GLBA Compliance Checklist: Requirements for 2026

GLBA compliance means meeting the three obligations in Title V of the Gramm-Leach-Bliley Act: the Financial Privacy Rule (tell customers how you share their information and let them opt out), the Safeguards Rule (run a written information security program), and the pretexting provisions (stop people obtaining customer information under false pretenses). This checklist covers all three as they stand in November 2026, with the section number behind each item and the evidence a regulator will ask to see. It is written for the non-bank institutions the FTC regulates, with notes for banks, credit unions, colleges and SEC-registered firms.

There is no GLBA certification; your regulator judges compliance when it examines or investigates you. Invadel’s part is the testing: the annual penetration test and six-month vulnerability assessments the Safeguards Rule names, covered on our FTC Safeguards Rule penetration testing page and starting with an external network penetration test from $4,200. We do not run GLBA programs.

GLBA requirements: the three rules

Rule	Where it lives	What it governs
Financial Privacy Rule	15 U.S.C. 6801-6809; Regulation P, 12 CFR 1016	Privacy notices, opt-outs, limits on sharing
Safeguards Rule	15 U.S.C. 6801(b); 16 CFR 314 for FTC-regulated institutions	The written security program and its controls
Pretexting provisions	15 U.S.C. 6821-6827	Obtaining customer information by deception

All three protect nonpublic personal information: what a consumer gives you to get a financial product, what their transactions with you show, and anything else you learn while serving them, including the fact that they are your customer (12 CFR 1016.3(p) and (q)). The Safeguards Rule calls such records about your customers “customer information”, in any format, whether you or a provider holds them (16 CFR 314.2).

Who GLBA applies to, and which rulebook is yours

The FTC’s examples include mortgage lenders and brokers, payday lenders, finance companies, check cashers, collection agencies, tax preparation firms and non-federally insured credit unions, plus the finders added in 2021 (FTC, Safeguards Rule: What Your Business Needs to Know). Section 6805 splits enforcement among regulators, so the first checklist item is knowing whose rules you follow:

You are	Enforced by	Security standard	Privacy rule	Incident notice to regulator
Non-bank lender, broker, finance company, tax preparer, collector, financing auto dealer, most fintechs	FTC (Safeguards Rule); CFPB also enforces Regulation P	16 CFR 314	Regulation P (auto dealers: 16 CFR 313, FTC only)	FTC within 30 days, 500+ consumers
College in federal student aid programs (its software vendors: see HECVAT penetration testing)	FTC rule, checked by the Department of Education	16 CFR 314	Deemed compliant if FERPA-compliant	FTC within 30 days, 500+ consumers; the Department of Education immediately, under the school’s SAIG Agreement (FSA Handbook)
Bank or savings association	OCC, Federal Reserve, FDIC	Interagency Guidelines	Regulation P	Regulator within 36 hours
Federally insured credit union	NCUA	12 CFR 748, Appendix A	Regulation P	NCUA within 72 hours
Broker-dealer, SEC-registered adviser, fund	SEC	Regulation S-P	Regulation S-P	None to the SEC; affected individuals within 30 days
Insurance company	State insurance regulator	State law	State law	State law

Tax preparers are often surprised to be on this list, though the IRS reminds them that federal law requires a written information security plan (IRS Publication 5708); see penetration testing for accounting firms. Non-bank lenders: see fintech penetration testing and our fintech penetration testing services.

GLBA compliance checklist: the Safeguards Rule (16 CFR 314.4)

The FTC amended the Safeguards Rule in December 2021, with most changes enforceable from June 9, 2023 (314.5), and again in 2023 to add the FTC notification duty in 314.4(j), effective May 13, 2024. The FTC counts nine program elements; the notification duty makes ten. The last column shows what 314.6 lifts for institutions holding customer information on fewer than 5,000 consumers.

