Hawaiian Electric Industries · NYSE:HE
Hawaiian Electric Industries — Investor Presentation
21 slides from Hawaiian Electric Industries's investor presentation
Slide 1: Safeguarding Customer Information: Key Provisions of the FFIEC Security Guidelines
SAFEGUARDING CUSTOMER INFORMATION: KEY PROVISIONS OF THE FFIEC SECURITY GUIDELINES
Slide 2: Security Standards
SECURITY STANDARDS • Mandated by 501(b) of Gramm-Leach- Bliley Act • Promulgated under Section 39 of the FDI Act - Enforceable • Developed by the FDIC, FRB, OCC, & OTS • Effective Date: July 1, 2001
Slide 3: Applicability
APPLICABILITY • Applies only to “customer’s non-public personal information” – Does not cover information relating to the bank, business customers or to consumers that have not established an ongoing relationship with the financial institution. – Consistent with definition of non-public personal inf
Slide 4: Information Security Program
INFORMATION SECURITY PROGRAM • Each financial institution (FI) shall implement a comprehensive written information security program. • The program must include administrative, technical, and physical safeguards appropriate to the size and complexity of the FI and the nature and scope of its activiti
Slide 5: Objectives
OBJECTIVES • Ensure the security and confidentiality of customer records and information. • Protect against anticipated threats or hazards to the security or integrity of such records. • Protect against unauthorized access to or use of such records or information that would result in substantial har
Slide 6: Program Development & Implementation
PROGRAM DEVELOPMENT & IMPLEMENTATION • Involve the Board of Directors • Assess Risk • Manage and Control Risk • Oversee Service Provider Arrangements • Adjust the Program • Report to the Board
Slide 7: Involve the Board of Directors
INVOLVE THE BOARD OF DIRECTORS • The Board or a board designated committee shall: – Approve the FI’s written security program. – Oversee the development, implementation, and maintenance of the program. – Assign specific responsibility for its implementation and review reports from management.
Slide 8: Assess Risk
ASSESS RISK • Identify internal & external threats to customer information/information systems. • Assess potential damage of these threats. • Assess sufficiency of policies, procedures, customer information systems, and other arrangements in place to control risk.
Slide 9: Manage & Control Risk
MANAGE & CONTROL RISK • Each FI shall design an information security program to control identified risks including: – Logical Access Controls – Physical Access Restrictions – Encryption of Information – Information Systems Modification Procedures
Slide 10: Manage & Control Risk Continued
MANAGE & CONTROL RISK CONTINUED • Information Security Program Contd. – Dual Control, Segregation of Duties, & Employee Background Checks – Monitoring Systems/Intrusion Detection – Incident Response Programs – Measures to Protect Against Destruction, Loss, or Damage of Customer Information from Envi
Slide 11: Manage & Control Risk Continued
MANAGE & CONTROL RISK CONTINUED • Train Staff to Implement the Program. • Regularly Test Key Controls, Systems, and Procedures of the Security Program. – Test Frequency & Scope to be Determined by the FI’s Risk Assessment. – Tests should be Conducted & Reviewed by Independent Third Parties or Staff.
Slide 12: Oversee Service Provider Arrangements
OVERSEE SERVICE PROVIDER ARRANGEMENTS • Due Diligence in the Selection Process • Contract Clauses to Meet Guidance Objectives • Monitor Service Providers – Review Audits & Test Results
Slide 13: Adjust the Program
ADJUST THE PROGRAM • Monitor, Evaluate, and Adjust the Program to Address: – Technological Changes – Sensitivity of Customer Information – Internal/External Threats – FI’s Changing Business Arrangements
Slide 14: Report to the Board
REPORT TO THE BOARD • Report to Board or Designated Committee at least Annually. – Describe overall status and financial institution’s compliance with the program
Slide 15: Report to the Board Continued
REPORT TO THE BOARD CONTINUED • Reports should address: – Risk Assessment & Management – Control Decisions – Service Provider Arrangements – Results of Testing – Security Breaches or Violations – Management’s Responses & Recommendations for Changes
Slide 16: Implement Standards
IMPLEMENT STANDARDS • Must Implement an Information Security Program by JULY 1, 2001
Slide 17: Grandfathering Clause
GRANDFATHERING CLAUSE • Service provider contracts entered into on or before March 5, 2001 have until July 1, 2003 to comply with the Service Provider Agreement requirements.
Slide 18: Questions
QUESTIONS be) 4
Slide 19: Comments
COMMENTS
Slide 20: Complaints
COMPLAINTS
Slide 21: Contact Information
CONTACT INFORMATION • Marlene Roberts • Examination Specialist (IS) • 25 Ecker Street • San Francisco, CA 94105 • (415)808-8003 • marroberts@fdic.gov