191—90.40 (505) Effective date. Each licensee shall establish and implement an information security program, including appropriate policies and systems, by June 30, 2003.