On 25 August 2026, the Federal Trade Commission reported that it "received approximately 163 breach notifications" in 2025 from non-bank financial institutions whose unencrypted customer information on 500 or more consumers was acquired without authorization (91 FR 54873). When it adopted the notification requirement in 2023, the Commission said the requirement "will increase the efficiency and effectiveness of the Commission's enforcement of the Rule" (88 FR 77501). State examiners ask about the test itself. The nonbank cybersecurity exam programs that state regulators built for "examinations of nonbank institutions" (version 1.1, 21 October 2024) ask: "Are penetration tests conducted? If yes, indicate by whom and frequency," citing 16 CFR 314.4(d)(2) (CSBS).
This ranking is for the institutions that answer that question: consumer and installment lenders, buy now, pay later (BNPL) providers, loan servicers, debt collectors and debt buyers, finance companies, check cashers and payday lenders, tax preparation firms at scale, title, escrow and settlement agents, and colleges in federal student aid. It is written for the CISO, Qualified Individual or procurement lead at an organization of 200 to 20,000 people. Auto dealers, mortgage lenders and accounting firms have their own rankings (dealerships, mortgage lenders, accounting firms), and the rule is read clause by clause in our FTC Safeguards Rule penetration testing guide.
Quick answer. The best FTC Safeguards Rule penetration testing companies in 2026 are Stingrai, NetSPI, TrustedSec, Raxis, Praetorian, GuidePoint Security, Coalfire, Sprocket Security, Rapid7 and Schellman. Stingrai ranks first: a CREST-accredited firm headquartered in Toronto whose named penetration testers test a lender's perimeter from outside, its network and Active Directory from inside, every borrower and payment portal across every role, multi-factor authentication and the help desk, with retesting and an attestation letter, as a one-time annual test or a continuous program. Unless an institution runs effective continuous monitoring, 16 CFR 314.4(d)(2) requires annual penetration testing and vulnerability assessments at least every six months; below 5,000 consumers, 314.6 lifts that clause but not the 30-day FTC breach notice.
What drives a penetration test at a non-bank financial institution
Each source is quoted with its own verb.
The FTC Safeguards Rule, 16 CFR Part 314
Annual test and six-month assessments, 314.4(d)(2), "shall". Absent "effective continuous monitoring or other systems to detect, on an ongoing basis, changes in information systems that may create vulnerabilities", the institution "shall conduct" annual penetration testing "determined each given year based on relevant identified risks in accordance with the risk assessment", plus vulnerability assessments "at least every six months", after material changes and when other circumstances may materially affect the program (eCFR). In force since 9 June 2023 (87 FR 71509).
The definition, 314.2(n). Assessors attempt to defeat security features "from outside or inside your information systems", and the FTC said in 2021 that "Attempted social engineering and phishing ... would not be excluded by this definition" (86 FR 70277).
The board report, 314.4(i), "shall include". The Qualified Individual's annual written report covers material matters such as "results of testing".
The FTC notice, 314.4(j), "must". For 500 or more consumers, "you must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event", since 13 May 2024.
The exemption, 314.6, "do not apply". The written risk assessment, the (d)(2) testing clause, the incident response plan and the board report "do not apply" below 5,000 consumers.
The rule does not say who runs the test; an outside tester who can reach customer information is a service provider (314.2(r)) that 314.4(f) requires you to select, bind by contract and periodically assess.
Federal Student Aid, for colleges and their servicers
FSA's GENERAL-23-09 says every Title IV institution "has agreed in its Program Participation Agreement (PPA) to comply with the GLBA Safeguards Rule", and that the written program "must include" nine elements, including Element 4: "regularly test or otherwise monitor the effectiveness of the safeguards". GLBA findings "will have the same effect on an institution's participation in the Title IV programs as any other determination of non-compliance", and GENERAL-24-46 reminds institutions that they "must immediately report breaches within 24 hours after the incident is known or identified." FSA's May 2026 Canvas alert said "ED strongly urges all institutions to implement MFA uniformly", and GENERAL-26-60 gives every organization until 31 December 2026 to confirm each user's access to FSA systems.
