exchange

Under the proposed rules, a regulated entity must create a management group called the Information Security Group (InfoSec Group), separate from its existing Information Technology Group, and appoint a Chief Information Security Officer.