23 CAR § 31-111
Each licensee shall establish and implement an information security program, including appropriate policies and systems, pursuant to this part by January 1, 2003.