20260529130617621 Attachment 10 - GLBA Safeguards Rule Compliance Acknowledgment.pdf

ATTACHMENT 10- GLBA Safeguards Rule Compliance Acknowledgment

RFP 26-07

Banking Depository Services

INSTRUCTIONS

1. Complete all required fields. Leave no required field blank. If not applicable, enter “N/A.”

2. Check each compliance box. All boxes must be checked; if any item is not yet fully implemented, provide an explanation in Section 3.

3. This Acknowledgment must be signed by an officer with authority to bind the institution.

4. This Attachment must be included in your sealed proposal PDF uploaded to PlanetBids by the deadline. It does not count toward the 75-page narrative limit.

SECTION 1 — REGULATORY BASIS

This Acknowledgment is submitted pursuant to the Gramm-Leach-Bliley Act (GLBA), 15 U.S.C. §6801 et seq., and implementing regulations at 16 CFR Part 314 (Standards for Safeguarding Customer Information), as amended by the FTC Safeguards Rule Final Rule effective June 9, 2023. Financial institutions subject to the GLBA Safeguards Rule are required to develop, implement, and maintain a comprehensive written information security program to protect customer financial information.

DCTA requires this Acknowledgment as a condition of proposal consideration for RFP 26-07, Banking Depository Services, to confirm that the proposing institution has an active, compliant information security program that will protect DCTA’s account data, customer information, and transaction records throughout the term of any resulting agreement.

SECTION 2 — COMPLIANCE CERTIFICATION CHECKLIST

By checking each item below, the authorized officer certifies that the institution currently satisfies each requirement. For any item where implementation is partial or subject to a known remediation timeline, provide an explanation in Section 3.

☐ Written Information Security Program (WISP)

The institution maintains a comprehensive Written Information Security Program (WISP) satisfying 16 CFR Part 314, as amended effective June 9, 2023.

☐ Qualified Individual / CISO Designation

The institution has designated a qualified individual responsible for overseeing and enforcing the WISP, who reports to the Board of Directors at least annually on the state of the information security program.

☐ Risk Assessment

The institution conducts periodic risk assessments to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, and evaluates existing safeguards.

☐ Safeguards Implementation

The institution has implemented and monitors safeguards to control identified risks, including: access controls, data inventory and classification, encryption of customer information in transit and at rest, and multi-factor authentication for any individual who accesses customer information.

☐ Service Provider Oversight

The institution selects and retains only service providers that maintain appropriate safeguards and requires service providers to implement and maintain such safeguards by contract.

☐ Incident Response Plan

The institution maintains a written incident response plan designed to promptly respond to and recover from any security event materially affecting the confidentiality, integrity, or availability of customer information.

☐ Annual Board Reporting

The qualified individual presents a written annual report on the WISP to the Board of Directors (or a committee thereof) addressing overall WISP status and compliance with 16 CFR Part 314.

☐ Encryption Standards

Customer information is encrypted using current industry standards (minimum TLS 1.2 in transit; AES-256 at rest) on all systems handling DCTA account or transaction data.

☐ Multi-Factor Authentication (MFA)

MFA is required for all personnel with access to customer information systems; MFA uses at least two independent authentication factors and does not rely solely on SMS-based one-time passwords.

☐ SOC Audit Compliance

The institution undergoes annual SOC 1 Type II and SOC 2 Type II audits covering depository and related IT services and will provide DCTA current-year reports upon request under appropriate confidentiality protections.

SECTION 3 — EXCEPTIONS, PARTIAL COMPLIANCE, OR COMMENTS

If any certification above cannot be checked, or if any item is subject to pending remediation, describe the current status and expected timeline for full compliance. Attach additional pages if needed.

SECTION 4 — ATTESTATION AND AUTHORIZED SIGNATURE

The undersigned officer, being duly authorized to act on behalf of the institution named below, hereby certifies under penalty of applicable law that: (a) all information in this Acknowledgment is true, accurate, and complete; (b) the institution currently maintains an information security program satisfying 16 CFR Part 314; and (c) the institution will maintain such a program throughout the term of any agreement awarded pursuant to RFP 26-07.

Firm Name: _______________________________________________

Authorized Representative (Print): _______________________________________________

Title: _______________________________________________

Signature: _______________________________________________

Date: _______________________________________________

Email Address: _______________________________________________