Two Regulations, One Framework: Why the Confusion Persists
If you manage compliance for a financial institution, mortgage company, auto dealer, tax preparer, or any other entity that handles consumer financial data, you have almost certainly encountered both the Gramm-Leach-Bliley Act (GLBA) and the FTC Safeguards Rule in the same conversation. The two are frequently conflated, and that confusion creates real compliance risk.
Here is the short version: GLBA is the federal statute. The FTC Safeguards Rule is the implementing regulation. Understanding how they relate to each other — and what each one actually demands of your organization — is the foundation of any credible compliance program in this space. This post will walk through both, clarify the key obligations, and explain what a defensible compliance posture looks like in 2026.
What GLBA Actually Says
The Gramm-Leach-Bliley Act, enacted in 1999, established a broad framework for how financial institutions must treat the nonpublic personal information (NPI) of their customers. The Act contains three primary components:
- The Financial Privacy Rule — governs how financial institutions collect and disclose personal financial information
- The Safeguards Rule — requires financial institutions to develop, implement, and maintain a comprehensive information security program
- The Pretexting Provisions — prohibit social engineering tactics used to obtain customer financial information
GLBA defines "financial institution" broadly. It covers not just banks and credit unions, but also mortgage brokers, payday lenders, finance companies, tax preparation firms, retailers that offer financing, and many others. If your business is significantly engaged in financial activities, GLBA likely applies to you.
Critically, GLBA itself delegates enforcement and rulemaking authority to different agencies depending on the type of institution. Bank regulators — the OCC, Federal Reserve, FDIC, and NCUA — oversee banks and credit unions. The Federal Trade Commission (FTC) handles non-bank financial institutions, which is where the FTC Safeguards Rule comes in.
What the FTC Safeguards Rule Actually Requires
The FTC Safeguards Rule is the mechanism through which the FTC enforces GLBA's security requirements against the non-bank financial institutions it regulates. The rule was originally issued in 2003 and substantially revised in 2021, with the updated requirements phased in through 2023.
The revised rule is significantly more prescriptive than its predecessor. Where the 2003 version gave institutions broad flexibility, the 2021 amendments introduced specific technical and administrative requirements. Understanding what GLBA compliance services must cover starts with understanding what the Safeguards Rule now mandates.
The core requirement is a Written Information Security Program (WISP) that is reasonably designed to protect the security, confidentiality, and integrity of customer information. But the revised rule goes further, requiring:
- Designation of a qualified individual responsible for the information security program
- A written risk assessment that identifies reasonably foreseeable internal and external risks
- Access controls limiting who can access customer information systems
- Encryption of customer information in transit and at rest
- Multi-factor authentication (MFA) for any individual accessing customer information systems
- Secure development practices for in-house applications
- Procedures for the secure disposal of customer information
- Change management controls
- Monitoring and testing of the information security program
- A written incident response plan
- Vendor oversight requirements, including written contracts with service providers
- Annual reporting to the board of directors or equivalent governing body
The threshold for which institutions must comply with all of these requirements versus a scaled-down version matters. Institutions that maintain customer information on fewer than 5,000 consumers are exempt from certain requirements, including the written risk assessment, incident response plan, and annual reporting. Everyone else must comply in full.
The Critical Distinction: GLBA vs. FTC Safeguards Rule in Practice
Here is where many compliance managers get tripped up. GLBA sets the statutory obligation. The FTC Safeguards Rule defines how to meet it — for non-bank financial institutions regulated by the FTC. If you are a bank, thrift, or credit union, the FTC Safeguards Rule does not apply to you directly. You instead operate under the Interagency Guidelines Establishing Information Security Standards, which the bank regulators issued under their own GLBA authority.
The practical implication: if you are a mortgage company, auto dealer with a financing arm, or fintech firm, the FTC is your regulator, and the FTC Safeguards Rule is your compliance standard. If you are a community bank, your compliance standard comes from your prudential regulator — but the underlying GLBA obligation is the same.
For organizations subject to the FTC, a comprehensive FTC Safeguards Rule compliance checklist is the right place to start validating your current posture.
