Back to Frameworks

GLBA

Self-Assess
United States (federal)
vTitle V of Public Law 106-102 (12 November 1999) as codified at 15 U.S.C. 6801 to 6809 and 6821 to 6827, with the 2006, 2010 and 2015 amendments recorded
2 domains
10 controls

The Gramm-Leach-Bliley Act (GLBA, also known as the Financial Services Modernization Act of 1999, Public Law 106-102) is a US federal statute enacted 12 November 1999 that imposes privacy + safeguarding + anti-pretexting obligations on FINANCIAL INSTITUTIONS handling nonpublic personal information (NPI). KEY PROVISIONS: (a) SUBCHAPTER I - DISCLOSURE OF NONPUBLIC PERSONAL INFORMATION (15 USC 6801-6809): policy of privacy obligation + safeguarding standard (Sec. 6801); notice + opt-out obligations on disclosure to nonaffiliated third parties (Sec. 6802); annual privacy notice obligation (Sec. 6803); rulemaking authority delegated to Bureau of Consumer Financial Protection (CFPB) + Securities and Exchange Commission (SEC) + Commodity Futures Trading Commission (CFTC) (Sec. 6804); enforcement by federal banking agencies (OCC + Federal Reserve + FDIC + NCUA + OTS) + SEC + CFTC + FTC + State insurance authorities (Sec. 6805); state insurance preemption (Sec. 6806); relation to other Acts (Sec. 6807); study of information sharing (Sec. 6808); definitions (Sec. 6809). (b) SUBCHAPTER II - FRAUDULENT ACCESS TO FINANCIAL INFORMATION (15 USC 6821-6827): PRETEXTING prohibition (Sec. 6821) - obtaining customer information by false pretenses + including phone + internet + impersonation prohibited; administrative enforcement by FTC + federal banking agencies (Sec. 6822); criminal penalties up to 5 years imprisonment or 10 years if aggravated (Sec. 6823); relation to other laws (Sec. 6824); agency guidance (Sec. 6825); reports (Sec. 6826); definitions (Sec. 6827). OPERATIONALISATION: GLBA establishes the statutory umbrella; substantive operational controls are issued by regulators via subordinate rules: (a) FTC Safeguards Rule 16 CFR Part 314 (last major revision 2021 + 2023 breach-notification amendment effective 2024 + further 2024-2025 amendments - verified separately); (b) FTC Privacy Rule 16 CFR Part 313 + model privacy form; (c) SEC Regulation S-P (17 CFR Part 248) - amended March 2024 + effective 2025-2026 with incident-response + breach-notification + 30-day individual notification + supervisory + record-keeping requirements; (d) BANKING-AGENCY RULES (Interagency Guidelines Establishing Standards for Safeguarding Customer Information + Interagency Guidance on Response Programs for Unauthorized Access to Customer Information + Customer Notice) issued by OCC + Federal Reserve + FDIC + NCUA + OTS - see 12 CFR Part 30 + Part 208 + Part 364 + Part 748; (e) NAIC Insurance Data Security Model Law (NAIC #668) adopted by 20+ states; (f) CFPB enforcement under Dodd-Frank for non-bank financial institutions; (g) HIGHER EDUCATION institutions participating in Title IV (FSA - Federal Student Aid) are FTC Safeguards Rule covered + tracked separately as a sectoral application. 2024-2025 PIPELINE: SEC Reg S-P amendments effective 2025-12-03 large + 2026-06-03 small institutions; FTC Safeguards 2024 30-day FTC notification rule effective; CFPB Section 1033 Open Banking Rule (October 2024) imposes additional safeguarding obligations on screen-scrapers; NAIC Model Bulletin on AI 2023; state privacy laws (CCPA + state DP laws) coordinate. ENGAGEMENT: GLBA is the statutory umbrella - cross-mapping to substantive controls + auditor evidence should target the subordinate FTC Safeguards Rule + FTC Privacy Rule + SEC Reg S-P + banking-agency rule frameworks.

