GLBA Penetration Testing: Meeting the FTC Safeguards Rule

Quick answer: GLBA penetration testing is penetration testing performed to meet the security testing requirements of the Gramm-Leach-Bliley Act, most directly the FTC Safeguards Rule. The rule requires covered non-bank financial institutions to either continuously monitor their information systems or run penetration testing at least once a year, plus vulnerability assessments at least every six months and whenever there are material changes. Mortgage companies, lenders, auto dealers that offer financing, tax preparers, collection agencies and many other businesses are covered.

Many organizations do not realize they count as financial institutions under GLBA. If your business provides financial products or services to consumers, such as loans, financing, tax preparation or debt collection, the FTC Safeguards Rule likely applies. The rule was significantly strengthened, with most new requirements taking effect in June 2023, and the FTC added breach notification requirements in 2024.

This guide explains who must comply, what the Safeguards Rule says about testing, how to scope and run GLBA penetration testing, what evidence to keep and how to choose a provider. To discuss testing for your organization, explore Privaxi's financial services cybersecurity services.

What Is GLBA Penetration Testing?

GLBA penetration testing is an authorized security test of the systems that store, process or transmit customer financial information, scoped and documented to support compliance with GLBA safeguards requirements. Qualified testers safely attempt to find and exploit weaknesses in networks, applications, cloud services and remote access, then report the risks and how to fix them. The results become evidence that your information security program is being tested as the rule requires.

For a general introduction to penetration testing, see our guide to penetration testing services.

Who Must Comply With the FTC Safeguards Rule?

The FTC Safeguards Rule applies to non-bank financial institutions under FTC jurisdiction. Examples include:

• Mortgage lenders, brokers and servicers.

• Payday lenders, consumer finance companies and other non-bank lenders.

• Auto dealers that arrange or provide financing or leasing.

• Tax preparation firms and some accounting firms that provide financial services.

• Debt collection agencies and credit counselors.

• Check cashers, money transmitters and wire transfer services.

• Some investment advisers and financial planners not regulated by the SEC.

• Fintech companies offering consumer financial products.

Banks and credit unions follow similar GLBA safeguards requirements issued by their own regulators. For those institutions, see our guides to bank penetration testing and credit union penetration testing. If you are unsure whether the rule applies, confirm with legal counsel.

What the Safeguards Rule Requires for Testing

Organizations that maintain information on fewer than 5,000 consumers are exempt from some requirements, including the testing and monitoring requirement, the written risk assessment, the incident response plan and the annual board report. Even so, testing remains a strong practice for protecting customer data. For a comparison with other frameworks, see penetration testing compliance requirements.

Continuous Monitoring vs Annual Penetration Testing

The rule allows either continuous monitoring or annual penetration testing with six-month vulnerability assessments. Continuous monitoring means having systems that detect changes and vulnerabilities on an ongoing basis, which can be difficult and expensive for smaller organizations to prove. For most businesses, annual GLBA penetration testing combined with regular vulnerability scanning is the clearest and most defensible approach. Some organizations choose both, using continuous monitoring for visibility and annual testing for deeper validation. See our guides to continuous penetration testing and vulnerability assessment services.

What to Include in Scope

• External network: websites, customer portals, email and remote access. See external penetration testing.

• Internal network: office networks, file servers and directory services. See internal penetration testing.

• Customer-facing applications: loan applications, account portals and payment pages. See web application penetration testing.

• APIs and integrations: connections to credit bureaus, lenders, payment processors and CRMs. See API penetration testing.

• Cloud services: cloud-hosted applications, storage and SaaS platforms holding customer data. See cloud penetration testing.

• Remote access: VPNs, remote desktop tools and vendor access paths.

• Multi-factor authentication: confirm MFA is enforced for anyone accessing customer information, as the rule requires.

Focus on every system that stores or accesses customer information. Our guide to penetration testing scope explains how to prioritize.

How a GLBA Penetration Test Works

1. Planning: confirm which systems hold customer information, agree on scope, timing and safety limits.

2. Discovery: map in-scope systems and exposed services.

3. Testing: identify and safely validate weaknesses across networks, applications and cloud services.

4. Impact analysis: rate findings by risk to customer information.

5. Reporting: provide an executive summary for the Qualified Individual and board and technical detail for IT.

6. Remediation and retesting: fix issues and confirm the fixes work.

For more detail, see our overview of penetration testing methodology.

Common Findings for Covered Businesses

• Missing or inconsistent multi-factor authentication on email, remote access and customer data systems.

• Unpatched systems exposed to the internet.

• Customer files stored on shared drives with broad access.

• Weak access controls in loan or customer portals.

• Default or shared administrator passwords.

• Unencrypted customer data in storage or transit.

• Vendor and dealer management systems with unnecessary access.

• Flat office networks where one infected computer can reach everything.

Finding these through GLBA penetration testing lets you fix them before they lead to a breach and a reportable event. For a structured approach, read our guide to penetration testing remediation.

Breach Notification Adds Urgency

Since May 2024, the Safeguards Rule requires covered institutions to notify the FTC within 30 days of discovering a notification event involving the unencrypted information of at least 500 consumers. This makes prevention even more important. Regular testing reduces the chance of an incident and helps you show that reasonable safeguards were in place if one occurs. Encrypting customer data at rest and in transit also matters, because notification is tied to unencrypted information.

