Ok, I've done a search on BOL and have found that GLB is not a favorite topic!
We are having our Safety and Soundness exam in a few weeks and they are asking for a GLB Risk Assessment Policy. I have searched everywhere for some guidance on this; including Kirchman, BOL, Bank Focus, etc. I have come up with nothing, has anyone else had to come up with this policy?

Kara,
We were told we needed to do a risk assessment along with testing and reporting, but nothing about a risk assessment policy.

Yeah, well the Board meets at 4:00 today and needs a policy! Talk about pulling hair out!

Also GLB and Reg P. Same thing or two different regs/laws?

In our Safey and Soundess Exam they wanted an extension assessment of the Information Security. Even though we had an Information Systems Policy with most all the items covered, we did not have a formal assessment from the IT Department and they seemed to want Information "Security" where we had our titled Information "Systems".

Kara,
I have an "Access to Customer Information" policy if that will help. Give me your email address and I will send it to you.

We recently had our S & S exam but I was not asked about a Risk Assessment policy. However, we do address risk assessment in our Information Security Program. Maybe it has been included in your written Program?

In reply to:

---

Also GLB and Reg P. Same thing or two different regs/laws?

---

GLB contained the privacy requirements that became Reg P, but included quite a bit more than that. Financial holding companies, sale of insurance disclosures, Reg E and on-machine ATM fee disclosures, and Information Security Guidelines also came from GLB. The "risk assessment" is PROBABLY the risk assessment required for Information Security, which did come from GLB.

Kara:

I submitted an Intrusion Risk Assessment Policy a few months back. I tried to write the policy so that it addressed the security concerns outlined in GLB. You can find it at

www.bankersonline.com/tools/intrusionriskassess.doc

Regards,
Wayne Barnett, Preaident
Wayne Barnett Software
A Texas Corporation
877-945-4344
wbarnett@barnettsoftware.com

Wayne Barnett, CPA
800-680-8692
wbarnett@barnettcpa.com

Thank you all very much, I really appreciate the help!