Verified

GLBA is a compliance framework from United States (federal) with 2 domains and 10 controls that map to 100 other frameworks. The largest domains are Subtitle A: Disclosure of nonpublic personal information (sections 501 to 510, 15 U.S.C. 6801 to 6809) – GLBA (8 controls), Subtitle B: Fraudulent access to financial information (sections 521 to 527, 15 U.S.C. 6821 to 6827) – GLBA (2 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykControl text last updated

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (2)

Subtitle A: Disclosure of nonpublic personal information (sections 501 to 510, 15 U.S.C. 6801 to 6809) – GLBA

8 controls
Controls in the Subtitle A: Disclosure of nonpublic personal information (sections 501 to 510, 15 U.S.C. 6801 to 6809) – GLBA domain of GLBA: 8 controls
CodeTitle
glba::501(b)Sec. 501(b) (15 U.S.C. 6801(b)) Safeguards standard: security and confidentiality, anticipated threats, unauthorised access
glba::502(a)Sec. 502(a) (15 U.S.C. 6802(a)) No disclosure to nonaffiliated third parties without a compliant notice
glba::502(b)(1)Sec. 502(b)(1) (15 U.S.C. 6802(b)(1)) Opt-out before disclosure to nonaffiliated third parties
glba::502(b)(2)Sec. 502(b)(2) (15 U.S.C. 6802(b)(2)) Service provider and joint marketing exception with disclosure and a confidentiality contract
glba::502(c)Sec. 502(c) (15 U.S.C. 6802(c)) Limits on reuse by the receiving third party
glba::502(d)Sec. 502(d) (15 U.S.C. 6802(d)) No sharing of account numbers for marketing
glba::503(a)Sec. 503(a) (15 U.S.C. 6803(a)) Initial and annual privacy notice
glba::503(b)Sec. 503(b) (15 U.S.C. 6803(b)) Contents of the privacy notice

Subtitle B: Fraudulent access to financial information (sections 521 to 527, 15 U.S.C. 6821 to 6827) – GLBA

2 controls
Controls in the Subtitle B: Fraudulent access to financial information (sections 521 to 527, 15 U.S.C. 6821 to 6827) – GLBA domain of GLBA: 2 controls
CodeTitle
glba::521(a)Sec. 521(a) (15 U.S.C. 6821(a)) Prohibition on obtaining customer information by false pretences
glba::521(b)Sec. 521(b) (15 U.S.C. 6821(b)) Prohibition on soliciting another to obtain customer information by false pretences

Your Compliance Coverage

If you comply with GLBA, you already cover:

Protective Security Policy Framework (PSPF) Release 2026

18%

4 controls mapped

Compare →

OWASP Top 10:2025

18%

4 controls mapped

Compare →

OWASP DevSecOps Maturity Model (DSOMM)

18%

4 controls mapped

Compare →

+ 97 more: HKMA Cyber Resilience Assessment Framework (C-RAF) (18%), ISO/IEC 27400:2022 (18%)

