GLBA Safeguards Rule

• FTC: Standards for Safeguarding Customer Information
• FTC business guidance: Safeguards Rule
• eCFR: 16 CFR Part 314

The FTC describes the Safeguards Rule as requiring financial institutions under FTC jurisdiction to have measures to keep customer information secure.

The Safeguards Rule is designed to protect customer information held by covered financial institutions. A covered business needs to understand what customer information it has, where it lives, who can access it, what risks apply, what safeguards are used, and which service providers handle or can access the information.

Service provider oversight is part of the rule because customer information is often handled by software providers, processors, cloud services, call centers, analytics providers, lenders, servicers, and other third parties.

Important areas include:

• designation of a qualified individual;
• written information security program;
• risk assessment;
• safeguards to control identified risks;
• monitoring and testing;
• employee training;
• service provider selection and oversight;
• incident response plan;
• reporting to the board or governing body where required.

Teams should map customer information to systems and service providers. That map should show what information the provider handles, what safeguards are expected, what contract terms apply, what evidence was reviewed, when the provider was last assessed, and what issues remain open.

Security, privacy, procurement, and legal should not operate separately. If a provider stores customer information, the service provider review should connect to the written information security program.

• Written information security program and qualified individual governance records.
• Risk assessment and customer information inventory.
• Service provider inventory tied to customer information access.
• Provider due diligence, contracts, safeguards evidence, and monitoring records.
• Access, encryption, monitoring, testing, training, and incident response evidence.
• Incident response plan, incident records, remediation, and board or governing body reporting.

• Customer information is mapped internally but not connected to service providers.
• Contracts require safeguards, but provider monitoring does not confirm whether safeguards remain

in place.

• Incident response plans do not define service provider responsibilities clearly.
• Security evidence is collected but not tied to the risk assessment.
• Board reporting omits service provider issues affecting customer information.

Halbarad helps teams keep service provider oversight connected to the Safeguards Rule program. It can show which providers handle customer information, what evidence supports their safeguards, what issues exist, and how monitoring is performed.

Halbarad can help teams:

• maintain service provider records tied to customer information;
• collect and refresh safeguards evidence;
• monitor trust centers, incidents, outages, advisories, and provider changes;
• discover downstream providers and concentration exposure;
• track issues, remediation, approvals, reporting, and audit trail.

Halbarad helps document and evidence the work. It does not replace the Safeguards Rule or legal review.