Documentation and Evidence to Keep

• The penetration test report with scope, dates, methodology and findings.

• Vulnerability assessment results for each six-month period.

• Remediation records, retest results and any documented risk acceptance.

• Updates to the written risk assessment based on test results.

• The Qualified Individual's annual report to the board or senior officer.

• Records of testing after material changes.

Keeping this evidence organized makes it easier to respond to FTC inquiries, partner due diligence and cyber insurance questionnaires. Store everything in one place so evidence is ready whenever it is needed. Our guide to the penetration testing report explains what each section should include.

Industries Most Affected

• Auto dealers: dealer management systems, F&I offices and credit application portals hold sensitive customer data.

• Mortgage and lending: loan origination systems and document portals contain full financial profiles.

• Tax preparers: tax software and client portals hold Social Security numbers and income data.

• Collections: collection platforms hold account and contact data. See Privaxi's collections and receivables security services.

• Fintech: consumer financial apps and APIs. See fintech penetration testing.

How Often Should You Test?

The Safeguards Rule requires GLBA penetration testing at least annually, unless you use continuous monitoring, and vulnerability assessments at least every six months. You should also test after material changes, such as new systems, cloud migrations, office moves or acquisitions. Put these dates on a shared calendar so nothing is missed. See annual penetration testing for planning tips.

Choosing a GLBA Penetration Testing Provider

• Experience with the FTC Safeguards Rule and non-bank financial institutions.

• Ability to test networks, applications, cloud services and vendor access.

• Clear reports suitable for the Qualified Individual and board reporting.

• Vulnerability assessment support for the six-month requirement.

• Retesting included to confirm fixes.

• Practical guidance for small and mid-sized IT teams.

Our guide to choosing a penetration testing company lists more questions to ask.

Cost of GLBA Penetration Testing

The cost of GLBA penetration testing depends on the number of locations, networks, applications and cloud services that hold customer information, and whether vulnerability assessments and retesting are included. Small businesses with simple environments usually need less effort than multi-location lenders or dealer groups. Combining annual testing with semiannual scanning in one program can reduce cost and simplify compliance. For pricing factors, see penetration testing cost.

Preparing for a Test

1. Confirm which systems store or access customer information.

2. Name the Qualified Individual and technical contacts.

3. Share network diagrams, application lists and vendor access details.

4. Create test accounts for customer portals and staff applications.

5. Notify IT providers and managed security partners of testing windows.

6. Plan remediation and retesting before the next board report.

Common Mistakes to Avoid

• Assuming GLBA only applies to banks.

• Relying on vulnerability scans alone instead of a penetration test.

• Leaving cloud and SaaS systems that hold customer data out of scope.

• Not testing after material changes.

• Failing to document remediation and retesting.

• Ignoring vendor and dealer system access.

Building a Compliant, Sustainable Program

The strongest programs combine annual GLBA penetration testing, six-month vulnerability assessments, enforced multi-factor authentication, encryption, access reviews, staff training and a tested incident response plan. The Qualified Individual tracks results over time and reports progress to leadership. This approach meets the rule and builds real protection for customer information. For related guidance, see our article on financial services penetration testing.

The Role of the Qualified Individual

The Safeguards Rule requires each covered institution to name a Qualified Individual who oversees and enforces the information security program. This person can be an employee or a service provider, but the institution remains responsible for compliance. The Qualified Individual should own the testing calendar, approve the scope of each GLBA penetration testing engagement, track remediation and include results in the written report to the board or senior officer at least annually.

When the Qualified Individual is an outside provider, such as a virtual CISO, make sure someone inside the business still has clear oversight and receives testing results directly. The rule expects institutions to supervise service providers, so documented testing and clear reporting lines help demonstrate that oversight. For more on outside security leadership, see our article on what a vCISO does.

Frequently Asked Questions About GLBA Penetration Testing

What is GLBA penetration testing?

GLBA penetration testing is penetration testing scoped and documented to meet the GLBA safeguards requirements, most directly the FTC Safeguards Rule's testing and monitoring requirement.

Does the FTC Safeguards Rule require penetration testing?

Yes. Covered institutions must either continuously monitor their systems or perform penetration testing at least annually, plus vulnerability assessments at least every six months.

Who must comply with the FTC Safeguards Rule?

Non-bank financial institutions under FTC jurisdiction, such as mortgage companies, lenders, auto dealers that offer financing, tax preparers and collection agencies.

Are small businesses exempt?

Institutions that maintain information on fewer than 5,000 consumers are exempt from some requirements, including the testing and monitoring requirement, but testing is still strongly recommended.

When must breaches be reported to the FTC?

Covered institutions must notify the FTC within 30 days of discovering a notification event involving the unencrypted information of at least 500 consumers.

How often should GLBA penetration testing be performed?

At least annually, plus vulnerability assessments every six months and testing after material changes to systems or operations.

Final Thoughts

GLBA penetration testing helps non-bank financial institutions meet the FTC Safeguards Rule and protect customer information. Confirm whether the rule applies, scope testing around customer data, run annual penetration tests and six-month vulnerability assessments, fix and retest findings, and keep clear evidence for your Qualified Individual and board.

To plan GLBA penetration testing for your organization, explore Privaxi's financial services cybersecurity services.