Based on the results of the risk assessment, a licensee shall do the following:

1. (1) Design its information security program to mitigate the identified risks, commensurate with:

   1. (A) the licensee's size and complexity;
   2. (B) the nature and scope of the licensee's activities; and
   3. (C) the sensitivity of the nonpublic information in the licensee's control.

2. (2) Determine and implement appropriate security measures, which may include the following:

   1. (A) Placing access controls on information systems, including controls to authenticate and permit only authorized individuals to have access to nonpublic information.
   2. (B) Identifying and managing the data, personnel, devices, systems, and facilities that enable the licensee to achieve business purposes in accordance with their relative importance to business objectives and risk strategy.
   3. (C) Restricting physical access to nonpublic information to authorized individuals only.
   4. (D) Protecting by encryption or other appropriate means all nonpublic information while being transmitted over an external network and all nonpublic information stored on a laptop computer or other portable computing or storage device or media.
   5. (E) Adopting secure development practices for in-house developed applications used by the licensee.
   6. (F) Modifying information systems in accordance with the licensee's information security program.
   7. (G) Using effective controls, which may include multi-factor authentication procedures for any employees accessing nonpublic information.
   8. (H) Regularly testing and monitoring systems and procedures to detect actual and attempted attacks on, or intrusions into, information systems.
   9. (I) Including audit trails within the information security program designed to detect and respond to a cybersecurity event and designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the licensee.
   10. (J) Implementing measures to protect against destruction, loss, or damage of nonpublic information due to environmental hazards, such as fire and water damage or other catastrophes or technological failures.
   11. (K) Developing, implementing, and maintaining procedures for the secure disposal of nonpublic information in any format.
3. (3) Include cybersecurity risks in the licensee's enterprise risk management process.
4. (4) Stay informed regarding emerging threats or vulnerabilities.
5. (5) Use reasonable security measures when sharing information, relative to the character of the sharing and the type of information shared.
6. (6) Provide personnel with cybersecurity awareness training that is updated as necessary to reflect risks identified in the risk assessment.

As added by P.L.130-2020, SEC.10.