Does GLBA require an annual security report to your board?

If you are the CCO or COO of an RIA, broker-dealer, dual-registered firm, insurance agency, or family office, year-end is when someone asks whether the security program has to go to the board. Under GLBA, the answer depends on which regulator's rule governs each entity in your firm, and whether you owe a GLBA annual report to the board can differ from one affiliate to the next.

Does GLBA itself require a report to the board?

No. The Gramm-Leach-Bliley Act sets the obligation and leaves the details to regulators. 15 U.S.C. 6801(b) directs the federal agencies and state insurance authorities to establish administrative, technical, and physical safeguards standards for the financial institutions they oversee.

Each regulator wrote its own version, and their board reporting requirements differ. The sections below walk through each one, then give a single report outline that satisfies all of them.

Which GLBA rules require an annual report to the board?

Three of them do, and they use nearly the same wording.

• The FTC Safeguards Rule. 16 CFR 314.4(i) requires the Qualified Individual to "report in writing, regularly and at least annually," to the board or equivalent governing body, or to a senior officer if there is no board. It reaches non-bank financial institutions under the FTC's jurisdiction, including investment advisers that are not required to register with the SEC.
• The banking agencies' Interagency Guidelines. Section III.F of the FDIC's version, 12 CFR part 364, Appendix B, says "Each institution shall report to its board or an appropriate committee of the board at least annually." Section III.A also has the board approve the written program and oversee it.
• The NAIC Insurance Data Security Model Law. Section 4E of Model Law #668 requires a licensee with a board to have executive management report in writing at least annually on the program's status and material matters.

All three ask for the same two things. The report covers the overall status of the information security program and compliance with the rule, then the material matters: risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events and management's responses, and recommendations for changes.

Which firms are exempt from the board report?

Small firms, under two of the three rules. 16 CFR 314.6 exempts a firm that maintains customer information concerning fewer than five thousand consumers from the board report, though not from naming a Qualified Individual. Section 9A of the NAIC model exempts a licensee with fewer than ten employees, including independent contractors, from Section 4 entirely.

The NAIC model only binds licensees in states that adopted it. As of the NAIC's August 2025 status update, 28 jurisdictions had implemented it, and California was not among them. A California insurance agency should check what its own regulator and any other states where it is licensed require.

Does Regulation S-P require a board report?

No. Regulation S-P is the GLBA rule for SEC-registered advisers and broker-dealers, and it requires no board report. 17 CFR 248.30 requires written policies and procedures to safeguard customer information, including an incident response program and service provider oversight, but its text does not name a board, an owner, or an approver. We covered that gap in who should own and sign a Reg S-P program.

Other rules give the security program a route to leadership:

• Advisers Act Rule 206(4)-7 requires an SEC-registered adviser to designate a chief compliance officer and to review its policies and procedures at least annually. Reg S-P policies are part of that review.
• FINRA Rule 3130 requires a broker-dealer's CEO to certify annually, and Supplementary Material .10 says the supporting report "must be provided to the member's board of directors and audit committee in final form." See what technology evidence backs the CEO's signature.
• FINRA Rule 3120 requires an annual report to senior management on supervisory control testing.

A dual-registered firm may sit under several of these at once. A family office that is not registered may fall outside Reg S-P and inside the FTC rule, depending on its structure, which is a question for counsel.

Why write a board report if your rule does not require one?

Because the annual review still has to happen, and a written report is the cleanest record that leadership saw the results. An RIA's annual compliance review and a broker-dealer's Rule 3130 process both ask whether the firm's policies, including its Reg S-P program, are working. A security section built on the same outline the other GLBA rules use answers that question in a form an examiner will recognize.

It also helps in an incident. Reg S-P requires a covered firm to notify affected individuals no later than 30 days after becoming aware of unauthorized access to sensitive customer information, unless it determines that harm is not reasonably likely. The people who make that call should already know the program's gaps, the vendors that hold customer information, and the last test results. A report delivered once a year to the owners or managing partners puts that on the record.

What should a GLBA board report contain?

One page of decisions, backed by attached evidence. This cybersecurity board report outline works under every rule above:

• Cover: which rule or rules the report addresses, the period covered, who prepared it, and the date it was presented.
• Program status: each required element, whether it is in place, and what changed this year.
• Risk assessment: when it was last updated, the top risks, and which were mitigated or accepted.
• Risk and control decisions: exceptions granted, compensating controls, and anything deferred.
• Service providers: vendors that hold customer information, the oversight performed, and contract updates, including the 72-hour breach notice terms Reg S-P now expects in service provider oversight.
• Testing results: penetration tests, vulnerability scans, and phishing exercises, with what was fixed.
• Security events: incidents, the response, and any notices to customers or regulators.
• Recommendations: the decisions, budget, or risk acceptances the board is being asked for.

Keep it short enough to be read in the meeting. The FTC version is covered in more depth in what the Qualified Individual's board report must cover.

What should you do this quarter?

Five steps turn the outline into a finished report before year-end:

• Confirm which GLBA rule governs each entity in your firm, including any affiliated insurance agency or state-registered adviser.
• Name the author. Under the FTC rule it is the Qualified Individual. Under Reg S-P, it is usually the CCO or the person who runs the security program.
• Put the presentation on the board, owners', or management committee agenda now.
• Pull the year's risk assessment, test reports, vendor reviews, and incident log into one folder.
• Record the meeting date, attendees, questions, and decisions, and keep that record with the report.

This article summarizes what the rules say. Which rule applies to your firm, and how, depends on your facts, and your counsel is the right person to confirm.

How s90 helps

s90 manages IT for RIAs, broker-dealers, insurance agencies, and family offices in Los Angeles and Orange County. We keep the vendor records, test results, and incident logs a board report draws on, and our agreements commit us to 72-hour breach notification and 24-hour evidence production. If you want help assembling this year's report, we are glad to talk it through.