Industries
Financial Services
Examiners and customers expect a named person in charge of security. We give you one.
Sound familiar?
What financial firms are being asked.
By examiners, your board, and your customers. We help you answer every one.
-
The examiners
"Who is responsible for your security program?"
You geta named security leader and a written program they can review.
-
Your board
"How much cyber risk are we carrying?"
You geta short, plain report your board can actually read.
-
Your card processor
"Are you PCI compliant?"
You getthe work and the paperwork PCI DSS requires.
-
Your vendors
"Can we connect to your systems?"
You getrules for which vendors get access, and checks that they follow them.
Why it matters
Security here is about trust.
-
Several rules at once
GLBA, PCI DSS and SOX can all apply to the same firm.
-
A name is required
The Safeguards Rule expects one qualified person in charge.
-
Money is the target
Attackers go where the money is.
-
Vendors widen the door
Every connected vendor is another way in.
What you get
One program. Every rule covered.
Covers GLBA, PCI DSS, SOX and SOC 2.
-
We check where you stand
Against the rules that actually apply to you.
-
We build one program
One set of rules that covers every requirement, not three.
-
We report to your board
In plain terms, the same way every quarter.
-
We keep vendors in check
Who has access, what they owe you, and proof they deliver.
Questions
Financial services questions, answered.
Can a vCISO serve as our designated qualified individual?
Yes. The Safeguards Rule allows an outside provider, as long as someone senior at your firm oversees the work. We set that up with you.
How do we report cyber risk to a board that thinks in credit and market risk terms?
Talk about it the same way: how likely, how costly, and what it takes to bring it down. We write the report that way.
We are subject to GLBA, PCI DSS and SOX. Do these need separate programs?
No. One program can cover all three. We map each rule to it so nothing gets done twice.
Insights
Related reading.
-
Regulatory and Framework Readiness
GLBA Safeguards Rule Changes: What Financial Institutions Must Do in 2024
The FTC amended the Gramm-Leach-Bliley Act Safeguards Rule in 2021 and 2023, with the most recent breach notification requirements taking effect in May 2024. Financial institutions subject to FTC jurisdiction must now maintain written information security programs meeting specific technical standards and report qualifying data breaches within 30 days. Leadership faces accountability for security outcomes without always having clear ownership or governance in place.
Dr. Daniel Glauber, 19 August 2026
-
Compliance
What Sarbanes-Oxley IT General Controls Actually Require and How They Are Tested
Public company executives are accountable for IT general controls under Sarbanes-Oxley Section 404, yet many face audits without clarity on what is tested, what constitutes a deficiency, or who owns the outcome. This article explains what auditors examine, what delays sign-off, and how vCISO leadership provides the executive ownership needed to close this gap.
Dr. Daniel Glauber, 17 August 2026
Let's talk.
Got an exam coming, a board question or a PCI deadline? Book a call. We'll tell you where you stand and what it takes.