16 CFR 314.1 purpose + scope; 314.2 definitions. PURPOSE: to establish standards for safeguarding customer information held by financial institutions under FTC jurisdiction + implementing Title V of GLBA. SCOPE: applies to FINANCIAL INSTITUTIONS under FTC jurisdiction (i.e. not supervised by federal banking agencies). FINANCIAL INSTITUTION = any institution the business of which is engaging in financial activities described in 12 USC 1843(k); the 2021 amendments EXPANDED the definition to include FINDERS (entities that introduce buyers and sellers of financial products). EXAMPLES: consumer reporting agencies + finance companies + mortgage brokers + automobile dealers + payday lenders + tax preparation firms + non-bank lenders + collection agencies + investment advisors not registered with SEC + finders. CUSTOMER INFORMATION: nonpublic personal information about a consumer obtained in connection with a financial product or service - includes both data the institution collects + data received from another financial institution. NONPUBLIC PERSONAL INFORMATION (NPI) per GLBA + the Privacy Rule (16 CFR Part 313): personally identifiable financial information collected in connection with a financial product or service - excludes publicly available information. EXEMPTIONS: institutions maintaining customer information of FEWER THAN 5,000 CONSUMERS may use SIMPLIFIED COMPLIANCE under 314.6.
This control maps to 511 controls across 230 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 511 it maps to, and the evidence behind each claim, over MCP and REST.