About this Framework
The Gramm-Leach-Bliley Act (GLBA) Safeguards Rule, significantly updated in 2021 (effective June 2023), requires financial institutions to implement a written information security program protecting customers' non-public personal information (NPI). The revised rule added specific technical requirements — MFA, encryption, access controls, penetration testing and a written incident response plan — closely aligned with NIST CSF and CIS Controls. Institutions with over 5,000 customer records must notify the FTC within 30 days of a security breach.
Key Control Domains
Information Security Program Governance
Risk Assessment
Access Controls & Authentication
Encryption (In Transit and At Rest)
Multi-Factor Authentication (MFA)
Secure Development Practices
Penetration Testing & Vulnerability Scanning
Incident Response Plan
Vendor & Service Provider Management
Data Disposal & Retention
Who Needs This?
- Banks, credit unions and savings associations
- Mortgage lenders, brokers and servicers
- Auto dealers with consumer financing programs
- Accountants, tax preparers and financial advisors
- Investment advisors and broker-dealers
Compliance Benefits
- FTC regulatory compliance and civil penalty avoidance
- Structured customer financial data protection program
- Updated 2021 rule aligned with modern technical security standards
- Foundation for state-level financial privacy law compliance
Official Reference
FTC GLBA Safeguards Rule Guidance
https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act
Assessment Details
Share this Assessment
Share this permanent link with your team, clients or auditors.
https://grcopilot.app/frameworks/glba-safeguards-rule-assessment