How does Cyber Crucible support GLBA and financial-institution vendor requirements?
Short answer: As a software service provider to a financial institution, Cyber Crucible supports the institution's obligations under the GLBA Safeguards expectations and the interagency information-security guidelines — primarily by never collecting the non-public personal information (NPI) those rules are written to protect. Cyber Crucible is a software vendor, not a chartered financial institution, so it is not itself examined; its controls are built to be examinable as part of the institution's third-party risk program.
Where the architecture does the work
- No NPI collected. The product runs on endpoints that may handle NPI without extracting it. There is no consumer financial information for Cyber Crucible to use, share, or re-disclose, which directly supports the GLBA Privacy Rule / Regulation P position.
- Documented security program. Access control, encryption, breach response, and change control are documented and evidenceable — the safeguards a bank's program looks for in a service provider.
- Due-diligence evidence on hand. A prepared vendor package is structured to serve as the due-diligence and ongoing-monitoring evidence a bank needs under current interagency third-party risk guidance.
The honest boundary
Cyber Crucible supports a customer's compliance obligations; it does not, by itself, make an organization compliant, and this is not legal advice. Specific, evidence-grade detail is provided to a bank's reviewers under NDA. See also Does Cyber Crucible meet FFIEC and third-party risk management expectations?