Financial institutions operate under some of the most demanding cybersecurity rules of any industry. Banks, credit unions, wealth management firms, insurance agencies, mortgage companies, and tax preparers all handle data that regulators expect to be protected with care. Requirements differ depending on the type of institution, but the core expectations are remarkably consistent.
Here is an overview of the main regulations and what they require in practice. This is general information, not legal advice, so confirm the specific rules that apply to your organization with your compliance team or counsel.
The Gramm-Leach-Bliley Act (GLBA)
GLBA requires financial institutions to protect customers’ nonpublic personal information. Its Safeguards Rule, enforced by the FTC for many non-bank financial companies, spells out specific security requirements, including:
- A designated qualified individual responsible for the information security program
- A written risk assessment
- Access controls and multi-factor authentication for anyone accessing customer information
- Encryption of customer information in transit and at rest
- Continuous monitoring or annual penetration testing with vulnerability assessments
- Security awareness training for staff
- Oversight of service providers
- A written incident response plan
- Regular reports to the board or senior leadership
Our SEC and FTC Safeguards support helps firms put these controls in place and document them.
FFIEC Guidance For Banks And Credit Unions
Banks and credit unions are examined using guidance from the Federal Financial Institutions Examination Council (FFIEC) and their primary regulators. Examiners look at governance, risk management, access controls, vendor management, business continuity, and incident response. Credit unions are also subject to NCUA requirements, including incident reporting timelines.
SEC Rules For Investment Advisers And Public Companies
Registered investment advisers and broker-dealers must have written policies to protect customer records under Regulation S-P, which has been updated to include incident response and customer notification requirements. Public companies must also disclose material cybersecurity incidents and describe their cybersecurity risk management in annual filings.
PCI DSS
Any institution that stores, processes, or transmits payment card data must comply with the Payment Card Industry Data Security Standard. PCI DSS includes network segmentation, encryption, logging, vulnerability scanning, and regular testing.
State Laws
Many states have their own data protection and breach notification laws. Michigan’s Identity Theft Protection Act requires notification when certain personal information is compromised. Firms that serve clients in multiple states need to understand several sets of requirements.
Common Themes Across All Regulations
While the details vary, nearly every framework expects the same foundation:
- A written information security program with clear ownership
- Risk assessments performed and updated regularly
- Strong access control, including MFA
- Encryption of sensitive data
- Monitoring and logging to detect suspicious activity
- Vendor oversight for any third party touching customer data
- Incident response and business continuity plans that are tested
- Employee training on phishing and data handling
Where Smaller Financial Firms Struggle
Large banks have dedicated security teams. Smaller firms, such as independent advisers, insurance agencies, and community credit unions, often rely on one IT person or an outside provider. The most common gaps are missing documentation, inconsistent MFA, lack of log monitoring, and vendor reviews that never happened.
Turning Requirements Into A Plan
Start with a gap assessment against the regulations that apply to you. Prioritize the controls regulators focus on most, such as MFA, encryption, monitoring, and incident response. Then build a calendar for recurring tasks like access reviews, training, and testing so compliance stays current instead of becoming a scramble before each exam.
CTS Companies provides cybersecurity services for financial services firms in Michigan, along with managed compliance services that keep your controls and documentation current. Talk to an expert about where your firm stands.