Section	Requirement	Evidence to keep	Under 5,000 consumers
314.4(a)	A Qualified Individual oversees the program; if outsourced, you stay responsible and a senior staff member supervises	Written designation	Applies
314.4(b)(1)	Written risk assessment with criteria for rating risks, judging confidentiality, integrity and availability, and mitigating or accepting each risk	Dated risk assessment	Lifted (the 314.4(b) duty to base the program on a risk assessment remains)
314.4(b)(2)	Periodic reassessment	Reassessment records	Applies
314.4(c)(1)	Least-privilege access, reviewed periodically	Access reviews	Applies
314.4(c)(2)	Inventory of data, devices, systems, personnel and facilities	Inventory	Applies
314.4(c)(3)	Encryption in transit over external networks and at rest; where infeasible, compensating controls the Qualified Individual reviews and approves	Settings; approvals	Applies
314.4(c)(4)	Secure development of in-house apps; testing of external apps	Procedure; test reports	Applies
314.4(c)(5)	MFA for any individual accessing any information system, unless the Qualified Individual approves equivalent or stronger controls in writing	MFA coverage list	Applies
314.4(c)(6)	Disposal within two years of last use unless an exception applies	Retention schedule	Applies
314.4(c)(7)	Change management	Change records	Applies
314.4(c)(8)	Monitor and log user activity; detect unauthorized access	Log and alert reviews	Applies
314.4(d)(1)	Regularly test or monitor key controls	Test records	Applies
314.4(d)(2)	Continuous monitoring, or annual penetration test plus vulnerability assessments every six months and after material change	Test report, two assessments, retest	Lifted
314.4(e)	Security training; qualified staff kept current	Training records	Applies
314.4(f)	Select, contract with and periodically assess service providers	Contracts; reviews	Applies
314.4(g)	Adjust the program for test results and changes	Change log	Applies
314.4(h)	Written incident response plan with seven listed elements	The plan	Lifted
314.4(i)	Qualified Individual’s written board report, at least annually	Board reports	Lifted
314.4(j)	Notify the FTC of a notification event involving 500+ consumers within 30 days	Procedure; filed forms	Applies

The same row-by-row format is used in our CJIS compliance checklist, for organizations that handle criminal justice information.

The GLBA risk assessment: requirements and steps

Everything in 314.4 rests on the risk assessment. A usable one names every system and provider holding customer information (loan origination, tax software, client portal, shared drives), rates threats to each against your written criteria, and records a decision for every risk, then gets redone after material changes. Our security risk assessment guide walks through a method, and penetration test findings belong in it.

Section 314.4(b)(1) requires the assessment in writing, with three things in it: criteria for evaluating and categorizing the risks you identify, criteria for assessing the confidentiality, integrity and availability of your systems and customer information, including whether existing controls are adequate, and a statement of how each risk will be mitigated or accepted. In steps:

1. Inventory. List every system, provider and location that holds customer information. The 314.4(c)(2) inventory is the input.
2. Write the rating criteria first. Define a likelihood and impact scale before scoring anything (314.4(b)(1)(i)).
3. Identify threats to each asset, internal and external: stolen credentials, a lost laptop, a vendor breach, ransomware, a misdirected email.
4. Assess existing controls against confidentiality, integrity and availability, and note where they fall short (314.4(b)(1)(ii)).
5. Decide and record. For each risk, mitigate it with an owner and a date, or accept it with a named approver (314.4(b)(1)(iii)).
6. Reassess periodically and after material change (314.4(b)(2)), feeding in test results.

Who can be the Qualified Individual

Section 314.4(a) sets no credential. The Qualified Individual can be your employee, or work for an affiliate or a service provider. If you outsource the role you keep responsibility for compliance, name a senior member of your own staff to direct and oversee that person, and require the provider to maintain a security program that meets the rule. The annual written report under 314.4(i) goes to the board, or to a senior officer where there is no board. It covers the overall status of the program and material matters: risk assessment and control decisions, service provider arrangements, test results, security events and management’s response, and recommended changes.

The testing requirement

Section 314.4(d)(2) requires an annual penetration test, scoped each year by the risks your assessment identifies, and vulnerability assessments at least every six months and after material changes, unless you run effective continuous monitoring. Our FTC Safeguards Rule penetration testing page explains what qualifies and how we scope it. To compare this with other rules, see penetration testing requirements by framework.

Under test, items that commonly fail: MFA enforced for staff but not for vendor remote-access accounts or legacy mail protocols, customer files open to any workstation, unencrypted backups, and logging that records an attacker without alerting anyone.

Notifying the FTC under 314.4(j)

A notification event is the acquisition of unencrypted customer information without authorization, and unauthorized access is presumed to be acquisition unless you have reliable evidence it was not (314.2(m)). If it involves at least 500 consumers, notify the FTC through its online form as soon as possible and no later than 30 days after discovery. Data counts as unencrypted if the key was also accessed, and discovery is the first day any employee or agent knows, so the clock can start before leadership hears.

