Section node
Risk assessment
16 CFR 314.4(b)
- What this page is
- Section node, 16 CFR 314.4(b)
- Checked against the official source
- 2026-08-15Current
- Responsible publisher
- ExploreWorld Legal, editorial deskLiability position
Short answer
What does 16 CFR 314.4(b) require, and where does it carry an outcome in the rule tree?
16 CFR 314.4(b) is the paragraph the GLBA decision agent rests on for this question. Written assessment of foreseeable risks to customer information. The block was read against the publisher on 2026-08-15 and carries 2 outcomes in the agent's rule tree. The reference can be cited as it stands, with a link to the official text and a content hash.
16 CFR 314.4(b)Checked against the publisher 2026-08-15Official text
A source reference, not legal advice.
- Jurisdiction
- 16 CFR Part 314
- Section node
- risk-assessment
- Read
- 2026-08-15
- Hash
- sha256:070b1c6f414859b4
Outcomes resting on this section
The rules below point to this section in their outcome. The verdict is a machine classification, not a judgment on an individual matter.
glba-small
The full rule applies, including risk assessment and incident response
16 CFR 314.6 exempts those maintaining information on fewer than 5,000 customers from certain parts. At 5,000 customers or more the written risk assessment in 16 CFR 314.4(b), the incident response plan in 314.4(h) and the board report in 314.4(i) also apply.
risk, Requirement applies
glba-base
The rule applies, with the exemption for smaller holdings
16 CFR 314.1 states the scope for financial institutions under the Commission's jurisdiction. 16 CFR 314.6 exempts those maintaining information on fewer than 5,000 customers from parts of 314.4.
risk, Requirement applies conditionally
Section nodes
- Information security program16 CFR 314.4(a)
- Safeguards16 CFR 314.4(c)
- Notification of a security event16 CFR 314.5
The verdict is a machine classification of the outcome, not legal advice and not a compliance decision.
Verifiable trust signals
- Six fixed blocks, one source per line
- No sentence written by a language model
- Engine version and read date on every answer
- No customer data, no documents, no advice
- Model card and audit published under the EU AI Act