Can I skip having an information security program in place in Indiana? What are the requirements?

Based on the Indiana Code, it is mandatory for a licensee to develop, implement, and maintain a comprehensive, written information security program that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee’s information systems ^[1.1]. This program must protect the security and confidentiality of nonpublic information and information systems, protect against any threats or hazards to the security or integrity of nonpublic information and information systems, protect against unauthorized access to or use of nonpublic information and minimize the likelihood of harm to a consumer, and define and periodically reevaluate a schedule for retention of nonpublic information and a procedure for its destruction when no longer needed ^[1.1][1.2]. Therefore, it is not possible to skip having an information security program in place in Indiana if you are a licensee.

Source(s):

• [1.1] Information security program; requirements
• [1.2] “Information security program”

Jurisdiction

Indiana

• Privacy