GLBA Safeguards Rule

Why does it matter?

The Safeguards Rule is the federal security standard for non-bank financial businesses, and since 2021 it has named the controls instead of leaving them to judgment: encryption, multi-factor authentication, disposal within two years, annual penetration testing and six-monthly vulnerability assessments. Since May 13, 2024 the FTC also learns of larger breaches directly, through the section 314.4(j) notice that it publishes. A car dealer, mortgage broker or tax preparer that cannot show the written program, the Qualified Individual's annual report and the test results faces an FTC enforcement action under the rule and Section 5 of the FTC Act.

Key benefits include:

• A named set of safeguards

Section 314.4(c)(1) to (8) lists access controls, an inventory of data and systems, encryption in transit and at rest, secure development, multi-factor authentication, disposal and retention, change management and activity logging.

• One accountable person

Section 314.4(a) requires a Qualified Individual to oversee, implement and enforce the program, with a senior staff member overseeing any outside provider that fills the role.

• Evidence examiners can read

A written risk assessment (314.4(b)), test results (314.4(d)), service provider assessments (314.4(f)) and a written incident response plan (314.4(h)) are all required documents.

• Board visibility

The Qualified Individual reports in writing to the board or governing body at least annually under section 314.4(i), covering program status, risk decisions, test results and security events.

• A fixed breach clock

A notification event involving at least 500 consumers must be reported to the FTC as soon as possible and no later than 30 days after discovery (314.4(j)).

How does it work?

Section 314.3 sets the frame: a comprehensive information security program, written in one or more readily accessible parts, with administrative, technical and physical safeguards appropriate to the institution's size and complexity, the nature and scope of its activities and the sensitivity of the customer information. Its objectives follow the statute: to ensure the security and confidentiality of customer information, to protect against anticipated threats or hazards to its security or integrity, and to protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.

Section 314.4 lists the elements. The Qualified Individual (a) runs the program. The written risk assessment (b) identifies reasonably foreseeable internal and external risks and the criteria for rating them. The safeguards (c) are the eight controls, including encryption of customer information in transit over external networks and at rest, multi-factor authentication for anyone accessing an information system and secure disposal no later than two years after the last use unless retention is needed. Testing (d) means continuous monitoring or annual penetration testing plus vulnerability assessments at least every six months. Training (e), service providers (f), program adjustment (g), the incident response plan (h) and the annual board report (i) complete the list.

Section 314.4(j), effective May 13, 2024, requires electronic notice to the FTC on its form for any notification event involving at least 500 consumers: the institution's name and contact details, the types of information involved, the date or date range, the number of consumers affected and a general description, plus whether a law enforcement official has determined in writing that public notice would impede an investigation. The FTC publishes these notices. Section 314.6 exempts institutions holding information on fewer than 5,000 consumers from the written risk assessment, the continuous monitoring or penetration testing requirement in 314.4(d)(2), the incident response plan and the annual board report.

Key Elements

• Qualified Individual (314.4(a))

One person, who may be an employee, an affiliate's employee or a service provider's employee, oversees the program; the institution stays responsible and designates a senior staff member to oversee an outside provider.

• Written risk assessment (314.4(b))

Identifies reasonably foreseeable risks to customer information, assesses existing safeguards, sets criteria for rating risks and for confidentiality, integrity and availability, and is reassessed periodically.

• Eight safeguards (314.4(c))

Access controls, data and system inventory, encryption, secure development practices, multi-factor authentication, disposal and retention, change management, and monitoring and logging of user activity.

• Testing, training and service providers (314.4(d) to (f))

Continuous monitoring or annual penetration tests and six-monthly vulnerability assessments; security awareness training; contractual safeguards and periodic assessment of service providers.

• Incident response plan and board report (314.4(h) and (i))

A written plan covering goals, processes, roles, communications, remediation, documentation and post-event revision; a written report to the board at least annually.

• Notification events (314.2 and 314.4(j))

Unauthorized acquisition of unencrypted customer information, presumed from unauthorized access unless reliable evidence shows otherwise; FTC notice within 30 days when 500 or more consumers are involved.

What does it cover?

The rule applies to the handling of customer information by every financial institution over which the FTC has jurisdiction under section 505 of the Gramm-Leach-Bliley Act (15 U.S.C. 6805(a)(7)), that is, businesses significantly engaged in activities that are financial in nature under section 4(k) of the Bank Holding Company Act and not supervised by a federal banking agency, the NCUA, the SEC or a state insurance authority. Section 314.1(b) gives the examples, from mortgage lenders and payday lenders to tax preparation firms and finders. It covers all customer information in the institution's possession, including information about other institutions' customers, in any form.

What are its objectives?

The Safeguards Rule exists to carry out the objectives Congress set in 15 U.S.C. 6801(b).

Ensure the security and confidentiality of customer records and information.

Protect against any anticipated threats or hazards to the security or integrity of such records.

Protect against unauthorized access to or use of such records or information that could result in substantial harm or inconvenience to any customer.

Make one accountable person, a written program and periodic testing the proof of those outcomes.

Give the FTC prompt notice of larger breaches through section 314.4(j).

Framework in Context

The Safeguards Rule is the FTC's half of the GLBA security regime; banks, savings associations and credit unions follow the Interagency Guidelines Establishing Information Security Standards and the FFIEC IT Handbook, and SEC registrants follow Regulation S-P, which the SEC amended in 2024 with its own incident response and notification duties. The 2021 rewrite drew its structure from the New York Department of Financial Services' 23 NYCRR 500, and its eight safeguards line up with the NIST Cybersecurity Framework and ISO/IEC 27001 controls, which is why a single control set serves the rule, a SOC 2 report and state privacy laws. The FTC's companion Privacy Rule (16 CFR Part 313) and the FTC Act's Section 5 supply the enforcement backdrop.

Common Framework Mappings

Organizations map the Safeguards Rule's elements to the frameworks below so that the same safeguards, tests and evidence serve the FTC, auditors and other regulators.

Mapped frameworks include:

CIS Controls v8.1

EU DORA

FFIEC CAT

ISO 27001:2022

ISO 27701

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2