Standards note
GLBA penetration testing under the FTC Safeguards Rule
GLBA penetration testing became explicit when the FTC updated its Safeguards Rule. So many non-bank financial institutions now need annual penetration tests, unless they monitor continuously.
- Written scope and rules of engagement
- PTES, OWASP and NIST SP 800-115
- Nothing retained after close
Who GLBA penetration testing applies to
The Gramm-Leach-Bliley Act covers financial institutions broadly. However, the FTC Safeguards Rule applies to non-bank institutions under FTC jurisdiction. For example, mortgage brokers, tax preparers and some fintech firms.
Banks follow their own regulators' guidance. Therefore check which rule applies before scoping.
What the Safeguards Rule asks for
The updated rule names testing directly. Also, it offers an alternative for organisations with continuous monitoring.
| Activity | Expectation |
|---|---|
| Penetration testing | At least annually, based on risk assessment |
| Vulnerability assessments | At least every six months |
| After material changes | Additional testing as needed |
| Continuous monitoring | An alternative to periodic testing |
GLBA penetration testing readiness check
Tick what is in place.
Your result appears here as you tick, so you can see what is still open.
Scoping GLBA penetration testing
Scope follows customer information. So systems that store or process it come first.
- Customer portals and applications
- Internal networks holding customer data
- Remote access paths
- Cloud environments
- Connections to service providers
Evidence and reporting
The rule also expects reporting to the board or a senior officer. Because the qualified individual must report at least annually, test results feed that report. As a result, findings reach decision-makers.
In addition, keep remediation records with each report. The rule text is on the FTC Safeguards Rule page.
How Certus works
Every engagement follows a written scope, PTES and NIST SP 800-115. Full engagements usually settle between $35,000 and $120,000, and the floor is $25,000. The bounded Security Posture Assessment starts at $4,500. Its fee is credited in full against a full engagement commissioned within ninety days.
Also review service providers. Because the rule expects oversight of providers with access to customer information, their testing evidence matters too. So ask key providers how they test, and keep their answers on file.
GLBA penetration testing questions
Is GLBA penetration testing required annually?
Under the FTC Safeguards Rule, yes, unless you use continuous monitoring.
Does GLBA penetration testing apply to banks?
Banks follow their own regulators' guidance, which also expects testing.
What else does GLBA penetration testing sit alongside?
Vulnerability assessments at least every six months.
Who receives the results?
The qualified individual, who reports to the board or a senior officer.
Related guides
Scope GLBA penetration testing properly
Describe the systems that hold customer information. We return a written scope that names each standard, with a fixed fee. Nothing is tested before the owner signs.
Request a written scope