GLBA
Readiness
The FTC Safeguards Rule turned GLBA from a privacy notice obligation into a prescriptive security programme with named accountability. Financial institutions - defined more broadly than most companies expect - now need a written programme, a qualified individual, and evidence it operates. We run readiness so yours exists.
Who this is for
Readiness earns its cost when something is waiting on the other side of it. These are the situations where it pays for itself.
Financial institutions under the FTC Safeguards Rule, including many non-bank lenders and servicers
Companies who discovered the definition of "financial institution" is broader than they assumed
Organisations who need a qualified individual named and a written programme in place
Teams whose board or regulator has asked for the annual report the rule requires
What the engagement does
Your Lorikeet team runs the assessment, collects and vets the evidence, and keeps control status current. You are not handed a spreadsheet and wished well.
- Confirm whether and how the Safeguards Rule applies to you, which is not always obvious
- Run the risk assessment the rule requires, in writing
- Assess the required safeguards - access controls, encryption, MFA, disposal, change management, monitoring
- Establish the qualified individual role and the reporting line it needs
- Build the service provider oversight the rule requires
- Prepare the written programme and the annual report to your board or governing body
What you walk away with
A written information security programme that satisfies 16 CFR 314, a named qualified individual with real accountability, a documented risk assessment, and the service provider oversight the rule requires. The annual report writes itself from the programme rather than being assembled from memory.
How it runs
Four phases. You always know which one you are in and what is outstanding.
Scoping call
We establish what is in scope, which assessment path applies, and what you already have. It costs nothing, and it ends with a straight answer about whether readiness is the right spend right now.
Assessment
We walk the control set and record where you actually stand, control by control. The gap list lands early so your team can start on the long items while the rest of the assessment continues.
Remediate and evidence
We work the gap list down with your team and collect what each control needs, filed against the control it belongs to with an owner and an expiry date rather than dumped in a folder.
Hand off to your assessor
You go in with a package that maps requirement to control to evidence, and we stay available through the assessment itself.
What the assessment covers
The control areas we walk for GLBA. Each breaks down into individual controls carrying status, owner and evidence in Talon.
GLBA has no certification. The FTC enforces the Safeguards Rule, and your own board or governing body receives the annual report. We build the programme and prepare you for third-party assessments where customers ask for them.
It runs in Talon, not in a spreadsheet
Every control, its status, its owner and its evidence sit in the portal your team already uses, so the readiness picture you see is the one your Lorikeet team is maintaining rather than a copy that went stale a fortnight ago.
- Control-by-control status, kept current by the people doing the work
- Evidence filed against the control it satisfies, with expiry dates tracked
- The auditor request list, so nothing is chased over email
- A readiness view that shows what an assessor would see
Tools like Vanta monitor controls continuously once they exist and work. Readiness is the part before that: deciding the boundary, designing the controls, and closing the gaps a monitoring tool would otherwise report as permanently red. We work alongside them, and we are a Vanta MSP partner.
Our partnersAsked on almost every GLBA call
The FTC definition covers activities that are financial in nature, which sweeps in mortgage brokers, auto dealers arranging financing, payday lenders, tax preparers, collection agencies and more. Many companies caught by it do not think of themselves as financial institutions.
An employee, an affiliate, or a service provider - but if you outsource the role, you retain responsibility and must designate someone senior to oversee it. The role is accountable, not ceremonial.
The rule requires the qualified individual to report to your board or governing body at least annually on the programme status, risk assessment results, and material matters. Having a programme that produces this rather than one that has to be reconstructed is the point of readiness.
Heavily on the technical safeguards - access control, encryption, MFA, logging, vendor management. The GLBA-specific parts are the written programme, the qualified individual, and the reporting obligation.
Rarely run alone
Controls overlap heavily between frameworks, and evidence collected once counts everywhere it applies. A second framework costs a fraction of the first.
GLBA readiness, on your timeline
A scoping call costs nothing and ends with a straight answer: what the work involves, what it costs, and whether you need it yet.
