A thorough guide to using SIEM for GLBA compliance.

Gramm-Leach-Bliley Act (GLBA) is also known as the 1999 Financial Modernization Act. It is a regulation that requires institutions in the United States to explain how they handle and protect information about their customers. To be GLBA compliant, institutions (financial companies) disclose to their clients how they handle their sensitive information, inform their clients of the liberty to opt out if they do not want their information (customers’) shared with another party, and apply particular protection approaches to clients’ sensitive information under a properly constituted security plan established by the organization. The main implications for information protection under GLBA are stated in the Safeguards Rule, while additional privacy and protection demands are issued by the Federal Trade Commission’s (FTC) Privacy of Consumer Financial Information Rule (Privacy Rule), which is constituted under GLBA to force execution of GLBA requirements. The FTC enforces GLBA as the federal banking agency, along with different federal regulatory agencies and state-owned insurance oversight authorities.

GLBA Compliance Benefits

GLBA compliance lowers the chances of penalties and reputational harm to financial institutions arising from careless or unauthorized transfer, or loss, of customer sensitive information. Additionally, GLBA compliance delivers numerous privacy and security benefits through the following requirements:

• Personal data is protected from unauthorized access
• Clients receive notice whenever their private sensitive data will be shared between the financial institution they trust and a third party.
• The activity of the user is tracked, including the attempts to make access to secured records

GLBA safeguards both customers and their records, which helps build strong customer reliance and trust. Clients are assured that their sensitive data is safely and properly maintained by the financial institution(s), resulting in an enhanced reputation, repeat business, and other benefits of a trusted relationship.

Working principle

Under GLBA, financial institutions must account for the confidentiality and security of their customers’ NPI. NPI examples include Social Security card numbers, credit and income records, bank account numbers, mobile phone numbers, email and physical addresses, along with all confidential customer-related information the financial company receives. The Safeguards Rule directs financial agencies to prepare an information security plan that sets out the programs protecting client data from compromise. This information security plan is tailored specifically to the institution’s size, sophistication and operations. The Safeguards Rule requirements for financial institutions are:

• Appointing at least one qualified employee to coordinate the company’s information security program.
• Identifying and assessing risks to customer information across all relevant operational areas of the company, and evaluating how effective the current Safeguards are for controlling those risks.
• Designing and implementing safeguard programs, conducting routine checkups and testing
• Selecting the most suitable service provider to maintain the safeguards, ensuring the contract requires them to perform regular maintenance, and consistently overseeing how they handle customer data.
• Evaluating and adjusting the program as needed, such as when business operations change or when security inspections and testing produce new results.

To meet GLBA compliance under the Safeguards Rule, financial institutions must focus closely on staff management and training, data systems, and security management in their data security plans and their execution.

GLBA penalties

When an allegation of GLBA non-compliance is confirmed, the penalties can lead to consequences or changes to the business. Penalties tied to GLBA non-compliance include:

• A financial institution may be fined as much as $100,000 for each individual violation.
• An individual found responsible for the violation may be fined up to $10,000 for each individual violation.
• A person found guilty can be sentenced to up to 5 years imprisonment

Best GLBA compliance practices

GLBA is chiefly concerned with broadening and strengthening safeguards and restrictions around consumer data privacy. For IT experts and leading financial institutions, the primary issue with GLBA is protecting and ensuring the confidentiality of customers’ private and financial data. Maintaining GLBA compliance is essential for every financial institution, since any violation brings costly penalties and can ruin operations and reputation. Still, by following the proper step-by-step process to protect NPI and achieve GLBA compliance, an organization gains improved security, avoidance of penalties, and greater consumer trust and therefore loyalty.

Some of the best practices include:

• Involving the board: most financial institutions, especially banks, meet this requirement by maintaining a clearly defined board whose primary subjects center on providing security and protection for their customers. The board holds briefings with varying degrees of formality.
• Assessing the risk: the methods tied to risk assessment for GLBA compliance were formerly unclear, but became clearer in the years that followed under the guidance of the Information Technology Risk Management Program (IT-RMP). Indeed, this program removed the ambiguity that often arises when evaluating customer information risks.
• Management and control of risks: the primary aim is to assess the bank’s ability to perform after customer data risk assessment has been implemented. In particular, the examiner seeks evidence that the financial institution has successfully applied the appropriate mitigation tactics.
• Overseeing service providers: indeed, the growing practice of purchasing services and technology has thoroughly transformed the financial industry. Financial institutions are focused on building proficiency in vendor management and oversight, along with recurring evaluation and certification processes.
• Establishment of a proper method for adjusting the risk management program: Finally, a financial institution’s capacity to adapt its management response to both external and internal changes is crucial. This includes changes resulting from mergers, acquisitions, technology modifications or upgrades, and outsourcing. Financial institutions have adopted a specific adjustment process, at varying levels of formality.

Conclusion

Complying with GLBA is crucial for safeguarding customer information as it should be. Given the current state of innovation and cybercrime, financial institutions must adopt the newest technology to keep pace and reduce the risk of information being lost, damaged, altered, or compromised.