What qualifications are needed for the “Qualified Individual” role in the DoE/GLBA amendment?

Posted April 10, 2023 | Written by Dale McMurtrie, Senior Security Advisor, GreyCastle Security
>> Download our GLBA checklist guide to make sure you’re prepared for the new deadline this year

In December 2021, the FTC released updated Standards for Safeguarding Customer Information. under the Gramm-Leach-Bliley Act (GLBA) As you may know, implementation of these safeguards must be completed by June of 2023.

Key Updates Regarding Requirements for the “Qualified Individual” Who Must Oversee the Program

Designate a single qualified individual (QI) for program oversight:

- - - Previously, program oversight could be a shared responsibility among individuals in multiple roles. This is no longer the case.
    - The individual can be either an employee or a third-party.
    - If the individual is a third-party, the institution retains all compliance obligations, and must designate a “senior member” to direct and oversee the non-employee.

Mandatory reporting to the board of directors:

- - - The QI overseeing the information security program must submit a written report to the board of directors or equivalent governing body. If none exist, the report must be submitted to the senior institution officer whom the QI reports to.
    - The report must include the overall status of the information security program, including compliance with the updated Safeguards Rule
    - The report must also contain material matters impacting the information security program, including risks, impacts, and recommended improvements and mitigating actions

Here’s the mandate from the FTC:

“… develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to [the institution’s] size and complexity, the nature and scope of [institutional] activities, and the sensitivity of any customer information at issue.”

Many people come to GreyCastle Security seeking guidance and support to better understand what this really means and how they can find a person that satisfies this requirement. Qualified Individuals (QI) possess many of the capabilities and experience of individuals on the Greycastle Security vCISO Strategy and Governance team.

One thing that is important to keep in mind is that while QIs are expected to be able to oversee the complete GLBA cybersecurity program, technical execution in many areas is delegated to other members of the team with more specific and current expertise. It’s important to note that a “qualified individual” very likely has significant experience in technical areas of cyber but they must have leadership capabilities that are often only developed over time. Here are eleven key qualities of a qualified individual:

Years of experience
10+ years of experience developing, implementing, and maintaining information security programs

Knowledge of relevant laws and regulations
The qualified individual must have a thorough understanding of the GLBA and other relevant laws and regulations governing the financial institution’s information security program.

Risk assessment expertise
The qualified individual should be able to conduct risk assessments to identify potential risks to the financial institution’s customer information and systems.

Information security knowledge
The qualified individual should have expertise in information security, including knowledge of technical and administrative safeguards and best practices for information security.

Organizational skills
The qualified individual should be able to organize and manage the information security program, including the development and implementation of policies and procedures that align the program throughout the organization.

Communication skills
The qualified individual should be able to communicate effectively with stakeholders, including senior management, employees, and customers, to ensure that they are aware of the institution’s information security program and its role in safeguarding customer information.

Training and awareness
The qualified individual should be able to develop and implement training and awareness programs to educate employees about information security and their responsibilities for protecting customer information, highlighting what is most important for their organization.

Incident response expertise
The qualified individual should be able to develop and implement incident response plans to address security incidents and breaches.

Audit and assessment
The qualified individual should be able to conduct or direct periodic audits and assessments of the institution’s information security program to ensure compliance with the FTC Safeguards Rule.

Risk management
The qualified individual should be able to manage risks related to the institution’s information security program and make clear recommendations for risk mitigation strategies.

Technical knowledge
The qualified individual should have the technical knowledge to evaluate and select security technologies and tools to protect customer information and systems and guide teams on the implementation and management of selected solutions.

These skills and capabilities are what we expect to find in a job description for many a CISO role and are requisite of an individual that is qualified to manage a cybersecurity program. This includes all components of a GLBA cybersecurity program and the ability to align the organization, identify and mitigate top risks, and ensure ongoing compliance with an ever-changing threat and compliance landscape.

Want to make sure you’re up-to-date on the newest compliance requirements? Grab our newest GLBA checklist guide to make sure you’re prepared for the new deadline this year.

Get your free GLBA guide now