North Dakota Century Code Title 13. Debtor and Creditor Relationship § 13-01.2-03. Elements of a security program

a. Retain responsibility for compliance with this chapter;

b. Designate a senior member of the financial corporation's personnel to be responsible for directing and overseeing the qualified individual; and

c. Require the service provider or affiliate to maintain an information security program that protects the financial corporation in accordance with the requirements of this chapter.

a. Identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of customer information;

b. Assesses the sufficiency of any safeguards in place to control the risks in subdivision a; and

c. Includes additional periodic risk assessments that:

a. Criteria to evaluate and categorize identified security risks or threats the financial corporation faces;

b. Criteria for the assessment of the confidentiality, integrity, and availability of the financial corporation's information systems and customer information, including the adequacy of the existing controls in the context of the identified risks or threats the financial corporation faces; and

c. Requirements describing how:

a. Implementing and periodically reviewing access controls, including technical and as appropriate, physical controls to:

b. Identifying and managing data, personnel, devices, systems, and facilities that enable the financial corporation to achieve business purposes in accordance with the business purpose's relative importance to business objectives and the financial corporation's risk strategy.

c. Protecting by encryption all customer information held or transmitted by the financial corporation both in transit over external networks and at rest. To the extent a financial corporation determines that encryption of customer information, either in transit over external networks or at rest, is infeasible, the financial corporation may secure customer information using effective alternative compensating controls reviewed and approved by the financial corporation's qualified individual.

d. Adopting secure development practices for in-house developed applications utilized by the financial corporation for transmitting, accessing, or storing customer information and procedures for evaluating, assessing, or testing the security of externally developed applications the financial corporation utilizes to transmit, access, or store customer information.

e. Implementing multifactor authentication for any individual accessing any information system, unless the financial corporation's qualified individual has approved in writing the use of a reasonably equivalent or more secure access control.

f. Developing, implementing, and maintaining procedures to securely dispose of customer information, in any format, no later than two years after the last date the information is used in connection with providing a product or service to the customer which it relates, unless:

g. Periodically reviewing the financial corporation's data retention policy to minimize unnecessary retention of data.

h. Adopting procedures for change management.

i. Implementing policies, procedures and controls designed to:

6. a. A financial corporation shall regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures, including the controls, systems, and procedures to detect actual and attempted attacks on, or intrusions into, information systems.

b. Information systems monitoring and testing must include continuous monitoring or periodic penetration testing, and vulnerability assessments. Without effective continuous monitoring or other systems to detect, on an ongoing basis, changes in information systems that may create vulnerabilities, a financial corporation shall conduct:

a. Providing the financial corporation's personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment;

b. Utilizing qualified information security personnel employed by the financial corporation or an affiliate or service provider sufficient to manage the financial corporation's information security risks and to perform or oversee the information security program;

c. Providing information security personnel with security updates and training sufficient to address relevant security risks; and

d. Verifying that key information security personnel take steps to maintain current knowledge of changing information security threats and countermeasures.

a. Taking reasonable steps to select and retain service providers capable of maintaining appropriate safeguards for customer information;

b. Requiring, by contract, the financial corporation's service providers implement and maintain appropriate safeguards; and

c. Periodically assessing the financial corporation's service providers based on the risk they present, and the continued adequacy of the service providers' safeguards.

a. The results of the testing and monitoring required under subsection 5;

b. Any material changes to the financial corporation's operations or business arrangements;

c. The results of risk assessments performed under subsection 3; or

d. Any other circumstances that the financial corporation knows or has reason to know may have a material impact on the financial corporation's information security program.

a. The goals of the incident response plan;

b. The internal processes for responding to a security event;

c. Clear roles, responsibilities, and levels of decisionmaking authority;

d. External and internal communications and information sharing;

e. Requirements for the remediation of any identified weaknesses in information systems and associated controls;

f. Documentation and reporting regarding security events and related incident response activities; and

g. The evaluation and revision of the incident response plan, as necessary, after a security event.

a. The overall status of the information security program, and the financial corporation's compliance with this chapter and associated rules; and

b. Material matters related to the information security program, addressing issues including risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events or violations and management's responses thereto, and recommendations for changes in the information security program.

12. a. A financial corporation shall notify the commissioner about notification events.

b. After discovery of a notification event described in subdivision c, if the notification event involves the information of at least five hundred consumers, the financial corporation shall notify the commissioner as soon as possible, and no later than forty-five days after the event is discovered. The notice must be made in a format specified by the commissioner and include:

c. A notification event must be treated as discovered on the first day when the event is known to the financial corporation. A financial corporation is deemed to have knowledge of a notification event if the event is known to any employee, officer, or other agent of the financial corporation, other than the person committing the breach.