ND LEG Information Security Program

Published on: Apr 28, 2025

On Apr. 10, ND LEG enacted bill on financial data security program.

  • ND LEG enacted HB 1127 relating to the financial institution data security program.
  • Amendments to the North Dakota century code ND FIN 6-01-04.1, ND FIN 13-04.1-01.1; enacted new ND FIN 13-01.2, on financial institution's data security program.
  • Document dated Apr. 10, 2025, was received on Apr. 24, 2025, due to a fixed feed.
  • Removal of Officers
  • Current or former officer, director, employee, other participating in conduct of affairs of financial corp. or institution, CU issued order permanently suspend, prohibiting person.
  • From participation if convicted of any charge involving dishonesty or breach of trust.
  • Suspension or removal order effective immediately upon issuance on current or former officer, director, employee and upon financial corporation, financial institution, or CU.
  • Data Security Program
  • Financial corporation must develop, implement, maintain a comprehensive information security program; program must be written in one or more readily accessible parts.
  • Program must maintain administrative, technical, physical safeguards appropriate to financial corporation's size, complexity, nature, scope of financial corporation activities.
  • Must develop program that ensures security, confidentiality of customer information.
  • Protects against anticipated threats, hazards to security, integrity of such information; protects against unauthorized access to or use of info that could result in harm.
  • If designate individual employed by affiliate or service provider as qualified individual, must retain responsibility for compliance, require provider maintain info sec program.
  • A financial corporation must base financial corporation's information security program on a risk assessment that assesses sufficiency of safeguards in place to control risks.
  • Must design and implement safeguards to control risks identified via risk assessment.
  • Regularly test, monitor effectiveness of safeguards' key controls, systems, procedures.
  • Must implement policies and procedures to ensure the financial corporation's personnel are able to enact the financial corporation's information security program.
  • Oversee service providers by taking steps select, retain service providers; requiring, by contract, implement and maintain appropriate safeguards; periodically assessing.
  • Money Brokers
  • Added definition of loan to mean contract by which one delivers sum of money to another, latter agrees return at future time sum equivalent to which person borrowed.
  • Includes alternative financing products as identified by commissioner through order.
  • Legislative History
  • On Jan. 7, 2025, bill introduced in the House; on Feb. 14, 2025, bill passed the House.
  • On Feb. 18, 2025, bill introduced into Senate; on Mar. 13, 2025, bill passed Senate.
  • On Apr. 2, 2025, House concurred amendments; on Apr. 8, 2025, signed by House.
  • On Apr. 8, 2025, delivered to governor; on Apr. 10, 2025, bill signed by governor.
  • Effectiveness
  • Per ND Constitution, upon approval by governor, bill becomes effective Aug. 1, 2025.
Regulators
ND LEG
Entity Types
Bank; Corp; CU; MSB
Reference
Bill HB1127, 4/10/2025; Citation: *ND FIN* 6-01-04.1, 13-04.1-01.1, 13;
Functions
Compliance; C-Suite; Cyber; Legal; Operations; Outsourcing; Record Retention; Reporting; Risk; Technology
Countries
United States of America
Category
State
N/A
Products
Banking; Corporate; Deposits; Loan
Rule Type
Final
Regions
Am
Rule Date
Apr 10, 2025
Effective Date
Aug 1, 2025
Rule ID
252175
Linked to
N/A
Reg. Last Update
Apr 10, 2025
Report Section
US Banking