GLBA for Smaller Financial Firms: The IT Obligations
The Gramm-Leach-Bliley Act governs how financial institutions handle customer financial information. Most firms are familiar with the privacy notice requirement — the annual document customers receive and rarely read.
The part examined more closely is the Safeguards requirement: an actual information security programme, with controls, documentation and accountability. This is an orientation, not legal advice.
Who it reaches
Broader than banks. Investment advisers, broker-dealers, mortgage brokers and lenders, consumer lenders, tax preparers offering financial services, insurance providers, debt collectors and others handling consumer financial information.
Note that different regulators administer it for different firm types — the SEC for registered advisers, the FTC for many others, state regulators in some cases. The underlying expectations are similar; the examination process and the specific rule text differ. Know which applies to you.
What "customer information" covers
Broader than account numbers. Names and addresses collected in connection with a financial service, Social Security numbers, account balances, transaction history, credit information, and information obtained from a consumer report.
It includes information about people who did not become customers — a declined application contains customer information and attracts obligations. Firms routinely retain unsuccessful applications indefinitely without having decided to.
The programme elements
A designated individual accountable for the security programme. Named, with authority.
A written risk assessment, periodic, identifying risks to customer information and evaluating whether existing safeguards address them. This is the foundation document and the first thing asked for.
Safeguards addressing the identified risks, specifically including:
- Access controls, reviewed periodically — who can reach customer information and why
- An inventory of data, systems and devices
- Encryption in transit and at rest, with compensating controls documented and approved where encryption is infeasible
- Multi-factor authentication for access to information systems
- Secure disposal of customer information no longer needed
- Change management
- Monitoring and logging of authorised user activity
Testing — continuous monitoring, or periodic penetration testing and vulnerability assessment on a defined cadence.
Training for staff.
Service provider oversight — selection, contractual requirements, and ongoing assessment.
An incident response plan, written.
Periodic reporting to the board or a senior officer.
Where smaller firms typically fall short
MFA deployed partially. On email, missing on the portfolio management system, the custodian portal, or the CRM holding client financial detail. The requirement is for information systems, not just email.
Encryption assumed. Laptop disk encryption is common; encryption of the file server, the backup drive, and the archive is often not. Check each store rather than assuming.
Personal devices and email. Advisers working from personal laptops, client documents in personal email, spreadsheets on home machines. This is the most common real-world exposure in small advisory firms and it is rarely in the risk assessment.
Vendor oversight never performed. Providers were chosen; nobody assessed them since. The obligation is ongoing, and for firms using a custodian, a portfolio system and an outsourced IT provider, that is three relationships needing documented review.
Disposal not implemented. Declined applications, former client records and old backups retained forever because no retention schedule exists.
No tested incident response. A document exists; nobody has walked through it.
Texting and messaging. Advisers communicating with clients by text or messaging apps, outside any archiving or supervision arrangement. This intersects with recordkeeping obligations as well as security, and it has been an active enforcement area.
Practical priorities
If you are starting from a weak position, in order:
- Inventory where customer information actually lives. Include personal devices, email, cloud storage and anything a staff member set up independently. This is the step that reveals the real problem.
- MFA everywhere, prioritising whatever holds client financial data.
- Encryption on every store identified in step one.
- Written risk assessment against that inventory.
- Service provider list, contracts checked for security terms, assessments scheduled.
- Retention and disposal schedule, implemented rather than written.
- Incident response plan, then a tabletop exercise against it.
- Address messaging and personal device use with a policy that is enforceable and enforced.
The documentation point
Examinations are conducted on documents. A firm with good practices and no documentation presents worse than a firm with average practices and good records.
Keep: the risk assessment with dates, access review records, training completion, vendor assessments, testing results, incident log including minor events, and the periodic report.
None of it is onerous once it is routine. All of it is awkward to reconstruct under examination, which is exactly when it is requested.
