Oregon Revised Statutes Trade Regulations and Practices § 646A.622

(i) Designating one or more employees to coordinate the security program;

(ii) Identifying reasonably foreseeable internal and external risks;

(iii) Assessing whether existing safeguards adequately control the identified risks;

(iv) Training and managing employees in security program practices and procedures;

(v) Selecting service providers that are capable of maintaining appropriate safeguards, and requiring the service providers by contract to maintain the safeguards; and

(vi) Adjusting the security program in light of business changes or new circumstances;

(i) Assessing risks in network and software design;

(ii) Assessing risks in information processing, transmission and storage;

(iii) Detecting, preventing and responding to attacks or system failures; and

(iv) Testing and monitoring regularly the effectiveness of key controls, systems and procedures; and

(i) Assessing risks of information storage and disposal;

(ii) Detecting, preventing and responding to intrusions;

(iii) Protecting against unauthorized access to or use of personal information during or after collecting, transporting, destroying or disposing of the personal information; and

(iv) Disposing of personal information after the person no longer needs the personal information for business purposes or as required by local, state or federal law by burning, pulverizing, shredding or modifying a physical record and by destroying or erasing electronic media so that the information cannot be read or reconstructed.