See all 100 mapped frameworks ↓

Maps to 100 other frameworks

22 total controls
Protective Security Policy Framework (PSPF) Release 2026
4 source controls mapped|2 target controls covered
18%
OWASP Top 10:2025
4 source controls mapped|4 target controls covered
18%
OWASP DevSecOps Maturity Model (DSOMM)
4 source controls mapped|4 target controls covered
18%
HKMA Cyber Resilience Assessment Framework (C-RAF)
4 source controls mapped|3 target controls covered
18%
ISO/IEC 27400:2022
4 source controls mapped|5 target controls covered
18%
ASIS SPC.1-2009 - Organizational Resilience Standard
4 source controls mapped|5 target controls covered
18%
Annex 11 to EU GMP - Computerised Systems
4 source controls mapped|6 target controls covered
18%
FFIEC IT Examination Handbook
4 source controls mapped|15 target controls covered
18%
FTC GLBA Safeguards Rule (16 CFR Part 314)
4 source controls mapped|3 target controls covered
18%
Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023)
4 source controls mapped|6 target controls covered
18%
Vietnam Law on Cybersecurity (No. 116/2025/QH15)
3 source controls mapped|1 target controls covered
14%
TEFCA - Trusted Exchange Framework and Common Agreement
3 source controls mapped|1 target controls covered
14%
Pakistan Personal Data Protection Bill 2023
3 source controls mapped|3 target controls covered
14%
ISO/IEC 30111:2019
3 source controls mapped|3 target controls covered
14%
Barbados Data Protection Act 2019
3 source controls mapped|2 target controls covered
14%
US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements
3 source controls mapped|3 target controls covered
14%
US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements
3 source controls mapped|2 target controls covered
14%
Privacy Act 1988 (Australia)
3 source controls mapped|2 target controls covered
14%
Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP)
3 source controls mapped|1 target controls covered
14%
Law No. 172-13 on the Protection of Personal Data
3 source controls mapped|1 target controls covered
14%
India DPDP Act
3 source controls mapped|3 target controls covered
14%
India CERT-In Cyber Security Directions 2022
3 source controls mapped|3 target controls covered
14%
IACS Unified Requirements E26/E27 - Cyber Resilience of Ships and On-Board Systems
3 source controls mapped|5 target controls covered
14%
ISO/IEC 27010:2015
3 source controls mapped|4 target controls covered
14%
APPI
3 source controls mapped|4 target controls covered
14%
Bahrain PDPL
3 source controls mapped|4 target controls covered
14%
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL)
3 source controls mapped|4 target controls covered
14%
APRA CPS 230 Operational Risk Management
3 source controls mapped|5 target controls covered
14%
BSI IT-Grundschutz
3 source controls mapped|7 target controls covered
14%
API 1164
3 source controls mapped|7 target controls covered
14%
FFIEC Cybersecurity Assessment Tool (CAT)
3 source controls mapped|6 target controls covered
14%
UK Defence Standard 05-138 - Cyber Security for Defence Suppliers
3 source controls mapped|4 target controls covered
14%
ASD Strategies to Mitigate Cyber Security Incidents
3 source controls mapped|14 target controls covered
14%
APRA CPS 234
3 source controls mapped|6 target controls covered
14%
Canada ITSG-33 - IT Security Risk Management
3 source controls mapped|1 target controls covered
14%
OWASP ASVS
2 source controls mapped|4 target controls covered
9%
NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems
2 source controls mapped|4 target controls covered
9%
NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205)
2 source controls mapped|2 target controls covered
9%
MITRE D3FEND
2 source controls mapped|4 target controls covered
9%
ICH E6(R3) - Good Clinical Practice
2 source controls mapped|1 target controls covered
9%
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0
2 source controls mapped|6 target controls covered
9%
ISO/IEC 27031:2011
2 source controls mapped|8 target controls covered
9%
FedRAMP Rev 5
2 source controls mapped|7 target controls covered
9%
ISO/IEC 27011:2024
2 source controls mapped|6 target controls covered
9%
ISO/IEC 27557:2022 - Organisational Privacy Risk Management
2 source controls mapped|6 target controls covered
9%
IEC 60601-1 - Medical Electrical Equipment Safety
2 source controls mapped|4 target controls covered
9%
DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition)
2 source controls mapped|3 target controls covered
9%
COBIT 2019
2 source controls mapped|2 target controls covered
9%
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)
2 source controls mapped|6 target controls covered
9%
ISO/IEC 23837:2023
2 source controls mapped|4 target controls covered
9%
ISO/IEC 29115:2013 - Entity Authentication Assurance Framework
