source:
  type: regulation
  id: glba-safeguards-16cfr-314.3
  authority: 16 CFR §314.3 — Standards for safeguarding customer information (FTC GLBA Safeguards Rule)
  description: '16 CFR §314.3 sets the core standard for the FTC Safeguards Rule:

    a written, comprehensive information security program with

    administrative, technical, and physical safeguards.

    '
obligations:
- id: glba-safeguards-16cfr-314.3-a
  canonical_id: glba-safeguards-16cfr-314.3-a
  section: 16 CFR §314.3(a)
  description: '(a): (a) Information security program. You shall develop, implement, and maintain a comprehensive
    information security program that is written in one or more readily accessible parts and contains
    administrative, technical, and physical safeguards that are appropriate to your size and complexity,
    the natu…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.3(a)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.3
    snapshot_id: b979b8024856bd15
    fetched_at: '2026-05-24T00:44:10Z'
    content_hash: sha256:c5f87662a591e4ceac0c5e30ebae21e1b74205fa24d0ccc7cadf7458dac6aa29
    paragraph_quote: (a) Information security program. You shall develop, implement, and maintain a comprehensive
      information security program that is written in one or more readily accessible parts and contains
      administrative, technical, and physical safeguards that are appropriate to your size and complexity,
      the nature and scope of your activities, and the sensitivity of any customer information at issue.
      The information security program shall include the elements set forth in § 314.4 and shall be reasonably
      designed to achieve the objectives of this part, as set forth in paragraph (b) of this section.
    drafter_attestation: Verbatim subsection of 16 CFR §314.3 from Cornell LII snapshot b979b8024856bd15;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.3-b
  canonical_id: glba-safeguards-16cfr-314.3-b
  section: 16 CFR §314.3(b)
  description: '(b): (b) Objectives. The objectives of section 501(b) of the Act, and of this part, are
    to: (1) Insure the security and confidentiality of customer information ; (2) Protect against any
    anticipated threats or hazards to the security or integrity of such information; and (3) Protect against
    unauthorized a…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.3(a)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.3
    snapshot_id: b979b8024856bd15
    fetched_at: '2026-05-24T00:44:10Z'
    content_hash: sha256:c5f87662a591e4ceac0c5e30ebae21e1b74205fa24d0ccc7cadf7458dac6aa29
    paragraph_quote: '(b) Objectives. The objectives of section 501(b) of the Act, and of this part, are
      to: (1) Insure the security and confidentiality of customer information ; (2) Protect against any
      anticipated threats or hazards to the security or integrity of such information; and (3) Protect
      against unauthorized access to or use of such information that could result in substantial harm
      or inconvenience to any customer . [ 67 FR 36493 , May 23, 2002, as amended at 86 FR 70307 , Dec.
      9, 2021] CFR Toolbox Law about... Articles from Wex Table of Popular Names Parallel Table of Authorities
      Accessibility About LII Contact us Advertise here Help Terms of use Privacy'
    drafter_attestation: Verbatim subsection of 16 CFR §314.3 from Cornell LII snapshot b979b8024856bd15;
      body isolated between nav and notes; substring-verified.
  judgment: false
