I am interested in what other banks currently do about email encryption. Currently, our policy is to manually encrypt all sensitive outgoing documents, but we are looking at an automatic solution. Does anyone have a product that they use and would recommend?

Thanks.

Zix Corp is the one we used at my last place. From a user standpoint, it was very easy - you just typed securemail in the subject line before the actual subject and that was it. The person you sent it to got a notification directing them to the hosted website where they would log on and retrieve their mail.

Is outgoing email encryption required under GLBA or other standards?

Can anyone point me to any examples in which sensitive non-public personal information (NPPI) from an unencrypted email was actually compromised? I've been fighting for 18 months for us to get outgoing email encryption and management's response is that the risk is remote and the costs are too high. I think the reputation risk of not having email encryption is too high.

Below is a quote from the Interagency Guidelines Establishing Information Security Standards:

FDIC - 12 CFR Part 364 Appendix B III C 1 c
OCC - 12 CFR Part 30 Appendix B III C 1 c

"Encryption of electronic customer information, including while in transit or in storage on networks or systems to which unauthorized individuals may have access"

"in transit" would include e-mail containing customer confidential information . . .

I know of 3 community banks that use SecureWorks for email encryption. The banks each have 50-100 users.