2 source controls mapped|2 target controls covered
9%
IEC 62351 - Power Systems Communication Security
2 source controls mapped|4 target controls covered
9%
ISO/IEC 27007:2020
2 source controls mapped|2 target controls covered
9%
US Gramm-Leach-Bliley Act (GLBA) - Higher Education Safeguards Rule
2 source controls mapped|1 target controls covered
9%
Singapore Cybersecurity Act 2018
2 source controls mapped|1 target controls covered
9%
Nevada Gaming Control Board Cybersecurity Requirements
2 source controls mapped|1 target controls covered
9%
COSO Internal Control - Integrated Framework (2013)
2 source controls mapped|1 target controls covered
9%
ISO/IEC 29147:2018
1 source controls mapped|2 target controls covered
5%
W3C Verifiable Credentials (VC) Data Model 2.0
1 source controls mapped|1 target controls covered
5%
USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement)
1 source controls mapped|1 target controls covered
5%
SWIFT CSCF
1 source controls mapped|1 target controls covered
5%
Regulation on the European Health Data Space (EHDS)
1 source controls mapped|1 target controls covered
5%
PCAOB AS 2201 - Audit of Internal Control Over Financial Reporting (ICFR)
1 source controls mapped|2 target controls covered
5%
Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018)
1 source controls mapped|1 target controls covered
5%
India Account Aggregator Framework (RBI)
1 source controls mapped|1 target controls covered
5%
ICAO Annex 17 - Aviation Security (AVSEC)
1 source controls mapped|1 target controls covered
5%
ISO/IEC 27014:2020
1 source controls mapped|2 target controls covered
5%
Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018)
1 source controls mapped|2 target controls covered
5%
Science Based Targets Initiative (SBTi) - Net-Zero Standard
1 source controls mapped|2 target controls covered
5%
Florida Digital Bill of Rights (FDBR)
1 source controls mapped|2 target controls covered
5%
Azerbaijan Law on Personal Data (2010)
1 source controls mapped|1 target controls covered
5%
DFARS 252.204-7012 - Safeguarding Covered Defense Information
1 source controls mapped|1 target controls covered
5%
Illinois Biometric Information Privacy Act (BIPA)
1 source controls mapped|1 target controls covered
5%
Albania Law No. 124/2024 on Personal Data Protection
1 source controls mapped|2 target controls covered
5%
PCI DSS 4.0
1 source controls mapped|1 target controls covered
5%
ISO/IEC 27004:2016
1 source controls mapped|3 target controls covered
5%
ISO/IEC 29100:2024
1 source controls mapped|3 target controls covered
5%
US Foreign Corrupt Practices Act (FCPA)
1 source controls mapped|1 target controls covered
5%
Connecticut Data Privacy Act (CTDPA)
1 source controls mapped|1 target controls covered
5%
French Sapin II Law (Law No. 2016-1691)
1 source controls mapped|1 target controls covered
5%
FDA Quality Management System Regulation (QMSR)
1 source controls mapped|1 target controls covered
5%
FedRAMP High
1 source controls mapped|1 target controls covered
5%
FedRAMP Moderate
1 source controls mapped|1 target controls covered
5%
ISO/IEC 29134:2023
1 source controls mapped|1 target controls covered
5%
ISO/IEC 27050-1:2019
1 source controls mapped|1 target controls covered
5%
South Korea Cloud Security Assurance Program (CSAP)
1 source controls mapped|1 target controls covered
5%
OWASP API Security Top 10 - 2023
1 source controls mapped|1 target controls covered
5%
NATO AQAP 2110 - Quality Assurance Requirements for Design, Development, and Production
1 source controls mapped|2 target controls covered
5%
HL7 FHIR Security Framework
1 source controls mapped|1 target controls covered
5%
Global Cross-Border Privacy Rules (Global CBPR) Forum
1 source controls mapped|1 target controls covered
5%
US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties
1 source controls mapped|1 target controls covered
5%
Aged Care Quality Standards 2019 (repealed edition)
1 source controls mapped|1 target controls covered
5%
German Supply Chain Due Diligence Act (LkSG)
1 source controls mapped|1 target controls covered
5%
BS 65000:2014 - Guidance on Organizational Resilience
1 source controls mapped|3 target controls covered
5%
FBI CJIS Security Policy
1 source controls mapped|4 target controls covered
5%
AS9100D - Aerospace Quality Management System
1 source controls mapped|1 target controls covered
5%
UAE Virtual Asset Regulatory Authority (VARA) Regulations
1 source controls mapped|1 target controls covered
5%
AML/CTF Act 2006 (Australia)
1 source controls mapped|1 target controls covered
5%
FIDO2 / WebAuthn
1 source controls mapped|1 target controls covered
5%
Singapore AI Governance Framework
1 source controls mapped|1 target controls covered
5%
Compare GLBA with Protective Security Policy Framework (PSPF) Release 2026

