Understanding GLBA Compliance Requirements: How You Should Prepare for the June Deadline

Though you still have a few months to meet the June deadline, you shouldn’t put it off. Compliance may require significant investment in staff and technology on your part. Furthermore, failure to comply by the deadline could result in significant fines and penalties, and damage your company’s reputation. It’s preferable to err on the side of caution.

The first step is to determine whether your business qualifies as a financial institution under the FTC’s definition above. If your firm meets the definition, you need to start developing an information security program to:

• Ensure the security and confidentiality of customer information
• Protect against anticipated threats or hazards to the security or integration of that information
• Protect against unauthorized access to that information which could result in substantial harm or inconvenience to any customer

Here are nine things you must do to achieve GLBA compliance:

• Designate a Qualified Individual to implement and supervise your company’s information security program. Even if you outsource the role to a third-party provider, the overseer ensures the responsibility to comply with GLBA falls on your company.
• Conduct a risk assessment. This includes making a complete inventory of customer data and uncovering potential security threats to that data. The written assessment must be performed regularly to keep up with changes in your organization and new threats.
• Design and implement safeguards to control the risks identified through your assessment. They should include:
  • Implementing and periodically reviewing access controls
  • Knowing what customer data you have and where it’s stored
  • Encrypting customer data when it’s in transit
  • Assessing your apps
  • Implementing multi-factor authentication (MFA)
  • Disposing of customer data safely
  • Anticipating and evaluating changes to your information system or network
  • Maintaining a log of authorized user activity
• Regularly monitor and test the effectiveness of your safeguards. This can involve continuous monitoring of your information system or penetration testing and vulnerability assessments.
• Train your staff. Organize regular training sessions to keep staff up to date on best cybersecurity practices and GLBA standards.
• Monitor your service providers. Only hire reputable providers and make sure they maintain GLBA standards.
• Keep your information security program current. Technology constantly changes, so your information security program must adapt. Make sure it addresses current cyberthreats and risks.
• Create a written incident response plan. If a cyber-incident occurs, your staff should know exactly what to do. An incident response plan should cover goals, processes, roles, communication channels, and more.
• Require your Qualified Individual to report to your Board of Directors. They should report at least once annually. Among other things, their report should cover risk assessments, decisions, results, and recommendations.