GLBA is a statutory umbrella whose substantive operational controls are issued by regulators via subordinate rules. (a) FTC SAFEGUARDS RULE (16 CFR Part 314) - the substantive cybersecurity rule for non-bank financial institutions; major 2021 revision + 2023 amendment with FTC 30-day notification requirement effective 2024-05-13 + the rule is VERIFIED SEPARATELY in this corpus (4-way consolidation completed 2026-05-28 with 2225 incoming MAPS_TO preserved); 9 Required Elements (Sec. 314.4(a)-(i)) including written program + Qualified Individual + risk assessment + access controls + encryption + secure development + MFA + monitoring + employee training + service provider oversight + IR plan + incident reporting + board reporting + continuous improvement. (b) FTC PRIVACY RULE (16 CFR Part 313) - implements GLBA Sections 6802 + 6803 privacy notice + opt-out for non-bank financial institutions + tracked separately if present. (c) SEC REGULATION S-P (17 CFR Part 248) - applies to broker-dealers + investment companies + investment advisers + transfer agents; major March 2024 amendments effective 2025-12-03 (large) + 2026-06-03 (small) including (1) WRITTEN INCIDENT RESPONSE PROGRAM; (2) 30-DAY INDIVIDUAL NOTIFICATION upon discovery of unauthorized access/use; (3) THIRD-PARTY SERVICE PROVIDER oversight + supervision; (4) annual prudential-board reporting; (5) record-keeping extension. (d) INTERAGENCY GUIDELINES ESTABLISHING STANDARDS FOR SAFEGUARDING CUSTOMER INFORMATION - 12 CFR Part 30 Appendix B (OCC) + 12 CFR Part 208 Appendix D-2 (Federal Reserve) + 12 CFR Part 364 Appendix B (FDIC) + 12 CFR Part 748 Appendix A (NCUA) - banks + savings associations + credit unions. (e) INTERAGENCY GUIDANCE ON RESPONSE PROGRAMS for unauthorized access to customer information with customer-notification triggers. (f) NAIC INSURANCE DATA SECURITY MODEL LAW (NAIC #668, 2017) adopted by 20+ states (Alabama + Connecticut + Delaware + Indiana + Iowa + Kentucky + Louisiana + Maine + Maryland + Michigan + Minnesota + Mississippi + New Hampshire + New York DFS 23 NYCRR 500 + North Dakota + Ohio + South Carolina + Tennessee + Vermont + Virginia + Wisconsin) - state-level GLBA implementation for insurance sector.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.