Requirements · Financial services
Interagency Guidelines Establishing Information Security Standards
The banking agencies’ information security standards under GLBA Section 501(b). 15 Moraph products list it under “Requirements it supports”. The products support this requirement; meeting it remains your organization’s responsibility.
About the rule
What it is
The Interagency Guidelines Establishing Information Security Standards implement the safeguards requirements of Section 501(b) of the Gramm-Leach-Bliley Act for banks supervised by the federal banking agencies. Issued by the Office of the Comptroller of the Currency, the Federal Reserve Board and the FDIC, they call for a written information security program, approved by the board of directors, that assesses and controls risk to customer information, oversees service providers and is adjusted as risks change. They appear as appendices to each agency’s safety and soundness rules, for example Appendix B to the FDIC’s 12 CFR Part 364.
Source: 12 CFR Part 364 (eCFR). This summary is for orientation only; read the rule itself or ask your counsel for what it requires of you.
Citations
How the products cite it
The exact wording on the product pages, with how many products use each.
- Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B) 5 products
- Gramm-Leach-Bliley Act Safeguards (Interagency Guidelines Establishing Information Security Standards; FTC Safeguards Rule, 16 CFR Part 314) 2 products
- Gramm-Leach-Bliley Act and the Interagency Guidelines Establishing Information Security Standards 2 products
- Interagency Guidelines Establishing Information Security Standards (12 CFR Part 30 App. B, Part 364 App. B) 2 products
- Interagency Guidelines Establishing Information Security Standards (GLBA Section 501(b)) 2 products
- Interagency Guidelines Establishing Information Security Standards 1 product
- Interagency Guidelines Establishing Information Security Standards (12 CFR Part 30 Appendix B; 12 CFR Part 748 Appendix A for credit unions) 1 product
For what it requires of your organization, read the rule itself or ask your counsel.
Products
The 15 products that support it
API Security & Integration
Securing the connectivity between legacy mainframes (COBOL) and modern fintech apps.
Lists:
- Interagency Guidelines Establishing Information Security Standards (GLBA Section 501(b))
Board Governance & Packet Portal
Encrypted iPad portal for Board minutes and voting, with "reading room" controls on downloading and printing non-public material. Access policy and vote validity remain your institution's.
Lists:
- Interagency Guidelines Establishing Information Security Standards (12 CFR Part 30 Appendix B; 12 CFR Part 748 Appendix A for credit unions)
CRM for Finance
Managed Salesforce Shield encryption with key material held by Moraph outside Salesforce, so Salesforce does not store your decryption keys. Field permissions remain your decision.
Lists:
- Interagency Guidelines Establishing Information Security Standards
Data Loss Prevention
Network and endpoint blocking of outbound transmission of SSNs or credit card numbers (PAN).
Lists:
- Gramm-Leach-Bliley Act Safeguards (Interagency Guidelines Establishing Information Security Standards; FTC Safeguards Rule, 16 CFR Part 314)
Database Security
Real-time monitoring of SQL queries to detect mass data exfiltration events.
Lists:
- Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B)
Digital Transaction Management
Loan document signature workflows configured to support ESIGN and UETA consent and signing requirements, with audit trails. Enforceability remains a question for your counsel.
Lists:
- Gramm-Leach-Bliley Act and the Interagency Guidelines Establishing Information Security Standards
Endpoint Detection & Response
24/7 managed detection and hunting on teller workstations to reduce ransomware risk. Recovery, backups and notification decisions remain your institution's.
Lists:
- Interagency Guidelines Establishing Information Security Standards (12 CFR Part 30 App. B, Part 364 App. B)
Identity Access Management
MFA and SSO configurations tuned to support the FFIEC Authentication and Access guidance (2021). Your institution owns the risk assessment and the adequacy decision.
Lists:
- Gramm-Leach-Bliley Act and the Interagency Guidelines Establishing Information Security Standards
Privileged Access Management
Vaulting and rotating passwords for core banking admin accounts.
Lists:
- Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B)
Public Cloud Infrastructure
Managing the tenant with "Policy as Code" guardrails designed to block public S3 buckets holding consumer data. Guardrails reduce, not remove, misconfiguration risk; data decisions remain yours.
Lists:
- Gramm-Leach-Bliley Act Safeguards (Interagency Guidelines Establishing Information Security Standards; FTC Safeguards Rule, 16 CFR Part 314)
Secure File Transfer
Encrypted "drop box" for clients to upload tax returns without using insecure email.
Lists:
- Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B)
Security Awareness Training
Phishing simulations tailored to financial fraud (e.g., "Wire Transfer Request"), producing training evidence for examiners and cyber insurers. Premium decisions remain the insurer's.
Lists:
- Interagency Guidelines Establishing Information Security Standards (12 CFR Part 30 App. B, Part 364 App. B)
Third-Party Risk Scoring
Continuous credit-rating-style monitoring of vendor security postures.
Lists:
- Interagency Guidelines Establishing Information Security Standards (GLBA Section 501(b))
Virtual Desktop Infrastructure
Secure remote workspaces designed to keep PII off loan officers' local laptops, under file, clipboard and print policies you approve. Access decisions remain yours.
Lists:
- Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B)
Vulnerability Management
Authenticated scanning of the banking network on your schedule (e.g., weekly), supporting the GLBA Safeguards Rule's vulnerability-assessment requirement (16 CFR 314.4(d)(2)). Risk assessment and remediation remain the institution's.
Lists:
- Interagency Guidelines Establishing Information Security Standards (12 CFR Part 364, Appendix B; 12 CFR Part 30, Appendix B)
Not sure which requirements apply to you? Request a gap analysis. All requirements: Requirements our products support.