(1) Each licensee shall implement a comprehensive written information security program that includes administrative, technical and physical safeguards for the protection of personal information. The administrative, technical and physical safeguards included in the information security program shall be appropriate to the size and complexity of the licensee and the nature and scope of its activities.