12 CFR §326.2

Upon the issuance of Federal deposit insurance, the board of directors of each institution shall designate a security officer who shall have the authority, subject to the approval of the board of directors, to develop, within a reasonable time, but no later than 180 days, and to administer a written security program for each banking office.