The Gramm-Leach-Bliley Financial Services Modernization Act of 1999 applies to all financial institutions in the U.S. regulated by the Office of the Comptroller of the Currency (OCC). GLBA requires that financial institutions ensure the security and confidentiality of customer personal information against "reasonably foreseeable" internal or external threats.

From an information security perspective, organizations must implement a process that assesses and monitors the threat environment, as well as the tools and policies to counter threats, including access controls, authentication, encryption, data integrity controls and audit controls.