Data loss or compromise not only hurts the Receiver, but can also damage a business’s reputation. Receiver trust is a key factor in building loyalty. It is in the Originator’s best interest to develop and deploy practices that protect the integrity of Receiver information and the transaction, and to ensure that these practices are audited for their effectiveness.
The Nacha Operating Rules for debit WEB transactions require Originators to conduct an annual data security audit to ensure that Receivers’ financial information is protected by security practices and procedures that ensure the financial information the Originator obtains from Receivers is protected by commercially reasonable security practices that include adequate levels of:
physical security to protect against theft, tampering, or damage,
administrative, technical, and physical access controls to protect against unauthorized access and use,
network security to ensure secure capture, transmission, storage, distribution and destruction of financial information.
While the Nacha Operating Rules only require Originators of debit WEB Entries to conduct an audit of their security practices and procedures once a year, many companies are now opting to audit these practices bi-annually or even quarterly due to the rapid change of technology and security risks. It is therefore highly recommended that Originators of debit WEB entries conduct more frequent audits.
This audit requirement can be met in several ways. It can be a component of a comprehensive internal or external audit, or it can be an independent audit that uses a commercially reasonable generally accepted security compliance program. An Originator that is already conducting an audit of these practices and procedures for another area of its business is not required to have two separate audits. However, the audit should address adequate levels of data security for the Originator’s ACH operations.
The following sections detail the minimum components that need to be audited in order to be in compliance with the audit requirement. (NOTE: In any case where these key components are not specifically required under the Nacha Operating Rules, all are recommended by Nacha as sound business practices.)
It is important to note that for transactions that involve some use of the Internet but are not defined as WEB transactions, Originators must incorporate the security and risk management principles of the WEB rules, as applicable. For example the Originator is required to authenticate the Receiver and conduct a data security audit to ensure the Receiver’s data is stored securely.