Main content
The FTC Safeguards Rule puts the Gramm-Leach-Bliley Act into practice for non-bank financial institutions. Unless you run effective continuous monitoring, it requires a penetration test of your information systems every year and vulnerability assessments at least every six months (16 CFR 314.4(d)(2)).
Coastline tests the systems that hold your customers’ financial information, so you can show the testing was done and fix what matters before an attacker finds it.
We scope each engagement around the systems that store or process customer information. Every GLBA engagement can include:
How far an attacker gets from a single compromised workstation or account, including access to customer records.
Remote access, email and internet-facing systems, tested for the weaknesses attackers exploit first.
Loan applications, payment portals and customer logins, tested for broken access control and data exposure.
Findings show how each issue puts customer information at risk, so you can feed them into the written risk assessment the rule requires.
A report with every finding, its risk and how to fix it, ready for your Qualified Individual’s annual report to your board, which must cover the results of testing (16 CFR 314.4(i)).
Related: external penetration testing and internal penetration testing.
Yes, unless you run effective continuous monitoring. The rule requires a penetration test every year and vulnerability assessments at least every six months, plus assessments after material changes to your operations (16 CFR 314.4(d)(2)).
Non-bank financial institutions under FTC jurisdiction. The FTC lists examples such as mortgage lenders and brokers, payday lenders, finance companies, check cashers, wire transferors, collection agencies, tax preparation firms and some investment advisors. Auto dealers that offer financing or leasing are covered too.
Partly. If you hold customer information on fewer than 5,000 consumers, the annual penetration testing requirement does not apply (16 CFR 314.6). The rest of the rule still does.
No. The rule lists vulnerability assessments every six months and penetration testing every year as separate requirements, so you need both unless you run continuous monitoring.
Federally insured banks and credit unions follow their own federal regulators’ GLBA guidelines rather than the FTC rule. Examiners still expect regular testing, and the same engagement covers it.
If an incident exposes unencrypted information on 500 or more consumers, the rule requires you to notify the FTC within 30 days of discovering it (16 CFR 314.4(j)). Testing first helps you find those gaps before an attacker does.