 1081-2717 November 18, 2003 Enterprise Systems November 12, 2003 TIPS for Gramm-Leach-Bliley Compliance "The Gramm-Leach-Bliley Act (GLBA) requires  companies in the broadly defined financial services  sector to safeguard customer privacy by protecting  customer information." HOWEVER, what all companies are really  grappling with is the "broader climate" of  privacy-related regulations covering both customers AND EMPLOYEES such as:     Health Insurance Portability and Accountability Act (HIPAA)     California Breach Notification Act (SB 1386)     The Sarbanes-Oxley Act     The Homeland Security Act     The Patriot Act     Visa's Cardholder Information Security Program (VISA CISP)     BS 7799 (Britian)     The Basel Capital Accord II (Europe) ISO 17799 "The bad news for companies is that the whole list is quite long, and each one of these regulations can have  significant implications for companies including penalties  up to criminal penalties.    The worse news is that companies can have obligations under several of these regulations at the same time." On the other hand, the techniques used to meet one regulation will help when tackling others. "There is a burden to be informed, a burden to be aware."    Companies need to perform frequent network self-assessments and use security testing techniques.    It is a company's responsibility to know if it's information is secure and being properly used. "The giant killer requirement is that some of the new laws require that information security control must be  visible beginning at the Board of Directors level." "Regulators like to see well-documented security programs."    They also like to see that the personnel involved in handling the information are well documented.    However, many companies really don't have their  programs committed to writing, and they do not address  both the physical and administrative safeguards.    That is a GLBA No-No." Some good news is that companies have the latitude to assess risk in the way that they choose.     However, they must assess risk.    To help get there, the article recommends the following steps as a place to start.     Put access controls on customer information systems.     Put access restrictions at physical locations that contain customer information.     Encrypt electronic customer information.     Have written procedures for modifications to systems containing customer information.     Consider dual control procedures.     Segregate employees' duties.     Do employee Background Checks.     Monitor systems to detect actual/attempted attacks.     Have a systematic response program for any events related to the misuse of customer information.     Take measures to protect against environmental hazards that would make the company liable for information leaks. The reality of the Information Age is that you can lose your privacy at the speed of light.    These new laws are meant to force organizations to spend the resources necessary to protect people's information. Smaller organizations must realize that they are not immune from these new laws.    Even if a smaller company thinks that it is under the regulator's or examiner's radar, it must realize that it's larger clients are being examined, and as suppliers, the smaller organizations will likely have to supply information to complete the compliance picture for their larger clients. We suggest that you call The Integrity Center, Inc. (972) 484-6140 to discuss our online Employee File offerings.    We have made the investment in a fully integrated online HR Information System (HRIS) so that our clients don't have to spend the time and money. The system is easy to use, you can import your files at any time, and the cost is very low to maintain employee files and generate required reports.    We launched the HRIS portion of our client interface several years ago when we took a national survey and found that companies with up to 1,000 employees were often still using paper-based personnel files.    Their costs to generate the newly required reports is astronomical. With our system, you can still have your paper-based files because the system quickly prints both individual and group reports.    Having all your employee information online makes it easy for you to check on anything in the files, at any time, from anywhere.    Being able to quickly and easily generate reports, will greatly increase your productivity and decrease your reporting response times. EARLIER NEWS ITEMS The Resume    Problem Immigration Reform    Will Mean:    Employers MUST    Enforce    Employment    Eligibility    Verification Economic    Espionage Guerrilla    Reference    Checks The Mobile    Integrity    Connection (tm) NEW U.S.    Law Increases    Employer Risk Time    To    Shred Three New    H.R. Videos "7 Ways    To Avoid    Employees From    Hell" Form I-9 Update    and NEW    Form I-9 Tools New Federal Laws    To Consider Access To News    Items For HR    And Security    Professionals Sarbanes-Oxley    and    Background    Checking Using    Credit Bureau    Reports In The    Hiring Process Talent Assessments    Before Mergers    Acquisitions    or Investments Vicarious    Liability Medical    Identity Theft Federal    Civil    Litigation    Histories New Items    for HR and    Security    Professionals Employers    Offer Help    Fighting    I.D. Theft Avian Flu:    Business Thinks    The Unthinkable New Federal    Rules That    Govern Online    Recruiting Gaffe Shows Need    To Screen Current    Employees At    Promotion Time The    Baby Boomer    Exodus Document    Disposal Law    Kicked In    June 1, 2005 A New Wrinkle    On Age Bias Don't Let Your    Vendors    Compromise    Employee    Identity Data Annoying Hacking    Has Now Become    Organized Crime Persuading    Your Company    Management To    Encourage    Training Mainstream Media    FINALLY Address    Risks Of Using    Databases For    Employment    Screening HR Automation    Can Improve    Company Finances    And Innovation Employers Beware    The    "Seal of Approval" Identity    Verification The    Outsourcing    Hole Cyber Age    Employee Crimes Security Risk    From Mobile    Media Devices More FCRA    Amendments    Could Be Coming    By Year's End The FCRA    Was Amended    On 12/4/03 Physical Security    and Information    Security are    Merging Increase    HR Productivity Homeland    Security    Guidelines Sarbanes-Oxley:    Road To    Compliance WARNING Stored Data    Warning Signs How to FIND,    FIX or FIRE,    Your POOR    PERFORMERS ID Verification --    Inexpensive and    VERY Effective The Darkest Side    Of Identity Theft Companies Dig    Deeper Into    Executive's Pasts Fraud And New    Scrutiny Of    Executives Be Careful With    Instant Messaging    and Wi-Fi STRESS Identity    Management California    Data Privacy Rule Obtaining    Criminal Histories    In New York State "The Privacy Rule"    in HIPAA Putting A Crimp In    The Management    Of Spam New Technology    Facilitates    Corporate    Espionage Identity Theft    Checklist Monitoring    Employees The Domestic    Security    Enhancement Act NEW    Overtime    Pay Rules The High Cost    Of Penny-Ante    Scams "Signs" That    You Need To Do A    Periodic Check FTC Charges A    Company With    FCRA Violations The NEW    Integrity    Connection (tm) Workplace    Safety    Checklist HR is Splitting    Into Two    Separate Parts Keep Your Eye On    RFID Technology Improv At    The Interview Real Security    Won't Come Easy    Or Cheap DOs & DON'Ts    To Minimize    Violence Identity    Theft Snapshots of    Federal Laws TIPS for    Gramm-Leach-Bliley    Compliance The Sarbanes -    Oxley Act NEW Calif.    Background    Checking Laws The Benefits    Of Online    Job Applications Compensation    --- Now It's    Getting Personal The United States    Security Network Supreme Court Limits ADA Supreme Court Will    Review Law On    Age Discrimination Management Sleaze The Examiner (tm) Helps You Uncover The New Face Of Corporate Responsibility The Sarbanes-Oxley    Corporate    Reform Law The Corporate Spy National Wants and    Warrants Illegal No Dangerous    Jobs For Disabled Security    Precautions    for Businesses Terminating    An Employee Listening in an    Interview Arbitration    vs.    Litigation Supreme Court    Eases Rules for    Workers Who Sue Drug Abuse    Statistics The Enemy    Within Priority:    Integrity Funding Terrorism    With    Information Theft Corporate America vs. Copyright Theft Mental Illness    Workplace Costs How to    Fire Properly Lying    On Resumes Workplace    Guidelines    To Be Voluntary