GLBA GLBA-Crosswalk-Subordinate-Substantive-Rules: GLBA Crosswalk to FTC Safeguards Rule, FTC Privacy Rule, SEC Reg S-P, Interagency Guidelines, NAIC Model Law

GLBA crosswalk to subordinate substantive rules. Auditor evidence + substantive control content lives in the SUBORDINATE rules + this GLBA parent statute is a STATUTORY UMBRELLA reference. (a) FTC SAFEGUARDS RULE (16 CFR Part 314) - VERIFIED SEPARATELY 2026-05-28 with 11 section-aligned controls + 2225 incoming MAPS_TO; covers 9 Required Elements + 30-day FTC notification + Qualified Individual + risk assessment + access controls + encryption + MFA + monitoring + IR plan + board reporting. (b) FTC PRIVACY RULE (16 CFR Part 313) - tracked separately if present + implements Sections 6802 + 6803 disclosure + notice + opt-out + model privacy form. (c) SEC REGULATION S-P (17 CFR Part 248) - applies to broker-dealers + investment companies + investment advisers + transfer agents + 2024 major amendments effective 2025-12-03 (large) + 2026-06-03 (small) with 30-day individual notification + IR program + record-keeping. (d) INTERAGENCY GUIDELINES ESTABLISHING STANDARDS FOR SAFEGUARDING CUSTOMER INFORMATION + INTERAGENCY GUIDANCE ON RESPONSE PROGRAMS - 12 CFR Part 30 (OCC) + Part 208 (Federal Reserve) + Part 364 (FDIC) + Part 748 (NCUA). (e) NAIC INSURANCE DATA SECURITY MODEL LAW (NAIC #668, 2017) + 20+ state adoptions. (f) NEW YORK DFS 23 NYCRR 500 (state-level GLBA-adjacent insurance + financial cyber). (g) CFPB SECTION 1033 OPEN BANKING RULE (October 2024 effective phased 2026-2030). (h) DEPARTMENT OF EDUCATION FSA SAFEGUARDS - Higher Ed Title IV (US Gramm-Leach-Bliley Act - Higher Education Safeguards Rule + tracked separately). (i) HIPAA Privacy + Security Rules - separate but coordination-relevant for entities subject to both. (j) FCRA Fair Credit Reporting Act - separate but coordination-relevant for credit-reporting agency information sharing. (k) ECOA Equal Credit Opportunity Act - separate but coordination-relevant for credit-decision NPI. (l) UDAAP enforcement - CFPB Unfair Deceptive Abusive Acts and Practices for non-bank consumer finance.