Resources to help licensees of DFI's Division of Consumer Services maintain information security and meet compliance requirements.
Overview
The Washington State Department of Financial Institutions Division of Consumer Services is concerned with the security of consumer information. Failure to maintain confidentiality, integrity, and availability of customer information can result in direct harm to consumers, as well as operational and reputational risk for licensees.
Licensees are encouraged to review relevant best practices and additional resources regarding information security and compliance listed below. These materials can provide valuable guidance on maintaining and enhancing Licensee information technology and security posture in accordance with industry standards and regulatory expectations.
Resources and Best Practices
- Best Practices and Resource List
- Nonbank Ransomware Self-Assessment Tool
- Cyber Hygiene Awareness Campaign
- More than a Password | CISA
- Free Cybersecurity Services & Tools | CISA
- Tabletop Exercises | CISA
Related Laws and Rules
Consumer Loan Companies
- WAC 208-620-490 (5) - Reporting requirements
- WAC 208-620-531 - Business resumption plans
- WAC 208-620-532 - Records disposal
- WAC 208-620-571 - Information security program requirements under Gramm-Leach-Bliley Act
- WAC 208-620-572 - Consumer privacy under Gramm-Leach Bliley Act and Regulation P
- WAC 208-620-573 - Notice to consumers of data breach
Mortgage Brokers
- WAC 208-660-400 (2)(e) - Reporting requirements
- WAC 208-660-460 - Information security program requirements under Gramm-Leach-Bliley Act
- WAC 208-660-470 - Consumer privacy under Gramm-Leach Bliley Act and Regulation P
- WAC 208-660-480 - Notice to consumers of data breach
- WAC 208-660-490 - Business resumption plans
Money Service Providers
- WAC 208-690-110 (10) - Report of material change
- WAC 208-690-240 - Cybersecurity program requirements
- WAC 208-690-250 - Information security program requirements under Gramm-Leach-Bliley Act
- WAC 208-690-260 - Consumer privacy under Gramm-Leach Bliley Act and Regulation P
- WAC 208-690-270 - Notice to consumers of data breach
- WAC 208-690-280 - Business resumption plans
Escrow Agents
- WAC 208-680-532 - Information security program requirements under Gramm-Leach-Bliley Act
- WAC 208-680-534 - Consumer privacy under Gramm-Leach Bliley Act and Regulation P
- WAC 208-680-536 - Notice to consumers of data breach
- WAC 208-680-538 - Business resumption plans
- WAC 208-680-265 (4)(i) - Reporting significant events