Understanding the Gramm-Leach-Bliley Act (GLBA)

What’s challenging about the Safeguard Rule is how you determine what an “appropriate” infosec program looks like. To help, the FTC has developed nine key guidelines that every compliant information security program should include:

• Select a designated, qualified individual to oversee and implement the program. This person is also responsible for program enforcement and can be someone you employ, an affiliate, or a service provider.
• Conduct periodic risk assessments to discover “reasonably foreseeable” internal and external risks that affect the security, confidentiality, and integrity of customer information that could result in unauthorized disclosure, misuse, alteration, destruction, or other compromises. The risk assessment must evaluate existing safeguard effectiveness and include written documentation detailing how your organization and program will mitigate or accept identified risks.
• Design and implement safeguards to control the risk identified in your risk assessment. This includes implementing and periodically reviewing access, technical, and physical controls including:
  1. Encrypting customer information in transit over external networks and at rest. 
  2. Adopting secure development practices for in-house developed applications used to transmit, access, or store customer information, as well as procedures to test the security of externally developed apps.
  3. Implementing multi-factor authentication for authorized access with limited exceptions.
  4. Developing, implementing, and maintaining procedures for secure disposal of customer information within two years after the last date of information usage related to a product or service, unless the information is necessary for business purposes or operations, is legally required for retention, or where disposal isn’t possible based on how you obtained the information. These procedures should be periodically reviewed.
  5. Adopting change management procedures.
  6. Implementing policies, procedures, and controls to monitor and log authorized user activity to detect unauthorized access or use of, or tampering with, customer information.
• Regularly test and monitor effectiveness of key controls, systems, and procedures, including those to detect attacks or intrusions into information systems. This should include continuous monitoring or periodic penetration testing and vulnerability assessments. Organizations that don’t do continuous monitoring should conduct annual penetration testing based on relevant risks identified in a risk assessment and do vulnerability assessments at least every six months and whenever there are material changes to operations, business arrangements, or circumstances that might impact your information security program.
• Implement policies and procedures for security awareness training including oversight for employees, affiliates, and service providers related to risk identification from your risk assessment.
• Oversee service providers including vetting them to ensure they can take reasonable steps to protect customer information and then contractually require those you select to implement and maintain those safeguards. You should also periodically assess these providers to make sure safeguards are effective.
• Whenever issues are identified through testing and monitoring, your business changes, or risk assessment results change, you must evaluate and adjust your existing security program.
• Develop a written response plan that details how your organization will promptly respond to and recover from security events that may affect the security, integrity or confidentiality of your customer data, including goals, response processes, roles and responsibilities, external and internal communications plans, remediation strategies, documentation and reporting of all security events and response, and evaluation of the plans and adjustment if needed post-event. 

The person overseeing your program should regularly create written reports for your board or other key stakeholders, at least annually. These reports should include information about your program’s current status and compliance level, and other information relevant to addressing issues related to your risk assessment, risk management, security events, testing results, and other critical program information.

In addition to safeguard controls, and the privacy and opt-out notices, GLBA also sets guidelines about how financial institutions get customer non-public information, specifically saying you cannot do so under false pretenses. That means someone from your institution or an affiliate can’t try to access this data by fooling the consumer or customer. This is an often-seen tactic of social engineering, like phishing schemes.

Prohibition on Obtaining Customer Information by False Pretenses in Section 521 of GLBA says that financial organizations cannot make false, fictitious, or fraudulent statements or representations to a customer. Further, you cannot provide a document to an officer, employee, or agent of your business if you know that document may be forged, counterfeit, lost, stolen, fraudulently obtained, or if it has false, fictitious, or fraudulent statements or representations.

The standards have a few exemptions:

• When you’re testing your security procedures or systems to maintain customer NPI confidentiality
• If you’re investigating misconduct or neglect of an employee, officer, or agent
• If you’re recovering NPI that was obtained under false pretenses

The guidelines are also not applicable if a law enforcement agency is conducting official duties when an insurer is conducting an investigation into criminal activities, fraud, or misrepresentation, or related to collecting delinquent child support. They’re also not applicable if the information is reasonably available as a public record related to security laws.