GLBA Safeguards Rule
The information security programme financial institutions must maintain for customer information.
- Issued by
- FTC
- Applies in
- United States
- Edition
- 16 CFR Part 314, amended 2023
- Area
- Data protection & privacy
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- 314.4(a)Qualified individual accountable for the programmeGovernance
- 314.4(b)Written risk assessmentRisk assessment
- 314.4(c)Access controls, encryption, MFA and secure developmentSecurity
- 314.4(h)Written incident response planIncidents
- 314.4(j)Breach notification to the FTCIncidents
How Amoreg keeps you on it.
Enable the GLBA Safeguards Rule and add FTC’s pages as a monitor of your own. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 5 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read FTC’s pages
- Check the library against 5 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: qualified individual accountable for the programme
- Rule
- GLBA Safeguards Rule, 314.4(a)
- Area
- Governance
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- EU General Data Protection RegulationThe data protection regime for controllers and processors established in, or targeting, the EU.European Union · 9 controls
- UK GDPR & Data Protection Act 2018The UK data protection regime after Brexit, with the ICO as supervisory authority.United Kingdom · 9 controls
- Data Protection (Bailiwick of Guernsey) Law, 2017The Bailiwick's GDPR-equivalent law, with EU adequacy.Guernsey · 9 controls
- Data Protection (Jersey) Law 2018Jersey's GDPR-equivalent law and the Data Protection Authority (Jersey) Law 2018 registration regime.Jersey · 9 controls
- Isle of Man GDPR & LED Implementing Regulations 2018The applied GDPR under the Data Protection Act 2018 (Isle of Man).Isle of Man · 9 controls
- Cayman Islands Data Protection ActEight data protection principles modelled on the UK Data Protection Act 1998, in force since 2019.Cayman Islands · 6 controls
Also in United States
- US Bank Secrecy Act / FinCEN AML ProgramBSA AML programme requirements: the pillars, CDD rule, SAR/CTR reporting and beneficial ownership.United States · 6 controls
- OFAC Sanctions Compliance ProgramThe five essential components of an effective sanctions compliance programme.United States · 5 controls
- US Foreign Corrupt Practices ActAnti-bribery and books-and-records provisions, assessed against the DOJ's Evaluation of Corporate Compliance Programs.United States · 4 controls
- NIST Cybersecurity Framework 2.0Six functions for managing cybersecurity risk, now including Govern.United States / Global · 6 controls
- NYDFS Cybersecurity Regulation (23 NYCRR 500)Cybersecurity requirements for DFS-licensed entities, with CISO, MFA, annual certification and 72-hour notice.United States — New York · 6 controls
- US Investment Advisers Act of 1940 — Compliance Program RuleWritten compliance policies, a chief compliance officer and an annual review for registered advisers.United States · 5 controls
Questions
Does Amoreg watch for changes to the GLBA Safeguards Rule?
Enable it and add the issuer’s pages as a monitor of your own. Every publication the Monitor records keeps its source, stage and date.
Can Amoreg check our policies against the GLBA Safeguards Rule?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records 16 CFR Part 314, amended 2023. Editions were last verified in August 2026, and the Monitor records new publications as they appear.