Did you know that the new GLBA Safeguards Rule take effect in just 5 short months? That’s right. As of December 9th, 2022, financial institutions must implement additional Safeguards in order to protect customer data. In this article, we’re taking a look at what’s NEW and what that means for IT Managers.
Related Article: “New Technical Security Assessment Requirements For GLBA”
Gramm-Leach-Bliley Act (GLBA)
The Gramm-Leach-Bliley Act (GLBA) requires financial institutions – companies that offer consumers financial products or services like loans, financial or investment advice, or insurance – to explain their information-sharing practices to their customers and to safeguard sensitive data. You can read the Act and specifically the Safeguards Rule in all it’s glory here: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314?toc=1. The website even has a neat way to show the differences between the old version and the new version. You can check that out here: https://www.ecfr.gov/compare/current/to/2021-12-31/title-16/chapter-I/subchapter-C/part-314/section-314.4
5 Modifications to the GLBA Safeguards Rule
On January 10th 2022 the Federal Trade Commission (FTC) issued a final rule to amend the Standards for Safeguarding Customer Information (Safeguards Rule). The Final Rule contains five main modifications to the existing Rule, which are:
1. More information security requirements
The rule adds guidance (aka requirements) on how to develop and implement specific aspects of an overall information security program, such as access controls, authentication, and encryption.
2. Improve information security program accountability
It adds provisions designed to improve the accountability of financial institutions’ information security programs, such as by requiring periodic reports to boards of directors or governing bodies.
3. Exemptions from certain requirements
The following sections of the Rule do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers:
· Written risk assessment – [(b)(1)]
· Annual penetration test and semi-annual vulnerability assessment – [(d)(2)]
· Written incident response plan – [(h)]
· Annual report to your board – [(i)]
4. Expanded “financial institution” definition
It expands the definition of “financial institution” to include entities engaged in activities the Federal Reserve Board determines to be incidental to financial activities. This change adds “finders”—companies that bring together buyers and sellers of a product or service—within the scope of the Rule.
5. Added definitions & examples
Finally, it defines several terms and provides related examples in the Rule itself rather than incorporates them from the Privacy of Consumer Financial Information Rule (“Privacy Rule”).
What this means for IT managers
Compliance with GLBA may be a NEW requirement for you
The latest amendments to the Safeguards Rule expands the definition of “financial institution”, therefore, entities such as mortgage brokers, payday lenders, auto dealers, collections agencies, real estate appraisers, professional tax preparers, and many others are now be covered by the law.
You have NEW information security requirements to COMPLY with
The amended Safeguards rule adds several new elements to Section 3.14.3 Standards for safeguarding customer information. These are the new requirements that are mentioned in item #1 above. These are very similar to what NY DFS has required within their Cyber Regulation. They are:
1. Oversight
The individual responsible for overseeing and implementing your information security program no longer needs to be an employee. This can be a 3rd party, so long as there is proper oversight and direction of this individual. Keep in mind responsibility for security still lies with your firm!
2. Risk Assessment
Your information security program now needs to be based on a written Risk Assessment. That Risk Assessment must identify internal and external risks to the security, confidentiality and integrity of customer information and assesses the sufficiency of any safeguards in place to control those risks. The Rule also states that organizations must
periodically perform risk assessments with documented criteria for assessing, prioritizing and treating risks.
3. Security Safeguards
Implementation of additional security controls (safeguards) are also now required. Those are:
o Access control reviews & least privilege access
o Inventory and classification of data and systems
o Encryption of customer information
o Secure development practices for in-house built software
o Multifactor authentication
o Secure disposal of customer information, 2 years after use for most cases!
o Change management
o Monitor and log user activity
4. Technical Assessments
Continuous monitoring or an annual penetration test along with a vulnerability assessment once every six months, or after significant changes to the environment.
5. Ensure people are trained & kept up-to-date
Security awareness training is now a requirement along with maintaining qualified information security professionals as well as keeping them trained and up-to-date on the latest threats.
6. Evaluate service Providers
You must now take steps to periodically assess your service providers based on the risk they present and the continued adequacy of their safeguards.
7. Have a written incident response plan
A written incident response plan (IRP) that’s designed to help you promptly respond to and recover from any security event, that could materially impact your organization or customer data, is also now a requirement. Elements of your IRP must include communications, roles and responsibilities, documentation of incidents and lessons learned.
8. Annual report to your board
The individual responsible for your security program must now report in writing at least annually to your board of directors or equivalent governing body. This report must describe the overall status of the security program including compliance to GLBA as well as identify any material risks and the recommended remediations for such risks.
When this takes effect
If you’re reading this before December of 2022, and you feel like you’re missing the mark on some of these. There’s good news! There is still time to implement these Safeguards, since these do not go into effect until December 9th, 2022.
Effective as of December 9th, 2022:
· Oversight of the security program from a qualified individual – [314.4(a)]
· Written risk assessment – [(b)(1)]
· Security Safeguards – [(c)(1) through (8)]
· Annual penetration test and semi-annual vulnerability assessment – [(d)(2)]
· Ensure people are kept up-to-date, including security awareness training and professional security training – [(e)]
· Periodic assessment of service providers – [(f)(3)]
· Written incident response plan – [(h)]
· Annual report to your board – [(i)]
What you should do now
If you’re not sure where you stand with these requirements and how they fit into your security program, that’s ok. Whether compliance with the new Safeguards Rule is new for you or not you likely already have some of these requirements already in place. Here’s a simple 3 step process you can use to evaluate where you stand with the amended Safeguards Rule.
1. Evaluate – Begin by reviewing each of the elements described in the Safeguards rule and evaluate whether or not your current security program meets the requirement.
2. Identify – Identify and document gaps, which are, places where your current processes do not meet the requirement.
3. Implement – Then develop a plan to implement those missing pieces over the next 5 months. Make sure you’re setting deadlines and tracking key milestones to make sure you stay on track. It’s not an easy task, but a doable one.
Our team of Cybersecurity professionals here at SecurIT360 conduct hundreds of Security and Gap Assessments every year and if at any point you’re unsure where you stand, you want help identifying those gaps, or are looking for advice on how to best implement these requirements, please reach out to us. We would be more than happy to help.
