GLBA Cybersecurity Requirements: What Gramm-Leach-Bliley Means for Your IT

The Gramm-Leach-Bliley Act (GLBA) a.k.a. the Financial Services Modernization Act is a 1999 piece of US legislation that reformed the finance industry by allowing banks to operate in the commercial, investment and insurance sector at the same time. By removing prior restrictions from the Glass-Steagall Act, GLBA cleared the way for huge mergers in the banking industry.

In addition to market reform, the Gramm-Leach-Bliley Act also includes security and privacy requirements for financial institutions:

However, GLBA does not detail what a privacy policy should look like or what appropriate safeguards for financial information are. Instead, the bill tasked relevant agencies such as the Federal Trade Commission (FTC) with creating specific rules based on the legislation, which were implemented in the Code of Federal Regulations.

The Gramm-Leach-Bliley Act applies to all financial institutions over which the FTC has jurisdiction, defined as “all businesses, regardless of size, that are significantly engaged in providing financial products or services” (and which are not subject to the enforcement authority of another regulatory agency). The FTC has a detailed list of activities it considers financial in nature, but in general the GLBA applies to:

The GLBA governs nonpublic personal information (NPI), which is all personally identifiable information financial institutions collect about their customers that is not publicly available through other sources, such as public government records.

NPI includes:

The Privacy of Consumer Financial Information Rule (Privacy Rule) is the federal regulation put in place by the FTC to implement financial privacy provisions of the Gramm-Leach-Bliley Act. Its full text can be found under 16 C.F.R. Part 313.

To comply with GLBA, financial institutions need to disclose their privacy policies and practices to consumers and give them the ability to opt out of their information being shared, except for a few specified purposes such as joint marketing or delivering a financial service. In the Privacy Rule, the FTC provides a model privacy form and lays out the notification and opt out requirements.

Standards for Safeguarding Customer Information or the Safeguards Rule is the federal regulation that implements sections 501 and 505 of the Gramm-Leach-Bliley Act. The full text of the Safeguards Rule is available at 16 C.F.R. Part 314.

The GLBA requires financial institutions to implement administrative, technical and physical safeguards to:

In the Safeguards Rule, the FTC details what a GLBA-compliant security program looks like and which safety measures banks need to implement, including risk assessments, stringent access controls and regular reviews and reports to the board. Learn more about the exact requirements of GBLA below.

Under the section Fraudulent Access to Financial Information, the GLBA prohibits obtaining customer information from financial institutions under false pretenses, such as making false statements or presenting false documents to bank employees or customers.

While the Safeguards Rule already requires banks to protect against various forms of fraud – including phishing, social engineering and insider threats – the Pretexting Provisions add a criminal penalty for the perpetrators behind these schemes: up to 5 years in prison or a fine of $250,000. In aggravated cases, the sentence can double to 10 years in prison or $500,000.

In order to comply with the Gramm-Leach-Bliley Act, financial institutions need to develop, implement and maintain a written information security program. This document explains the nature and sensitivity of customer data your organization collects and the specific safeguards (administrative, technical and physical) used to protect it from threats and unauthorized access.

Here are the requirements your information security program needs to conform to:

Aside from the structure of your security program, the FTC safeguards rule also details a number of specific safeguards banks need to cover in order to comply with the GLBA, beginning with the need for access controls.

In order to protect the privacy and security of customer data, financial institutes need to:

In order to manage their IT risks successfully, the GLBA requires organizations to identify the data, staff, devices and systems that enable their day-to-day operations and manage these assets according to their risk strategy and their relative importance to business objectives.

In simple terms, this means that banks and other financial institutions need to first identify all IT assets and then apply stricter security measures depending on an asset’s sensitivity level.

All customer information transmitted to your organization needs to be protected by encryption both at rest and in transit. When encryption is not feasible, alternative methods to secure information can be used as a compensating control, but only if your qualified individual reviews and approves them.

As part of their GLBA compliance, organizations need to evaluate the security of external software applications they utilize to store, transmit or access customer information. Likewise, you need to adopt secure development practices for any in-house applications used to process customer data.

Any information system that stores customer information must be secured through multi-factor authentication (MFA) for all accounts.

GLBA compliance requires businesses to securely dispose of customer information after 2 years from when it was last used to provide a service, unless a longer retention period is necessary for legal reasons or legitimate business purposes.

Either way, companies need to implement procedures for the secure disposal of customer information and periodically review their data retention policy to minimize the unnecessary retention of data.

Financial institutions need to adopt change management procedures to comply with the GLBA, which means that any change to the IT infrastructure, such as installing a new piece of software, needs to be reviewed and approved before it is implemented. This evaluation is intended to help organizations understand the security impact of proposed changes ahead of time.

To detect unauthorized access or tampering with customer data, GLBA requires organizations to implement procedures to monitor and log user activity.

To assess the effectiveness of your information security program, the FTC requires annual penetration testing based on relevant risks identified through your risk assessment.

Vulnerability assessments are likewise required to ensure the effectiveness of your IT safeguards and need to be conducted every six months as well as following material changes to your operations or business arrangements.

As part of their organizational controls, businesses covered by the GLBA need to ensure that their staff is able to follow the information security program by:

Aside from protecting their own network, the GLBA also requires financial companies to manage third-party risks and oversee their service providers by:

One of the cornerstones of GLBA compliance is protecting customer data from unauthorized access – both inside the organization and from external threats like data breaches and cyberattacks. But with hundreds of employees and dozens of information systems, how can financial institutions really ensure that no one on their staff has access they do not need?

There’s only one way to guarantee accurate user provisioning, timely on- and offboarding and least privilege access for all IT users: an automated IAM solution. Platforms for identity & access management allow businesses to track and manage all IT permissions through one central hub – from lifecycle automation to detailed reporting, regular permission audits and a self-service platform for end users.

While identity and access management is crucial to GLBA compliance – as well as standards like SOX, HIPAA and NIST 800-53 – there is one major problem: Most IAM solutions are far too complex to be used effectively outside huge, global corporations.

Conventional IAM products are delivered to you as a framework of building blocks that requires significant effort to assemble into a working platform: from custom code for interfaces to crafting your own workflows.

This build-your-own-IAM approach not only makes the software difficult to set up, but also challenging to maintain: Any change in your IT infrastructure and you need to go through the same process all over again.

Luckily, there is a faster and easier option that delivers the same results as complex enterprise platforms: Our no-code IAM solution tenfold!

Unlike conventional identity & access management products, tenfold comes with a suite of prebuilt plugins that allow you to connect your IT systems with just a few clicks! All plugins and features can be fully configured through our no-code UI – eliminating the need for scripting and custom code.

tenfold is easy to set up and operate while delivering the same powerful features you’d expect from an enterprise platform: automated provisioning, central access audits and detailed permission reporting, from accounts in IT systems down to unstructured data in file servers and cloud storage.

Make your life easy with our no-code platform for GLBA-compliant access control! Watch our video demo to learn more or sign up for a free trial to test our solution in-depth!