The GLBA Safeguards Rule, codified at 16 CFR Part 314, is the Federal Trade Commission's implementation of Section 501(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801(b)). That section directs the federal financial regulators and the FTC to set standards for safeguarding customer information. The FTC's original rule dates to 2003. A substantially rewritten version was published on December 9, 2021 (86 FR 70272) and took effect January 10, 2022. Certain new elements listed in Section 314.5 were first scheduled for December 9, 2022; a November 23, 2022 final rule delayed that applicability date to June 9, 2023. A further amendment, published November 13, 2023 and effective May 13, 2024, added the FTC notification duty in Section 314.4(j).
Section 314.1(b) limits the rule to financial institutions over which the FTC has jurisdiction: institutions whose business is an activity that is financial in nature, or incidental to such an activity, under section 4(k) of the Bank Holding Company Act, and that are not already subject to another regulator's enforcement authority under GLBA section 505 (15 U.S.C. 6805). The section's own "include, but are not limited to" list names mortgage lenders, payday lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, travel agencies operated in connection with financial services, collection agencies, credit counselors and other financial advisors, tax preparation firms, non-federally insured credit unions, investment advisers that are not required to register with the SEC, and entities acting as finders. Section 314.2 then gives its own examples. One of them is an automobile dealership that, as a usual part of its business, leases automobiles on a nonoperating basis for longer than 90 days, and only with respect to that leasing business. The example is leasing. It is not arranging financing. Another is a company acting as a finder that brings buyers and sellers together for transactions the parties themselves negotiate and consummate. Banks, savings associations, and federally insured credit unions are outside the FTC rule because their prudential regulators enforce parallel Interagency Guidelines under the same Section 501(b) authority. Broker-dealers, investment companies, and investment advisers required to register with the SEC fall under the SEC's Regulation S-P instead.
A service provider, per the same Section 314.2 definition, is any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a financial institution subject to this part. The test is direct access to customer information, not the vendor's industry label.
Section 314.4(f): the three-part service-provider duty
Section 314.4 lists ten required elements of an information security program, lettered (a) through (j). Service-provider oversight is (f), and it is stated as three discrete duties rather than one general outcome:
| Section | What it requires |
|---|---|
| 314.4(f)(1) | Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue. |
| 314.4(f)(2) | Requiring service providers, by contract, to implement and maintain those safeguards. |
| 314.4(f)(3) | Periodically assessing service providers based on the risk they present and the continued adequacy of their safeguards. |
Read against a regime like NYDFS Part 500 or PCI DSS, 314.4(f) is thin on contract mechanics. It does not enumerate required clauses the way Section 500.11(b) does, and it leaves "reasonable steps" and "periodically" undefined rather than fixing a cadence. The Safeguards Rule is built around a risk-based program the Qualified Individual required under 314.4(a) designs and defends, not a fixed checklist. A financial institution still has to document what reasonable selection and periodic reassessment mean for a given vendor, rather than reading those judgments off the regulation's text.
Section 314.4(a): the institution keeps responsibility when the security lead is outside
Section 314.4(f) is not the only service-provider duty. Section 314.4(a) requires the institution to designate a Qualified Individual to oversee and enforce the information security program. That person may be employed by the institution, an affiliate, or a service provider. When a service provider or an affiliate fills the role, the institution shall:
- Retain responsibility for compliance with Part 314.
- Designate a senior member of its own personnel to direct and oversee the Qualified Individual.
- Require the service provider or affiliate to maintain an information security program that protects the institution in accordance with Part 314.
Outsourcing the security lead does not outsource the rule. The institution remains the party that has to comply, and a senior person inside the institution has to direct and oversee the outside Qualified Individual.
The 5,000-consumer exception that does not reach service-provider oversight
Section 314.6 says that Sections 314.4(b)(1), (d)(2), (h), and (i) do not apply to a financial institution that maintains customer information concerning fewer than 5,000 consumers. Those four provisions are the written risk assessment, the annual penetration test and semiannual vulnerability assessment that apply when continuous monitoring is not in place, the written incident response plan, and the annual report to the board. Section 314.4(f) is not on that list, and neither is Section 314.4(a) or Section 314.4(j). An institution thin enough to qualify for the exception on those four items still has to select capable service providers, bind them by contract, and periodically reassess them. If a service provider supplies the Qualified Individual, the institution still keeps 314.4(a) responsibility. The same pattern shows up in NYDFS Part 500's small-business exemption, which trims internal documentation without excusing vendor oversight.
Where 314.4(f) meets the notification requirement
The November 13, 2023 amendment, effective May 13, 2024, added Section 314.4(j). Upon discovery of a notification event that involves the information of at least 500 consumers, the institution must notify the FTC as soon as possible, and no later than 30 days after discovery, electronically on a form on the FTC's website. Section 314.2 defines a notification event as the acquisition of unencrypted customer information without the authorization of the individual to whom the information pertains. Customer information is unencrypted for this purpose if the encryption key was accessed by an unauthorized person. Unauthorized acquisition is presumed from unauthorized access unless the institution has reliable evidence that there has not been, or could not reasonably have been, unauthorized acquisition. The same section defines customer information as any record containing nonpublic personal information about a customer, whether in paper, electronic, or other form, that is handled or maintained by or on behalf of the institution or its affiliates. An unauthorized acquisition inside a service provider can therefore be a notification event for the institution.
