GLBA Pentest Requirements
GLBA Safeguards Rule penetration testing requirements for financial institutions — what the FTC requires, who qualifies, and how to scope a compliant pentest.
2026-09-03
The FTC's Safeguards Rule (16 CFR Part 314) requires financial institutions to develop, implement, and maintain an information security program — and explicitly mandates penetration testing as part of that program.
Who must comply
The Safeguards Rule applies to any "financial institution" as defined by the Gramm-Leach-Bliley Act. This includes:
- Banks, credit unions, and mortgage brokers
- Non-bank lenders and payday lenders
- Insurance companies and agents
- Securities and commodities firms
- Financial advisors and tax preparers
- Any business significantly engaged in financial activities
What the Safeguards Rule requires for pentesting
The rule requires financial institutions to:
- Conduct periodic penetration testing of their information systems.
- Perform vulnerability assessments regularly.
- Document results and use them to adjust the information security program.
- Involve qualified personnel — internal or external — in testing.
- Address findings in a timely manner.
Scoping your GLBA pentest
Your pentest should cover all information systems that access, process, or store customer information. For most financial institutions, this includes:
- Customer-facing applications (online banking, loan applications, portals)
- Internal financial systems (account management, payment processing)
- APIs connecting to third-party financial services
- Employee workstations and internal networks
- Mobile banking applications
Frequency requirements
The Safeguards Rule requires "periodic" testing. Industry best practice and auditor expectations align with at least annual testing for most financial institutions. Organizations with higher risk profiles or significant change velocity should test more frequently.
Get GLBA compliant
Affordable Pentesting delivers audit-ready reports that satisfy Safeguards Rule requirements. Launch a pentest or view pricing for plans starting at $199 for external IP testing.
Related reading: Fintech Penetration Testing