(1) A licensee's information security program shall be designed to:

(a) ensure the security and confidentiality of personal information;

(b) protect against any anticipated threats or hazards to the security or integrity of the information; and

(c) protect against unauthorized access to or use of the information that could result in substantial harm or inconvenience to any individual or a violation of the Privacy Act.