{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/us/agent/glba/controls",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-08-25",
    "proof": "sha256:b2d8ae095cfc76369c0d9edd9bbc310d1e93f617479567a04aea3389789a5002",
    "jurisdiction": "eu"
  },
  "layer": "us-agent-section",
  "agent": "glba",
  "slug": "controls",
  "title": "Safeguards",
  "reference": "16 CFR 314.4(c)",
  "scope": "Access controls, encryption, multi-factor authentication, disposal and change management.",
  "rule": "glba-safeguards-rule",
  "identifier": "16 CFR Part 314",
  "jurisdiction_scope": [
    "federal"
  ],
  "risk_dimensions": [
    "privacy",
    "security",
    "financial"
  ],
  "tier": 1,
  "deterministic": true,
  "llm_used": false,
  "verdict_kind": "machine-classification",
  "official_source": "https://www.ecfr.gov/current/title-16/section-314.4",
  "register_source": "https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314",
  "cited_by": [
    {
      "ruleId": "glba-qualified",
      "code": "glba-qualified-missing",
      "title": "Ansvarig för programmet är inte utsedd",
      "titleEn": "No qualified individual is designated",
      "verdict": "risk",
      "audit": "KRAV_GÄLLER",
      "obligation": "16 CFR 314.4(a) kräver att en kvalificerad person utses att ansvara för programmet, och 16 CFR 314.4(i) kräver rapportering till styrelsen eller motsvarande.",
      "obligationEn": "16 CFR 314.4(a) requires designating a qualified individual responsible for the program, and 16 CFR 314.4(i) requires reporting to the board or equivalent."
    },
    {
      "ruleId": "glba-encryption",
      "code": "glba-encryption",
      "title": "Kryptering krävs, eller en dokumenterad likvärdig kontroll",
      "titleEn": "Encryption is required, or a documented equivalent control",
      "verdict": "risk",
      "audit": "KRAV_VILLKORAT",
      "obligation": "16 CFR 314.4(c)(3) kräver kryptering av kunduppgifter i vila och under överföring, eller en likvärdig kompenserande kontroll som den ansvariga skriftligen godkänt.",
      "obligationEn": "16 CFR 314.4(c)(3) requires encryption of customer information at rest and in transit, or an equivalent compensating control approved in writing by the qualified individual."
    },
    {
      "ruleId": "glba-small",
      "code": "glba-full",
      "title": "Alla delar av regeln gäller, inklusive riskbedömning och incidentplan",
      "titleEn": "The full rule applies, including risk assessment and incident response",
      "verdict": "risk",
      "audit": "KRAV_GÄLLER",
      "obligation": "16 CFR 314.6 undantar den som hanterar uppgifter om färre än 5 000 kunder från vissa delar. Vid 5 000 kunder eller fler gäller även skriftlig riskbedömning enligt 16 CFR 314.4(b), incidentplan enligt 314.4(h) och rapport till styrelsen enligt 314.4(i).",
      "obligationEn": "16 CFR 314.6 exempts those maintaining information on fewer than 5,000 customers from certain parts. At 5,000 customers or more the written risk assessment in 16 CFR 314.4(b), the incident response plan in 314.4(h) and the board report in 314.4(i) also apply."
    }
  ],
  "checked_at": "2026-08-15",
  "canonical": "https://legal.exploreworldai.com/us/agent/glba/controls",
  "agent_canonical": "https://legal.exploreworldai.com/us/agent/glba",
  "hash": "sha256:b2d8ae095cfc76369c0d9edd9bbc310d1e93f617479567a04aea3389789a5002",
  "citation": "16 CFR Part 314, GLBA, Finanssekretess och kunddata. ExploreWorld Legal, https://legal.exploreworldai.com/us/agent/glba (hämtad 2026-08-15, bevis sha256:1df7b9908c124522, bygge legal-2026-08-25).",
  "disclaimer": "Källhänvisning med officiell identifierare. Ingen juridisk rådgivning och inget efterlevnadsbeslut.",
  "version": "legal-2026-08-25",
  "expires": "2026-08-31T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-08-25+legal-2026-08-25+2026-08-25T10:00:00",
    "content_hash": "sha256:b2d8ae095cfc76369c0d9edd9bbc310d1e93f617479567a04aea3389789a5002",
    "revalidate_after": "2026-08-30T06:51:40.798Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; live-fetch-per-answer; attribution-required; no-derived-index",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "usageInfo": "https://legal.exploreworldai.com/citering"
}