GLBA Compliance

As part of the Gramm-Leach-Bliley Act (GLBA), also known as the Financial Modernization Act of 1999, the US government enacted legislation to ensure the protection of customer information. It is mandatory for financial institutions to conduct security risk assessments in order to comply with the GLBA requirements. Financial institutions also need to develop and implement security solutions that effectively detect, prevent, and allow them to respond to incidents in a timely manner. In addition, they are also required to conduct audits and monitoring of the security environment in which they operate.

In order to meet many of the requirements of the GLBA, log data has to be collected, managed, and analyzed. By using Logit.io, many GLBA requirements can be directly met and the cost of complying with others can be dramatically reduced.

With Logit.io, you can monitor activity and conditions on your network in real-time by collecting log data from various hosts, applications, and network devices. Additionally, Logit.io provides you with real-time event monitoring, alerts, and reporting in order to help you stay compliant. Get a free 14-day trial of our compliance software today or schedule a call with our compliance specialists to find out more about how we can help you.

Financial institutions must comply with the GLBA by explaining their information-sharing practices to their customers and by safeguarding sensitive information. This includes companies that offer consumers the opportunity to obtain financial products or services ranging from loans, investment advice, or insurance, just to name a few.

The field of compliance has been expanded to include emerging industries such as fintech, which are also expected to achieve compliance in order to avoid being penalized by fines of up to $100,000 per violation if they fail to do so. As part of this, fines of up to $10,000 per violation could be imposed on the company directors. Further, criminal penalties of up to five years in prison and professional license revocation may also be imposed.

In guideline 2.G.8, it is recommended that users identify whether appropriate logs are maintained and available so that incident detection and response efforts may be supported. Using Logit.io, you can easily maintain, centrally manage and route legacy audit logs to cold storage within Amazon S3, where they will be kept safely. In this way, users will be able to store log data generated around key incidents in the system and be able to access them at any time.

Users should evaluate whether any software they acquire has appropriate security controls, audit trails, and activity logs enabled in order to comply with control 2.H.4. Additionally, they ought to consider whether manual log reviews, can be conducted on a timely and appropriate basis. After all of your system applications have been enabled for logging, Logit.io can then be used to gather and centralise all of the data from all of these applications for further analysis.