Could someone please provide me with some guidance or direction as to what an Annual GLBA Board Report would contain?

I need to do one of these for two separate entities and want to ensure that I have sufficient information to apprise the Board as well as make the examination staff happy as well.

I sent you something, check your PMs.

Oh! Oh! Me too. Please, please, please.

I don't have any help for you really, but I will tell you what we do in lieu of an annual report and the examiner's have been happy with it. We have a formal GLBA committee that meets quarterly. We send the minutes of that meeting to the board of directors quarterly and they stand for our "annual report". In this way, the board is informed of information on a much more timely basis and the coverage is more complete. (IMHO)

If you mean the annual IT report, your infosec program must:

• Be approved and overseen by the Board of directors
• Be adjusted, as appropriate, for changes in the bank’s (or
servicer’s) processing environment or systems.
• Include an annual report to the board (or committee) describing the overall status of the program and bank’s compliance with the Guidelines.

In the FFIEC IT Handbook, look at the Booklet: Information Security, Section: Security Process. Go to http://www.ffiec.gov/ffiecinfobase/html_pages/infosec_book_frame.htm

It states: The board should approve written information security policies and the written report on the effectiveness of the information security program at least annually. At a minimum, the report should address:

1) the results of the risk assessment process;
2) risk management and control decisions;
3) service provider arrangements;
4) results of security monitoring and testing;
5) security breaches or violations and management’s responses; and
6) recommendations for changes to the information security program.

The annual approval should consider the results of management assessments and reviews, internal and external audit activity related to information security, third-party reviews of the information security program and information security measures, and other internal or external reviews designed to assess the adequacy of information security controls.

I have a memo that touches each of the above, and make sure it's in the board packet and approved in the board minutes.