Privacy Rule checklist (Regulation P)

The CFPB republished the Privacy Rule as Regulation P, 12 CFR Part 1016, in 2011.

• Sort consumers from customers (1016.3). The notice duties differ.
• Initial notice to customers no later than when the relationship begins, and to other consumers before sharing their information with a nonaffiliated third party other than under the exceptions in 1016.14 and 1016.15 (1016.4).
• Annual notice once in any 12 consecutive months (1016.5(a)), unless you share only under the exceptions in 1016.13 to 1016.15 and your practices have not changed (1016.5(e)).
• Opt-out notice and a reasonable opportunity to opt out before sharing with nonaffiliated third parties (1016.7, 1016.10), honored in every system that feeds sharing.
• No account numbers or access codes to nonaffiliated third parties for marketing (1016.12).
• Contracts limiting use for service providers that receive information under 1016.13, and limits on reuse of information you receive (1016.11).
• The model privacy form in the appendix to Part 1016 gives a safe harbor on notice content.

Pretexting provisions checklist

Section 6821 makes it unlawful to obtain customer information from a financial institution through false statements to its staff or customers, or with forged or stolen documents. A knowing and intentional violation carries up to five years in prison, or ten when committed while violating another federal law or as part of a pattern of illegal activity involving more than $100,000 in 12 months (6823), and section 6825 directs the banking agencies, the NCUA and the SEC to make institutions keep controls against it. In practice that means the phone (vishing, in security terms), chat and help desk:

• Written identity verification before revealing account details or changing an address, phone, email or bank account.
• Callbacks to the number on file, never the number the caller gives.
• Password and MFA resets that need more than researchable facts.
• Front-line training on pretext calls, with an easy escalation route.
• Testing with pretext calls and phishing: our social engineering testing is priced from $3,600 and also evidences the training element in 314.4(e).

Banks and credit unions: the Interagency Guidelines

Banks follow the Interagency Guidelines Establishing Information Security Standards (12 CFR 30, Appendix B for the OCC; 208, Appendix D-2 for the Federal Reserve; 364, Appendix B for the FDIC), and credit unions the same standard in 12 CFR 748, Appendix A. The board approves the written program (III.A) and gets a report at least annually (III.F), and key controls are tested regularly, by or under review of independent third parties or staff, at a frequency the risk assessment sets (III.C). Supplement A adds an incident response program and customer notice when misuse of sensitive information is reasonably possible.

Two newer rules sit beside them: banks notify their primary federal regulator within 36 hours of determining a notification incident occurred (86 FR 66424), and credit unions notify the NCUA within 72 hours (88 FR 12811). Our penetration testing for banks and credit unions page covers examiner scoping.

What changed since 2021

Date	Change
December 9, 2021	FTC publishes the amended Safeguards Rule
May 1, 2022	Bank 36-hour incident notification: compliance date
June 9, 2023	Most 2021 Safeguards Rule changes enforceable
September 1, 2023	NCUA 72-hour reporting takes effect
May 13, 2024	FTC notification requirement, 314.4(j), takes effect
December 3, 2025	Amended Regulation S-P: larger SEC-registered firms
June 3, 2026	Amended Regulation S-P: smaller firms

The Regulation S-P amendments require a written incident response program and notice to affected individuals within 30 days (SEC press release 2024-58). See SEC Regulation S-P testing, cybersecurity for wealth managers and penetration testing for hedge funds and asset managers.

GLBA assessment: how compliance is checked, and the real penalties

Banks, credit unions and SEC firms are examined; the FTC investigates, usually after a breach or complaint; colleges are checked in their annual Title IV compliance audits. A “GLBA assessment” is usually a gap review against the checklist above by internal audit, a consultant or your auditor. The technical testing inside it is the part we provide.

Title V has no single fine schedule: section 6805 hands enforcement to each regulator under its own statute, and the banking agencies and the SEC use their own civil money penalty powers. Figures such as “$100,000 per violation” circulate widely but do not appear in Title V, which sets only the criminal pretexting penalties in 6823; the FTC enforces the pretexting rules with its Fair Debt Collection Practices Act powers (6822). The FTC typically settles through 20-year consent orders, with civil penalties if an order is later violated. Our guide to data breach fines and penalties covers how each regulator enforces.

Two FTC Safeguards Rule cases show what gets cited. In August 2017 TaxSlayer settled charges that it had no written security program until November 2015 and no risk assessment, after attackers reached nearly 9,000 accounts. In December 2020 Ascension Data & Analytics settled charges that it failed to vet a vendor, require safeguards by contract or risk-assess its vendors, the service provider duties now in 314.4(f); the vendor had left mortgage documents on an unprotected cloud server. Both settlements require independent assessments every two years.

