GLBA
What is GLBA?
The Gramm-Leach-Bliley Act (GLBA, also known as the Financial Services Modernization Act of 1999, Public Law 106-102) is a US federal statute enacted 12 November 1999 that imposes privacy + safeguarding + anti-pretexting obligations on FINANCIAL INSTITUTIONS handling nonpublic personal information (NPI). KEY PROVISIONS: (a) SUBCHAPTER I - DISCLOSURE OF NONPUBLIC PERSONAL INFORMATION (15 USC 6801-6809): policy of privacy obligation + safeguarding standard (Sec. It comprises 10 controls organised across 2 domains, and applies in the United States.
How GLBA maps to other frameworks
All 10 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 2 domains GLBA groups its controls into
Frameworks that share controls with GLBA
Each of these has at least one control mapped to a control in GLBA. The number is how many GLBA controls are shared, counted from the mapping graph.
Protective Security Policy Framework (PSPF) Release 2024
4 shared controlsOWASP DevSecOps Maturity Model (DSOMM)
4 shared controlsHKMA Cyber Resilience Assessment Framework (C-RAF)
4 shared controlsFFIEC IT Examination Handbook
4 shared controlsFTC GLBA Safeguards Rule (16 CFR Part 314)
4 shared controlsAnnex 11 to EU GMP - Computerised Systems
4 shared controlsNIST SP 800-171A Rev 3 - Assessing CUI Security Requirements
4 shared controlsBahrain PDPL
3 shared controlsWhere GLBA overlaps with the standards you already hold
Where to get trained on GLBA
4 courses in the catalogue cover GLBA directly. Each is self-paced, includes the downloadable toolkit and the implementation playbook, and carries a certificate of completion.
Training more than one person? Ten seats of any course is $1,490 on a single licence, against $199 a seat bought one at a time.
What an auditor will ask you for
All 12 GLBA controls, each with what it requires, the artefacts an auditor will ask you for, and where it commonly fails. Free to read, nothing to fill in.
Read the GLBA evidence request listWhat GLBA means in your sector
What GLBA means for your job
Questions people ask about GLBA
What is GLBA?
How many controls does GLBA have?
Where does GLBA apply?
What frameworks does GLBA map to?
How do I get started with GLBA compliance?
Query GLBA programmatically
GLBA, its 10 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
GLBA API reference and MCP config →What GLBA requires, control by control
Each page carries the requirement text for one GLBA control and what an assessor expects to see as evidence.
- GLBA-IMPLEMENTATION-ROADMAP-EXAMINATION GLBA Implementation Roadmap, Examination Readiness, Roles and Tooling
- GLBA-SEC6801-POLICYDUTY-SAFEGUARDINGSTANDARD GLBA Section 6801 - Privacy Obligation Policy and Safeguarding Standard
- GLBA-STATUS-FTC-CFPB-SEC-NAIC-ENFORCEMENT GLBA Status, Enforcement Activity, FTC + CFPB + SEC + NAIC Recent Actions
- GLBA-SUBORDINATE-RULES-OPERATIONALISATION GLBA Operationalisation through FTC Safeguards Rule, Privacy Rule, SEC Reg S-P and Banking-Agency Guidelines
How ready are you for GLBA?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.