The 30 days run from discovery, not from the acquisition itself. Section 314.4(j)(2) treats a notification event as discovered on the first day it is known to the institution. The institution is deemed to know once any person, other than the person committing the breach, who is its employee, officer, or other agent knows of the event. A compromise at a service provider does not start the clock before an employee, officer, or other agent of the institution knows. A notice obligation in the Section 314.4(f)(2) contract is how the institution arranges to be told, and Section 314.4(f)(3) periodic assessment is how it checks that the safeguards still hold. Those duties are what put the institution in a position to discover the event and then meet the 30 days. They do not start the clock earlier than that knowledge.
Turning Section 314.4(f) into TPRM actions
- Scope the service-provider inventory to the Section 314.2 access test - receives, maintains, processes, or otherwise is permitted access to customer information, through services provided directly to the institution - rather than to a vendor's self-described category. See vendor tiering.
- If a service provider supplies the Qualified Individual, keep the Section 314.4(a) file. The institution still owns compliance, a senior member of its own personnel directs and oversees that person, and the provider must maintain an information security program that protects the institution.
- Do not rely on the Section 314.6 exception to skip Section 314.4(f). Confirm the selection step, the contract, and the periodic reassessment are in place even when the written risk assessment, the testing fallback, the incident response plan, and the board report are excused.
- Put a notice term in the Section 314.4(f)(2) contract with an actual time bound. The institution's 30-day period starts when an employee, officer, or other agent knows, so a vendor that is slow to speak delays discovery and compresses the time left to notify the FTC.
- Make Section 314.4(f)(3) reassessment continuous where the vendor's risk warrants it, rather than defaulting to a review that leaves most of the year uncovered. See continuous vendor monitoring.
- Treat Section 314.4(f)(1) selection as a pre-contract gate, evaluated against evidence of a prospective provider's actual safeguards rather than a self-reported claim of compliance.
Where this sits among TPRM platforms
Holding the Section 314.4(f) selection record, the contract-clause library, and the Qualified Individual oversight file is governance workflow that questionnaire and GRC platforms are built to manage well. What that library does not tell a program is whether a service provider's actual, current environment still matches what the last Section 314.4(f)(3) reassessment described - the same gap this cluster covers generally in evidence-based risk scoring, where externally observed security-rating signal fills in what a filed assessment cannot. Rescana is Fully Autonomous with human in the loop based on preference, pairing that continuous, evidence-based monitoring with automated evidence collection, so a Section 314.4(f)(3) reassessment checks current signal rather than a document that was accurate on the day it was collected.
Frequently asked questions
What does the GLBA Safeguards Rule require for third-party service providers?
Section 314.4 lists ten required elements of an information security program, lettered (a) through (j). Service-provider oversight is element (f). A covered financial institution must take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards for the customer information at issue; require those service providers, by contract, to implement and maintain such safeguards; and periodically assess them based on the risk they present and the continued adequacy of their safeguards. Separately, element (a) allows the required Qualified Individual to be employed by a service provider, but the institution must still retain responsibility for compliance with Part 314, designate a senior member of its own personnel to direct and oversee that person, and require the service provider to maintain an information security program that protects the institution. The rule does not enumerate specific contract clauses the way some state regulations do. It leaves the institution to document what reasonable selection and periodic reassessment mean for a given vendor.
Does the GLBA Safeguards Rule apply to banks?
Not the FTC's rule at 16 CFR Part 314. Section 314.1(b) limits that rule to financial institutions over which the Commission has enforcement jurisdiction, and excludes institutions already subject to another regulator under GLBA section 505, 15 U.S.C. 6805. The FTC's own scope list includes mortgage lenders, payday lenders, finance companies, mortgage brokers, check cashers, wire transferors, collection agencies, tax preparation firms, non-federally insured credit unions, and entities acting as finders. Banks, savings associations, and federally insured credit unions are covered instead by parallel Interagency Guidelines that their prudential regulators (the OCC, the Federal Reserve, the FDIC, and the NCUA) issue under the same Section 501(b) authority. Broker-dealers, investment companies, and investment advisers required to register with the SEC fall under the SEC's Regulation S-P. An automobile dealership is a financial institution under Section 314.2 only with respect to leasing automobiles on a nonoperating basis for longer than 90 days, not because it arranges financing.
Are small financial institutions exempt from GLBA Safeguards Rule service-provider oversight?
No. Section 314.6 says that Sections 314.4(b)(1), (d)(2), (h), and (i) do not apply to an institution that maintains customer information concerning fewer than 5,000 consumers. Those items are the written risk assessment, the annual penetration test and semiannual vulnerability assessment used when continuous monitoring is absent, the written incident response plan, and the annual board report. Section 314.4(f) is not on that list, and neither is Section 314.4(a). Even an excepted institution still has to select capable service providers, bind them by contract, and periodically reassess them, and it still keeps responsibility if a service provider supplies the Qualified Individual.
Does the GLBA Safeguards Rule breach notification requirement cover an incident at a service provider?
It can be the event. It does not, by itself, start the clock. Section 314.4(j), added by a 2023 amendment effective May 13, 2024, requires notice to the FTC as soon as possible and no later than 30 days after discovery of a notification event involving the information of at least 500 consumers. A notification event is the unauthorized acquisition of unencrypted customer information. Section 314.2 defines customer information to include records handled or maintained by or on behalf of the institution, so an incident inside a service provider can be a notification event. Section 314.4(j)(2) treats the event as discovered on the first day it is known to the institution, and deems the institution to know once an employee, officer, or other agent knows. The 30 days run from that knowledge. They do not run from a moment before any employee, officer, or agent of the institution knows. A contractual notice term under Section 314.4(f)(2) is how the institution arranges to learn of the vendor incident in time to meet the clock.