What a Defensible Compliance Program Looks Like
FTC Safeguards Rule compliance is not a documentation exercise. The FTC has demonstrated through enforcement actions that it expects substantive programs, not paper policies. Here is what a defensible program actually requires:
1. Risk Assessment That Drives the Program
Your written risk assessment must identify specific threats and vulnerabilities to customer information — not boilerplate language. The assessment should inform the controls you implement, and the connection between risk findings and control selection must be traceable. A formal risk assessment engagement conducted by qualified professionals will produce the documentation necessary to demonstrate this connection to FTC examiners.
2. A Qualified Individual, Not Just a Title
The rule requires a "qualified individual" to oversee the information security program. This person does not need to be a full-time employee — the FTC explicitly permits the use of a service provider in this role. Many organizations find that a regulatory vCISO engagement satisfies this requirement cost-effectively while providing genuine expertise. The key word is "qualified" — the individual must have the knowledge and authority to manage the program.
3. Technical Controls That Are Actually Implemented
Encryption, MFA, access controls, and monitoring are not optional checkboxes. The FTC expects these controls to be operational. Policies that describe controls that are not in place will not survive an examination. Your IT compliance program must bridge the gap between documented requirements and technical implementation.
4. Incident Response Planning
The written incident response plan must address detection, containment, notification, and post-incident review. Given FTC enforcement trends, incident response readiness is not theoretical — it is a live compliance obligation. Developing a comprehensive written information security plan that integrates incident response is a prerequisite for any credible program.
5. Vendor Management With Teeth
Service providers that handle customer information on your behalf must be covered by written contracts requiring them to maintain appropriate safeguards. Vendor oversight is one of the areas FTC examiners probe most aggressively. A mature compliance program development engagement will include vendor risk management processes aligned to this requirement.
Higher Education: A Frequently Overlooked Application
One of the more surprising aspects of GLBA coverage is its reach into higher education. Colleges and universities that participate in federal student financial aid programs are considered financial institutions under GLBA and the FTC Safeguards Rule. This means Title IV institutions must maintain a compliant information security program covering student financial information.
For institutions in this category, our GLBA Safeguards Rule for Higher Education and Financial Services training provides practical guidance on meeting these obligations in an academic environment.
Where ISO 27001 Fits In
Organizations pursuing FTC Safeguards Rule compliance frequently ask whether ISO 27001 certification satisfies the rule's requirements. The answer is nuanced: ISO 27001 provides an excellent structural framework for an information security management system, and its risk-based approach maps well to what the Safeguards Rule requires. However, ISO 27001 certification does not automatically constitute Safeguards Rule compliance — the rule has specific technical requirements (MFA, encryption standards, incident response plan content) that must be addressed on their own terms.
That said, organizations that have built their security programs around ISO 27001 will find that much of the groundwork is already in place. ISO 27001 compliance and FTC Safeguards Rule compliance are complementary objectives, not competing ones. Aligning your program to both simultaneously is achievable and efficient for most mid-size financial institutions.
Common Gaps We See in Practice
In our work with financial institutions and non-bank financial entities, the following gaps appear most frequently:
- Risk assessments that are outdated or not connected to actual control decisions
- MFA deployed inconsistently — covering some systems but not others
- Encryption implemented at the application layer but not enforced at the database or storage layer
- No documented change management process, leaving systems vulnerable to uncontrolled modifications
- Service provider contracts that lack the required security provisions
- Incident response plans that exist on paper but have never been tested
- Board reporting that is absent or consists of a single annual slide with no substantive content
Each of these gaps represents a finding in an FTC examination. More importantly, each represents a real security weakness that exposes your customers and your organization to harm.
Getting to a Defensible Program
FTC Safeguards Rule compliance requires the same discipline that any mature regulatory compliance program demands: documented requirements, implemented controls, tested procedures, and ongoing monitoring. The 2021 amendments raised the bar significantly. Organizations that built their programs around the 2003 rule and have not revisited them are almost certainly out of compliance.
If you are responsible for financial institution compliance and are not confident in your current program's ability to withstand FTC scrutiny, the time to close those gaps is now — not after an examination notice arrives.
Next Steps
At Cleared Systems, we work with financial institutions, higher education entities, and non-bank financial services firms to build FTC Safeguards Rule compliance programs that are substantive, documented, and defensible. Whether you need a gap assessment, a full program build, or ongoing vCISO support to manage your qualified individual obligation, we can help. Request a quote to discuss your situation, or review our engagement models to understand how we structure this work. Compliance that only exists on paper is not compliance — let us help you build something that holds up.