OAR 836-081-0111: Information Security Program

(1) Each licensee shall implement a comprehensive written information security program that includes administrative, technical and physical safeguards for the protection of customer information. The administrative, technical and physical safeguards included in the information security program shall be appropriate to the size and complexity of the licensee and the nature and scope of its activities. (2) If a licensee is domiciled in another jurisdiction or subject to the primary jurisdiction of a different functional regulator, and the statutes and rules administered by its domiciliary regulator or primary functional regulator establish standards for protecting the security of consumer information that are substantially similar to those established by OAR 836-081-0101 to 836-081-0126, then good faith compliance with those standards to the satisfaction of the licensee’s primary regulator shall constitute compliance with OAR 836-081-0101 to 836-081-0126.