GLBA penetration testing: what the evidence costs

For GLBA penetration testing, these are our published starting prices for the tests that map to the checklist, each fixed in writing from your scope details with no sales call:

Test	GLBA item it evidences	Cadence	From
External network penetration test	314.4(d)(2); MFA and encryption on remote access	Annual	$4,200
Internal network penetration test	314.4(d)(2); access controls and logging	Annual	$6,000
Vulnerability assessment	314.4(d)(2) six-month assessments, analyst-validated	Every six months	$1,500 up to 250 devices; $2,500 up to 1,000 (vulnerability assessment pricing)
Web application penetration test	Client portals and online applications, 314.4(c)(4)	Annual or before launch	$5,200
Microsoft 365 or Google Workspace assessment	MFA, mail security and logging	Annual	$4,200
Social engineering campaign	Training and pretexting controls	Annual	$3,600

For a small FTC-regulated institution, a typical annual set is an external test, an internal test and two vulnerability assessments: $13,200 at starting prices. Your risk assessment sets the test’s scope, so yours may be smaller or larger. Below 5,000 consumers, a single $1,500 assessment is a sensible start. Every penetration test includes a free retest of remediated findings (phishing campaigns, which have no findings to retest, are the exception), an attestation letter, and executive and technical reports mapped to 314.4, with a summary written for the Qualified Individual’s board report. Senior in-house testers do the work, and onboarding begins within 24 hours of a signed proposal. The price calculator adds up several tests; the sample report shows the deliverable.

What we do not do: write your security program, serve as your Qualified Individual, run your risk assessment, handle incident response or file your FTC notice. Whether GLBA covers you is a question for counsel.

New York: Part 500 and the SHIELD Act

Institutions licensed or chartered by the Department of Financial Services also answer to 23 NYCRR 500, which requires annual penetration testing from inside and outside the network (500.5), unless the entity qualifies for the limited exemption in 500.19(a); see our NYDFS 23 NYCRR 500 guide and Part 500 testing page. The New York SHIELD Act requires reasonable safeguards from any business holding New York residents’ private information, but treats a business subject to, and in compliance with, the GLBA Title V regulations as compliant (N.Y. Gen. Bus. Law 899-bb).

Frequently asked questions

What are the three main GLBA requirements? The Financial Privacy Rule (privacy notices and opt-outs), the Safeguards Rule (a written information security program), and the pretexting provisions, which make obtaining customer information under false pretenses a crime and require institutions to guard against it.

Does GLBA require penetration testing? Under the FTC Safeguards Rule, yes, if you hold customer information on 5,000 or more consumers (314.6) and do not run effective continuous monitoring: 314.4(d)(2) requires annual penetration testing and vulnerability assessments every six months. Banks and credit unions must regularly test key controls at a frequency their risk assessment sets.

Does GLBA only apply to banks? No. It covers any business whose activities are financial in nature, from mortgage brokers, financing auto dealers and tax preparers to colleges in federal student aid programs.

Is GLBA still in effect? Yes. The Gramm-Leach-Bliley Act was signed in 1999 and Title V remains in force, and its rules keep changing: the FTC amended the Safeguards Rule in 2021 and 2023, and the SEC amended Regulation S-P in 2024.

Does GLBA apply to small businesses? Yes. Below 5,000 consumers, four Safeguards Rule items are lifted, including the annual penetration test, but MFA, encryption and regular testing or monitoring still apply.

How often should we do a GLBA risk assessment? The rule requires periodic reassessment without fixing an interval. Annually and after any material change is the practical baseline; see how often to run a penetration test for testing cadence.

Is a vulnerability scan enough for the Safeguards Rule? Not at 5,000 or more consumers. Without effective continuous monitoring, 314.4(d)(2) requires an annual penetration test as well as vulnerability assessments every six months.

The short version

GLBA compliance is three rules: privacy notices and opt-outs, a written security program, and controls against pretexting. For FTC-regulated institutions above 5,000 consumers without continuous monitoring, the Safeguards Rule requires an annual penetration test and vulnerability assessments every six months; a typical set starts at $13,200 a year at our prices, with free retests. See our FTC Safeguards Rule penetration testing page, the published pricing, or send your scope for a fixed price in writing.