Licensees must take appropriate steps to ensure the security of any information handled or held on behalf of their customers.