GLBA encryption requirements: how do you prove them to an examiner?

An examiner asks for proof that client data is encrypted, and the answer sits in a device console, a backup portal and a folder of vendor security pages. For a CCO or COO at an RIA, broker-dealer or dual-registered firm, GLBA encryption requirements turn on which regulator's rule applies. Passing the exam turns on dated evidence that encryption is required, turned on and checked.

Does GLBA require encryption?

The statute does not name encryption. Whether you must encrypt depends on the rule that implements GLBA for your firm. GLBA section 501(b) directs each regulator to set standards for safeguarding customer records and information, and each wrote its own rule:

• The FTC Safeguards Rule (16 CFR part 314), which covers financial institutions under FTC jurisdiction, including investment advisers that are not required to register with the SEC.
• Regulation S-P (17 CFR part 248), which covers SEC-registered investment advisers, broker-dealers, investment companies and transfer agents.
• The banking agencies' Interagency Guidelines, which cover banks, including bank-chartered trust companies.

The FTC rule makes encryption mandatory unless it is infeasible. Reg S-P and the Interagency Guidelines leave the choice of controls to the firm, and expect the firm to justify it.

What does the FTC Safeguards Rule require?

16 CFR 314.4(c)(3) requires a covered firm to protect by encryption all customer information it holds or transmits, both in transit over external networks and at rest. If the firm determines encryption is infeasible, it may instead use "effective alternative compensating controls reviewed and approved by your Qualified Individual."

The rule also defines what counts. Under 16 CFR 314.2(f), encryption means transforming data so there is "a low probability of assigning meaning" without a protective process or key, "consistent with current cryptographic standards and accompanied by appropriate safeguards for cryptographic key material." Encryption also shapes breach reporting. A "notification event" is acquisition of unencrypted customer information without authorization, and information "is considered unencrypted for this purpose if the encryption key was accessed by an unauthorized person." Under section 314.4(j), a notification event involving the information of at least 500 consumers must be reported to the FTC.

How does encryption fit Reg S-P for SEC-registered firms?

Reg S-P does not list encryption as a required control. It still matters in two places. First, 17 CFR 248.30(a)(1) requires written policies and procedures that address "administrative, technical, and physical safeguards for the protection of customer information," reasonably designed to protect against unauthorized access or use. Encryption of devices, email and backups is among the first technical safeguards an examiner will ask about.

Second, encryption affects the customer notice decision. In the 2024 adopting release, the SEC said a firm might conclude harm is "not reasonably likely based on the use of encryption in accordance with industry standards," and that if "the encryption is compromised or it is discovered that the decryption key was also obtained by the threat actor," the firm "generally should revisit its determination." The final rule text does not mention encryption and offers no safe harbor for it, so the firm still has to investigate and document its conclusion.

The amended rule now applies to every SEC-registered firm. Under the SEC's fact sheet, larger entities had 18 months and smaller entities 24 months from Federal Register publication on June 3, 2024, which set compliance dates of December 3, 2025 and June 3, 2026. For what examiners have requested since, see what SEC examiners are asking for on Reg S-P.

For banks, including bank-chartered trust companies, the Interagency Guidelines list "encryption of electronic customer information, including while in transit or in storage on networks or systems to which unauthorized individuals may have access" among the measures each institution must consider.

What do encryption at rest and in transit cover in practice?

At rest means anywhere customer information is stored. In transit means any time it moves across a network you do not control. In a typical advisory or brokerage office, that includes:

• Laptops and desktops, through full-disk encryption such as BitLocker on Windows or FileVault on macOS.
• Phones and tablets that hold email or client files, with device encryption enforced through mobile device management.
• Servers, network storage and backups, including offsite and cloud backup copies.
• Cloud platforms such as Microsoft 365, CRM and portfolio systems, where the vendor encrypts storage and you keep its documentation.
• Email, through TLS between mail servers plus message encryption or a secure portal for sensitive attachments.
• File transfer and client portals, served only over HTTPS.
• Remote access, through a VPN or zero trust access service rather than remote desktop exposed to the internet.

For transport settings, NIST's SP 800-52 Rev. 2 is a useful reference. It requires government TLS servers and clients to support TLS 1.2 with FIPS-based cipher suites and to support TLS 1.3 by January 1, 2024. It is written for federal systems. For a private firm it is a defensible benchmark for "current cryptographic standards."

What evidence proves you meet GLBA encryption requirements?

Examiners want proof that encryption is required by policy, turned on, and checked. A strong evidence set includes:

• The written policy or information security plan section that sets the encryption standard for devices, email, backups and file transfer.
• A device compliance report showing encryption status for every laptop, desktop and mobile device, with exceptions named.
• Records showing where BitLocker or FileVault recovery keys are escrowed and who can access them.
• Vendor documentation, such as SOC 2 reports or security pages, confirming encryption for each cloud system that holds customer information. SEC-registered firms should file it with their Reg S-P service provider oversight records.
• Mail configuration showing TLS enforcement, and the procedure staff follow to send sensitive attachments.
• Backup job settings showing encryption is enabled.
• For FTC-covered firms, written compensating control approvals from the Qualified Individual for anything that cannot be encrypted.
• Dates on everything, refreshed on a schedule, so the evidence covers the exam period.

Key management deserves its own page in the binder. The FTC definition and the SEC's adopting release both treat a compromised key as undoing the protection, so show how keys are stored, who can reach them, and how access is logged.

How do you document an exception?

Name the system, explain why encryption is infeasible, describe the compensating controls, and record who approved them and when. Under the FTC rule, the Qualified Individual must review and approve the compensating controls. Common examples are a legacy scanner, a specialty application or an older phone system. Compensating controls often include network segmentation, restricted access, added logging and a target date to replace the system. Revisit each exception at least once a year and whenever the system changes, and raise open exceptions in the Qualified Individual's annual board report.

What should you do this quarter?

• Pull an encryption compliance report from your device management tool and fix every device that is not encrypted.
• Confirm where recovery keys are stored and limit who can retrieve them.
• List every cloud system that holds customer information and file each vendor's encryption documentation.
• Test that sensitive attachments go out through message encryption or a secure portal.
• Write up any exception and get it approved by your Qualified Individual or CCO.
• Add the dated evidence to your exam binder.

How can s90 help?

s90 enforces encryption across the devices and systems we manage and keeps the reports that prove it. Our agreements commit us to produce evidence within 24 hours of a request and to notify clients within 72 hours of a breach affecting systems we manage. If an exam is on your calendar, we can help you review your encryption evidence before the examiner does.