Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I skip having an information security program in place in Idaho? What are the requirements?

Information Security Program Requirements in Idaho

Based on the information provided in the context documents, it is not recommended to skip having an information security program in place in Idaho.

Security Breach Requirements

According to IDST 28-51-106, an agency, individual, or commercial entity that maintains its own notice procedures as part of an information security policy for the treatment of personal information, and whose procedures are otherwise consistent with the timing requirements of section 28-51-105, Idaho Code, is deemed to be in compliance with the notice requirements of section 28-51-105, Idaho Code, if the agency, individual, or commercial entity notifies affected Idaho residents in accordance with its policies in the event of a breach of security of the system.

User Responsibilities

IDAPA 11.10.01.20 outlines the responsibilities of any agency with access to ILETS, including the requirement to adhere to all applicable ILETS rules and policies and to have signed an agreement with ILETS or an interface agency to that effect. Additionally, any agency that enters information into ILETS or NCIC files is responsible for the accuracy, timeliness, and completeness of that information. Each agency employee who operates a computer to access ILETS must complete ILETS training at a level consistent with the employee’s duties, and each employee who operates a computer to access ILETS must be re-certified by the agency every two (2) years.

Conclusion

Based on the above requirements, it is strongly recommended that agencies, individuals, and commercial entities maintain an information security policy for the treatment of personal information and adhere to all applicable rules and policies. Failure to do so may result in sanctions imposed by the board, as outlined in IDAPA 11.10.01.28.

Therefore, it is not advisable to skip having an information security program in place in Idaho.

Jurisdiction

Idaho