Aegis AI™ · GLBA / FTC Safeguards Rule
The Safeguards Rule names its artifacts.
Here they are, filled in.
16 CFR §314.4 tells every nonbank financial institution exactly what its information security program must contain: a Qualified Individual, a written risk assessment, eight named safeguards, testing, training, service provider oversight, an incident response plan, an annual board report, and a 30-day FTC notification clock. This assessment answers every element from your own intake and hands you the working documents the rule asks for.
What you receive
- Element-by-element status across §314.4(a) through (j): a 22-point readiness battery covering the Qualified Individual, the written risk assessment, all eight (c) safeguards, testing, training, provider oversight, program evaluation, incident response, the board report, and FTC notification readiness.
- Honest accounting: every element is answered from your intake or explicitly listed as not asserted. Nothing un-answered is ever counted as passing, and there is no invented score, just the rule's own elements and where you stand on each.
- Remediation register: each open element carries the specific fix and the risk of leaving it open, sequenced so the Qualified Individual can work the list.
- The six program artifacts, templated: Qualified Individual designation record (a), written risk assessment scaffold (b)(1), incident response plan outline (h)(1) through (7), service provider oversight register (f), annual board report template (i), and the FTC notification checklist (j).
- Board-readable executive summary: plain language your owner, CFO, or counsel can read without a translator.
How it works
PurchaseStripe checkout, two minutes. Your intake link arrives by email immediately.
Answer short questions about your program, never customer dataWho holds the security role today, where customer information lives, your providers, your last risk assessment. About ten minutes. The form collects program and environment details only: no customer financial data, ever.
Your readiness report arrives in your inboxThe assessment runs against the full §314.4 element catalog and the PDF is released to you once it clears review.
Who this is for
Nonbank financial institutionsThe FTC's Safeguards Rule covers auto dealers that finance or lease, mortgage lenders and brokers, payday and installment lenders, finance companies, money transmitters and check cashers, collection agencies, credit counselors, and tax preparation firms.
Advisers and smaller institutionsInvestment advisers outside SEC registration and credit unions without federal insurance fall under the FTC rule too. If customer financial information flows through your business, §314.4 describes your program.
$1,495 one-time
Subscribe to GLBA Essentials or any Aegis AI™ tier within 30 days and the full $1,495 credits toward your first month. Month-to-month, no long-term contract.
Get your Safeguards readiness report →
Checkout by Stripe. Intake link arrives immediately after purchase.
Keep the program current: GLBA Essentials
The rule is not a one-time filing. The risk assessment gets reassessed, providers get re-evaluated, the board report comes due every year, and the notification clock is always 30 days. GLBA Essentials keeps the §314.4 artifact set current on a monthly cycle for one legal entity: the Qualified Individual package, the written risk assessment, the incident response plan, a service provider oversight register for up to 25 providers, the annual board report, and the rule's clocked obligations tracked. Delivered from your attested intake; step up to Cornerstone or above when you want measured evidence from live cloud telemetry or a second framework.
Common questions
Does this make us GLBA compliant?No document from any vendor does that, and you should be suspicious of one that claims to. This assessment tells you where your program stands against each element of §314.4, gives you the named artifacts in working form, and sequences the gaps. Your Qualified Individual, a person at your company, owns the program; Aegis AI™ is the system that does the assembly work.
Who is the Qualified Individual, us or you?Yours. The rule lets the QI be an employee, an affiliate, or a service provider, but the designation and the accountability sit with your institution. The report includes the designation record template and, if you have no one designated yet, makes that the first program element to close.
Do you need our customers' financial data?No. The intake collects program and environment details: where customer information lives, never what is in it.
What if our program barely exists?Then the report says so, element by element, and the remediation register becomes your build plan. An honest baseline in front of an FTC examiner beats an optimistic one every time.
What does GLBA Essentials not include?Live cloud scanning and multi-framework coverage. Essentials maintains the Safeguards Rule artifact program from your attested intake, one entity, monthly cycle. When you want controls validated against live telemetry, or SOC 2, PCI DSS, ISO 27001, NIST CSF, or HIPAA alongside GLBA, that is Cornerstone and up on the pricing page.
Aegis AI™ is a vCISO platform delivered as Agent-as-a-Service. Aegis AI is not a law firm and does not provide legal advice; the GLBA Safeguards Rule Readiness Assessment is a compliance work product prepared from your intake, not an attestation, audit, or certification. The platform supports Safeguards Rule compliance and produces the §314.4 artifacts; the Qualified Individual and the program remain the institution's own. ElasticD3M, LLC is a Texas limited liability company. Patent Pending.