Coverage is not the same as your position

This page shows what GLBA overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is GLBA and who does it apply to?

GLBA is a compliance framework from United States (federal) with 2 domains and 10 controls. The Gramm-Leach-Bliley Act (GLBA, also known as the Financial Services Modernization Act of 1999, Public Law 106-102) is a US federal statute enacted 12 November 1999 that imposes privacy + safeguarding + anti-pretexting obligations on FINANCIAL INSTITUTIONS handling nonpublic personal information (NPI). KEY PROVISIONS: (a) SUBCHAPTER I - DISCLOSURE OF NONPUBLIC PERSONAL INFORMATION (15 USC 6801-6809): policy of privacy obligation + safeguarding standard (Sec. 6801); notice + opt-out obligations on disclosure to nonaffiliated third parties (Sec. 6802); annual privacy notice obligation (Sec. 6803); rulemaking authority delegated to Bureau of Consumer Financial Protection (CFPB) + Securities and Exchange Commission (SEC) + Commodity Futures Trading Commission (CFTC) (Sec. 6804); enforcement by federal banking agencies (OCC + Federal Reserve + FDIC + NCUA + OTS) + SEC + CFTC + FTC + State insurance authorities (Sec. 6805); state insurance preemption (Sec. 6806); relation to other Acts (Sec. 6807); study of information sharing (Sec. 6808); definitions (Sec. 6809). (b) SUBCHAPTER II - FRAUDULENT ACCESS TO FINANCIAL INFORMATION (15 USC 6821-6827): PRETEXTING prohibition (Sec. 6821) - obtaining customer information by false pretenses + including phone + internet + impersonation prohibited; administrative enforcement by FTC + federal banking agencies (Sec. 6822); criminal penalties up to 5 years imprisonment or 10 years if aggravated (Sec. 6823); relation to other laws (Sec. 6824); agency guidance (Sec. 6825); reports (Sec. 6826); definitions (Sec. 6827). OPERATIONALISATION: GLBA establishes the statutory umbrella; substantive operational controls are issued by regulators via subordinate rules: (a) FTC Safeguards Rule 16 CFR Part 314 (last major revision 2021 + 2023 breach-notification amendment effective 2024 + further 2024-2025 amendments - verified separately); (b) FTC Privacy Rule 16 CFR Part 313 + model privacy form; (c) SEC Regulation S-P (17 CFR Part 248) - amended March 2024 + effective 2025-2026 with incident-response + breach-notification + 30-day individual notification + supervisory + record-keeping requirements; (d) BANKING-AGENCY RULES (Interagency Guidelines Establishing Standards for Safeguarding Customer Information + Interagency Guidance on Response Programs for Unauthorized Access to Customer Information + Customer Notice) issued by OCC + Federal Reserve + FDIC + NCUA + OTS - see 12 CFR Part 30 + Part 208 + Part 364 + Part 748; (e) NAIC Insurance Data Security Model Law (NAIC #668) adopted by 20+ states; (f) CFPB enforcement under Dodd-Frank for non-bank financial institutions; (g) HIGHER EDUCATION institutions participating in Title IV (FSA - Federal Student Aid) are FTC Safeguards Rule covered + tracked separately as a sectoral application. 2024-2025 PIPELINE: SEC Reg S-P amendments effective 2025-12-03 large + 2026-06-03 small institutions; FTC Safeguards 2024 30-day FTC notification rule effective; CFPB Section 1033 Open Banking Rule (October 2024) imposes additional safeguarding obligations on screen-scrapers; NAIC Model Bulletin on AI 2023; state privacy laws (CCPA + state DP laws) coordinate. ENGAGEMENT: GLBA is the statutory umbrella - cross-mapping to substantive controls + auditor evidence should target the subordinate FTC Safeguards Rule + FTC Privacy Rule + SEC Reg S-P + banking-agency rule frameworks. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does GLBA actually require?

GLBA has 10 controls organised across 2 domains. The largest domains are Subtitle A: Disclosure of nonpublic personal information (sections 501 to 510, 15 U.S.C. 6801 to 6809) – GLBA (8 controls), Subtitle B: Fraudulent access to financial information (sections 521 to 527, 15 U.S.C. 6821 to 6827) – GLBA (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of GLBA do I already cover?

GLBA maps to 100 other compliance frameworks. The top mapping partners are Protective Security Policy Framework (PSPF) Release 2026 (18% coverage), OWASP Top 10:2025 (18% coverage), OWASP DevSecOps Maturity Model (DSOMM) (18% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement GLBA?

Start your GLBA compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about GLBA requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 10 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.

Get Started Free →

Free forever, no credit card required