Requirements · Financial services
GLBA
Gramm-Leach-Bliley Act: safeguards and privacy rules, including the FTC Safeguards Rule and Regulation P. 19 Moraph products list it under “Requirements it supports”. The products support this requirement; meeting it remains your organization’s responsibility.
About the rule
What it is
The Gramm-Leach-Bliley Act of 1999 (GLBA) requires financial institutions to explain how they share customers’ personal information and to safeguard it. Its privacy provisions are implemented largely through Regulation P (12 CFR Part 1016), issued by the Consumer Financial Protection Bureau. Its safeguards provisions are implemented by each institution’s regulator, including the Federal Trade Commission’s Safeguards Rule (16 CFR Part 314) for financial institutions under the FTC’s jurisdiction and the banking agencies’ Interagency Guidelines for banks.
Source: FTC Safeguards Rule, 16 CFR Part 314 (eCFR). GLBA in the glossary. This summary is for orientation only; read the rule itself or ask your counsel for what it requires of you.
Moraph’s Trust Center lists “GLBA / FFIEC” among the frameworks its controls are mapped to: “Authentication and data-protection controls aligned to GLBA and FFIEC guidance, with evidence prepared for bank examinations.” It also states: “Moraph does not hold a certification or authorization for any framework in this list; where a client needs its own authorization or examination, we provide the control mapping and evidence to support it.”
Citations
How the products cite it
The exact wording on the product pages, with how many products use each.
- Gramm-Leach-Bliley Act Safeguards Rule (16 CFR Part 314) 4 products
- FTC Safeguards Rule (16 CFR Part 314), for non-bank financial institutions 2 products
- FTC Safeguards Rule under the Gramm-Leach-Bliley Act (16 CFR Part 314) 2 products
- Gramm-Leach-Bliley Act Safeguards (Interagency Guidelines Establishing Information Security Standards; FTC Safeguards Rule, 16 CFR Part 314) 2 products
- Gramm-Leach-Bliley Act and Regulation P (12 CFR Part 1016) 2 products
- Gramm-Leach-Bliley Act and the Interagency Guidelines Establishing Information Security Standards 2 products
- Interagency Guidelines Establishing Information Security Standards (GLBA Section 501(b)) 2 products
- FTC Safeguards Rule (16 CFR Part 314) for non-bank financial institutions 1 product
- Gramm-Leach-Bliley Act Safeguards Rule (16 CFR 314.4(d)(2), vulnerability assessments and penetration testing) 1 product
- Gramm-Leach-Bliley Act Section 501(b) information security standards 1 product
- Gramm-Leach-Bliley Act privacy provisions and Regulation P (12 CFR Part 1016) 1 product
- Gramm-Leach-Bliley Act safeguards for customer information 1 product
- Gramm-Leach-Bliley Act safeguards requirements (15 U.S.C. 6801 et seq.) 1 product
For what it requires of your organization, read the rule itself or ask your counsel. GLBA in the glossary.
Products
The 19 products that support it
API Security & Integration
Securing the connectivity between legacy mainframes (COBOL) and modern fintech apps.
Lists:
- Interagency Guidelines Establishing Information Security Standards (GLBA Section 501(b))
- FTC Safeguards Rule (16 CFR Part 314) for non-bank financial institutions
Business Continuity Planning
Managing disaster recovery plans and automated testing logs for examiners.
Lists:
- Gramm-Leach-Bliley Act Section 501(b) information security standards
CRM for Finance
Managed Salesforce Shield encryption with key material held by Moraph outside Salesforce, so Salesforce does not store your decryption keys. Field permissions remain your decision.
Lists:
- Gramm-Leach-Bliley Act and Regulation P (12 CFR Part 1016)
- FTC Safeguards Rule (16 CFR Part 314), for non-bank financial institutions
Data Loss Prevention
Network and endpoint blocking of outbound transmission of SSNs or credit card numbers (PAN).
Lists:
- Gramm-Leach-Bliley Act Safeguards (Interagency Guidelines Establishing Information Security Standards; FTC Safeguards Rule, 16 CFR Part 314)
Database Security
Real-time monitoring of SQL queries to detect mass data exfiltration events.
