Compliance FrameworksAmericas
GLBA
Gramm-Leach-Bliley Act - financial privacy rule, safeguards rule, pretexting protection.
Gramm-Leach-Bliley Act - financial privacy rule, safeguards rule, pretexting protection.
| Region | Americas |
| Country or scope | United States |
| Sector | Finance |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers GLBA
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 11 controls from Safeguard's control catalog for GLBA.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 23: 1 written for GLBA and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
GLBA-6801B Statutory Safeguards Mandate | Financial institutions must establish safeguards to insure the security and confidentiality of customer records and protect against anticipated threats and unauthorized access, an obligation documented through a formally identified written security program (15 U.S.C. 6801(b)) | Scan |
GLBA-314.4C2 Inventory of Data and Systems | The information security program must identify and manage the data, personnel, devices, systems, and facilities that enable the institution to achieve its business purposes, requiring an enumerated inventory of software components in those systems (16 CFR 314.4(c)(2)) | Scan |
GLBA-314.4B Written Risk Assessment | Institutions must base their safeguards on a written risk assessment identifying reasonably foreseeable risks to customer information; assessing software risk requires each component to be individually identifiable (16 CFR 314.4(b)) | Scan |
GLBA-314.4C3 Encryption and Integrity Controls | Customer information must be encrypted in transit over external networks and at rest, a protection posture that presupposes cryptographic integrity verification across the software stack handling that information (16 CFR 314.4(c)(3)) | Scan |
GLBA-314.4C4 Secure Development Practices | Institutions must adopt secure development practices for in-house applications and procedures for assessing externally developed applications that handle customer information, which requires precise, non-vague version declarations for the software in use (16 CFR 314.4(c)(4)) | Scan |
GLBA-314.4F Service Provider Oversight | Institutions must take reasonable steps to select service providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess them: requiring knowledge of the supplier behind each component and service (16 CFR 314.4(f)) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
313.4 | Privacy Notice: Initial |
313.6 | Privacy Notice: Annual |
314.4a | Information Security Program: Qualified Individual |
314.4b | Risk Assessment |
314.4c | Safeguards: Access Controls |
314.4d | Monitoring & Testing |
314.4e | Service Provider Oversight |
314.4f | Encryption of Customer Information |
314.4g | Incident Response Plan |
314.4h | Annual Board Reporting |
314.4i | Multi-Factor Authentication |
Policy templates
Written for GLBA:
- GLBA Customer Privacy Notice
And 22 from the standard set, adapted to GLBA.