Can anyone clarify whether the Information Security Program is required to be go before the FI's Board annually? My understanding is that the ISO must review the Program for effectiveness, making appropriate adjustments. The ISO's annual report to the Board should include substantive changes to the Program, if any. However, it is not necessary for the Program itself to be ratified by the Board every year?

Failure to perform and present an Annual Information Security Report to the Board is a violation of GLBA: Appendix B to Part 30.

The board, or designated board committee, should approve the institution’s written information security program; affirm responsibilities for the development, implementation, and maintenance of the program; and review a report on the overall status of the program at least annually.

Thank you for the clarification