A licensee shall implement a comprehensive written information security program that includes administrative, technical and physical safeguards for the protection of customer information. The administrative, technical and physical safeguards included in the information security program shall be appropriate to the size and complexity of the licensee and the nature and scope of its activities.
31 Pa. Code § 146c.3
This section cited in 31 Pa. Code § 146c.5 (relating to examples of methods of development and implementation); and 31 Pa. Code § 146c.10 (relating to determined violation).