GLBA sectoral application by institution type. BANKING (federal banking agencies enforcement): national banks (OCC) + state member banks (Federal Reserve) + state non-member banks (FDIC) + federal credit unions (NCUA) + savings associations (FDIC/OCC) - Interagency Guidelines Establishing Standards for Safeguarding Customer Information; subject to OCC + Federal Reserve + FDIC + NCUA examination programs + Federal Reserve SR Letters + OCC Bulletins + FDIC FILs. SECURITIES (SEC enforcement): broker-dealers + investment companies + investment advisers + transfer agents - SEC Regulation S-P (17 CFR Part 248) + 2024 amendments + Reg S-ID identity-theft red flags + Reg S-AM affiliate marketing; FINRA Rule 4530 + 2024-02-05 cybersecurity-disclosure rules. FUTURES (CFTC enforcement): futures commission merchants + commodity trading advisors + commodity pool operators - CFTC Reg 1.55 + 1.56 + 23.450 + NFA Cybersecurity Interpretive Notice 9070. INSURANCE (state insurance authorities): insurance companies + insurance agencies - NAIC Insurance Data Security Model Law (NAIC #668) adopted by 20+ states (most prominent New York DFS 23 NYCRR 500 + amended 2023 with enhanced governance + 72-hour reporting + ransomware-payment notification + class-A oversight); state insurance commissioners examination programs. NON-BANK FINANCIAL INSTITUTIONS (FTC + CFPB): consumer finance + check-cashers + money-services + tax preparers + automobile dealers + collection agencies + non-bank mortgage + retail finance - FTC Safeguards Rule + FTC Privacy Rule + CFPB Section 1033 Open Banking Rule (October 2024 effective 2026 phased) + CFPB UDAAP enforcement. HIGHER EDUCATION TITLE IV (Federal Student Aid - FSA): Department of Education GLBA enforcement via FSA Audit Guide + 2024 FSA Cybersecurity Program Bulletins + FTC Safeguards Rule applies (US Gramm-Leach-Bliley Act - Higher Education Safeguards Rule framework, tracked separately).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.