The new FACT Act provisions regarding idenity theft appear to be sufficiently broad to address information security issues. Specifically, issues relating to PC use by bank employees would be appropriately included in the implementation of the identity theft provisions of the FACT Act. The policy and procedures are to be risk based and FACT Act provisions for idenity theft appear to be sufficiently broad to address when IT dept should clean the hard drive of bank employee PC's before assigning to another department. This is a scope issue with the new regulation and I find it sufficiently broad to include many IT security issues. Anyone agree or disagree?

Correct me if I am mistaken Graham, but one of the underlining issues I seemed to notice repeated a few times was the Bank should create it's own procedures/policy. Maybe your policy or procedures won't call for the wiping of a hard drive IF it is staying within the Bank and is still only for the Bank' use? Just an idea.

Thank you for responding. Good point about having our own internal policy and proceures. Getting IT involved is critical. If we do not wipe the hard drive and the computer is staying in the bank, Is this an unacceptable amount of risk? I think it depends on what kind of sensitive or customer data is saved on the hard drive. Doesn't alot of idenity theft occur from inside the bank? Thanks for responding ACB or others.