Lists:
- FTC Safeguards Rule under the Gramm-Leach-Bliley Act (16 CFR Part 314)
Digital Member Onboarding (KYC/CIP)
Account opening with biometric liveness checks and OCR scanning, supporting the USA PATRIOT Act Customer Identification Program rule (31 CFR 1020.220). Your CIP and BSA officer's decisions remain yours.
Lists:
- Gramm-Leach-Bliley Act and Regulation P (12 CFR Part 1016)
Digital Transaction Management
Loan document signature workflows configured to support ESIGN and UETA consent and signing requirements, with audit trails. Enforceability remains a question for your counsel.
Lists:
- Gramm-Leach-Bliley Act and the Interagency Guidelines Establishing Information Security Standards
Endpoint Detection & Response
24/7 managed detection and hunting on teller workstations to reduce ransomware risk. Recovery, backups and notification decisions remain your institution's.
Lists:
- Gramm-Leach-Bliley Act Safeguards Rule (16 CFR Part 314)
Identity Access Management
MFA and SSO configurations tuned to support the FFIEC Authentication and Access guidance (2021). Your institution owns the risk assessment and the adequacy decision.
Lists:
- Gramm-Leach-Bliley Act and the Interagency Guidelines Establishing Information Security Standards
- FTC Safeguards Rule (16 CFR Part 314), for non-bank financial institutions
Marketing Automation
Governed campaigns configured to support CAN-SPAM opt-out and GDPR consent requirements. Content approval and compliance review remain your institution's.
Lists:
- Gramm-Leach-Bliley Act privacy provisions and Regulation P (12 CFR Part 1016)
Mobile Device Management
"Containerized" corporate apps on advisor personal phones, allowing selective wipe of business data.
Lists:
- Gramm-Leach-Bliley Act safeguards requirements (15 U.S.C. 6801 et seq.)
Privileged Access Management
Vaulting and rotating passwords for core banking admin accounts.
Lists:
- FTC Safeguards Rule under the Gramm-Leach-Bliley Act (16 CFR Part 314)
Public Cloud Infrastructure
Managing the tenant with "Policy as Code" guardrails designed to block public S3 buckets holding consumer data. Guardrails reduce, not remove, misconfiguration risk; data decisions remain yours.
Lists:
- Gramm-Leach-Bliley Act Safeguards (Interagency Guidelines Establishing Information Security Standards; FTC Safeguards Rule, 16 CFR Part 314)
Secure File Transfer
Encrypted "drop box" for clients to upload tax returns without using insecure email.
Lists:
- Gramm-Leach-Bliley Act Safeguards Rule (16 CFR Part 314)
Security Awareness Training
Phishing simulations tailored to financial fraud (e.g., "Wire Transfer Request"), producing training evidence for examiners and cyber insurers. Premium decisions remain the insurer's.
Lists:
- Gramm-Leach-Bliley Act Safeguards Rule (16 CFR Part 314)
Third-Party Risk Scoring
Continuous credit-rating-style monitoring of vendor security postures.
Lists:
- Interagency Guidelines Establishing Information Security Standards (GLBA Section 501(b))
Vendor Risk Management (VRM)
Centralized repository for tracking third-party SOC 2 reports and insurance certificates, automating vendor due diligence.
Lists:
- Gramm-Leach-Bliley Act safeguards for customer information
Virtual Desktop Infrastructure
Secure remote workspaces designed to keep PII off loan officers' local laptops, under file, clipboard and print policies you approve. Access decisions remain yours.
Lists:
- Gramm-Leach-Bliley Act Safeguards Rule (16 CFR Part 314)
Vulnerability Management
Authenticated scanning of the banking network on your schedule (e.g., weekly), supporting the GLBA Safeguards Rule's vulnerability-assessment requirement (16 CFR 314.4(d)(2)). Risk assessment and remediation remain the institution's.
Lists:
- Gramm-Leach-Bliley Act Safeguards Rule (16 CFR 314.4(d)(2), vulnerability assessments and penetration testing)
Not sure which requirements apply to you? Request a gap analysis. All requirements: Requirements our products support.