Email security and compliant data transfer

The Gramm-Leach-Bliley Act (GLBA), also known as the Financial Modernization Act, was enacted in 1999 to govern how financial institutions handle and protect customer information. The act requires financial institutions to develop and maintain comprehensive information security programs to safeguard customer data. 

GLBA applies to all financial institutions, including:

• Banks and credit unions
• Insurance companies
• Securities firms
• Mortgage lenders
• Financial service providers

What does GLBA require?

GLBA requires financial institutions to implement various measures to ensure the security and confidentiality of customer information through the application of multiple rules, including: 

1. The privacy rule

Financial institutions must provide customers with clear and concise privacy notices that outline how their personal information is collected, shared, and protected. Customers must have the opportunity to opt-out of certain information sharing practices.

2. Information security program

Financial institutions are obligated to develop and maintain a comprehensive information security program, as described in the ‘Safeguards Rule’. This program should include administrative, technical, and physical safeguards to protect customer information from unauthorized access, use, or disclosure.

3. Risk assessment

Regular risk assessments should be conducted to identify potential vulnerabilities in the security of customer information. Assessments help financial institutions understand the risks they face and implement appropriate security controls.

4. Employee training

Financial institutions must provide ongoing training to employees to ensure they understand their role in protecting customer information. Training should cover security awareness, data handling best practices, and incident response procedures.

5. Incident response

Financial institutions must establish an incident response plan to promptly address security incidents and breaches. The plan should outline procedures for detecting, responding to, and mitigating security incidents, as well as notifying customers and authorities as required.

6. Service provider oversight

Financial institutions must exercise due diligence in selecting and overseeing third-party service providers who have access to customer information. Contracts with these providers should include provisions for data security and privacy.

How to comply with GLBA 

Compliance with GLBA requires a holistic approach to information security. Here are some key steps financial institutions can take to ensure compliance:

1. Conduct regular risk assessments

The objective of GLBA is to protect customer data. Regularly conducting assessments to identify and evaluate potential risks to customer information, including both internal and external threats, is a key step in meeting compliance. Based on assessments, you can then implement appropriate security controls to mitigate identified risks.

2. Information security program

Create a comprehensive program that encompasses administrative, technical, and physical safeguards. This program should address areas such as access controls, data encryption, network security, and employee training.

3. Strong access controls

Control access to customer information through strong authentication mechanisms, user access management, and privileged access controls. Regularly review and update access privileges based on employees' roles and responsibilities.

4. Data encryption

Utilize strong encryption methods to protect customer information, both in transit and at rest. Encryption ensures that even if data is intercepted or accessed unlawfully, it remains unreadable and unusable.

5. A security-first culture

Train employees on data security best practices and the importance of protecting customer information. Encourage a culture of vigilance, where employees are actively involved in identifying and reporting potential security risks.

6. Test and update security controls

Conduct periodic security assessments and penetration tests to evaluate the effectiveness of existing security controls. Stay up to date with industry best practices and emerging threats to ensure continuous improvement of the information security program.

How to meet compliance with GLBA

Gartner reports an increased adoption of Email Data Protection Supplements due to their advanced encryption, authentication and data leak prevention capabilities.

Email data protection supplements support compliance with the GLBA by integrating with existing email solutions (including M365 and Google Workspace) to apply advanced security features.

Driven by machine learning, solutions can read and analyze email content and attachments in real-time. They identify potential errors and risks (and, in effect, policy violations) including incorrect recipients, the presence of sensitive data and more, and provide real-time decision support, enabling employees to apply appropriate security measures.

Next steps for your organization

Achieving and maintaining GLBA compliance requires ongoing effort and a deep understanding of information security best practices. Financial institutions should collaborate with legal and compliance experts, as well as leveraging tech solutions to support employees in protecting sensitive data.

To find out how we can support your organization to meet your requirements under GLBA, GDPR, DORA and more, get in touch.