New York's Part 500, for DFS licensees
If New York's DFS licenses you (its business types include check cashers, licensed lenders, money transmitters, sales finance companies and student loan servicers), section 500.5(a)(1) requires "penetration testing of their information systems from both inside and outside the information systems' boundaries by a qualified internal or external party at least annually" (DFS adopted text). The 2023 amendment deleted the continuous monitoring alternative, so outside the 500.19(a) small-entity exemption there is no monitoring route. See our NYDFS guide and NYDFS ranking.
State examiners and the IRS
The Conference of State Bank Supervisors' Baseline and Enhanced Nonbank Cybersecurity Exam Programs (the second for "larger, more complex institutions") also ask whether key controls are tested "through the IT audit process and network penetration testing and scanning", citing 314.4(d) (Enhanced program). For tax firms that are Online Providers of individual income tax returns, IRS Publication 1345 (Rev. 12-2025) says they "must contract with an independent third-party vendor to run weekly external network vulnerability scans" and keep the reports "for at least one year".
Who is covered
The FTC takes "any other financial institution" that no other regulator covers (15 U.S.C. 6805(a)(7)).
Business | Where coverage comes from |
|---|---|
Consumer, installment and BNPL lenders | 314.1(b) names finance companies and payday lenders; extending credit is a financial activity under 12 CFR 225.28(b)(1) |
Loan servicers, debt collectors and debt buyers | 314.1(b) names account servicers and collection agencies; servicing rights and purchased accounts create continuing relationships (314.2(e)(2)(i)(J) and (L)) |
Check cashers and money transmitters | 314.2(h)(2)(vi) and (vii); a one-off check cashed or wire sent creates no continuing relationship (314.2(e)(2)(ii)(A)), but a loan does |
Tax preparation firms | 314.2(h)(2)(viii); IRS Publication 1345 for Online Providers of individual income tax returns |
Title, escrow and settlement agents | 314.2(h)(2)(x); settlement services "do not include providing title insurance" (12 CFR 225.28), which answers to state insurance authorities (6805(a)(6)) |
Colleges in federal student aid | The FTC has determined that colleges are financial institutions (FSA, 2020); the Program Participation Agreement commits them to Part 314 (GENERAL-23-09) |
The 5,000-consumer line counts former customers too; the Safeguards Rule guide explains the count.
What mid-market and enterprise buyers need from a vendor
Scope from the risk assessment, not a template: the annual test is "determined each given year" from it.
Both sides of the boundary. 314.2(n) says "from outside or inside"; New York licensees need both every year.
Named testers and a named entity. Examiners ask "by whom", and CREST accreditation sits with a legal entity, so check the entity on your contract.
Service provider terms. Data handling and access belong in the contract 314.4(f) requires.
People and MFA in scope. Phishing is inside the definition, and 314.4(c)(5) requires MFA "for any individual accessing any information system" unless the Qualified Individual approves equivalent controls in writing, so test those exceptions, help desk resets and payment-change requests.
Evidence for three readers: a report the Qualified Individual can reuse for 314.4(i), a retest, and a letter for partners who ask for proof.
A calendar that fits: an annual test plus six-month assessments, or a continuous program the institution can show is "effective" across every system; the FTC said the rule "requires one, not both" (86 FR 70293).
Multi-entity scale: one methodology across licensed entities and states, with reports per entity.
What enforcement looks like
On 13 October 2026 the FTC's case list for its Gramm-Leach-Bliley Act topic showed 39 entries, the newest Ascension Data & Analytics (December 2021), so no case on it yet tests the clause in force since June 2023. The cases closest to this audience show what an order looks like:
Tax preparation: hackers gained "full access to nearly 9,000 TaxSlayer accounts" in 2015, and the 2017 order requires biennial third-party assessments for 10 years (FTC).
Money transfer: "through at least August 2014, Venmo did not have a written information security program"; the 2018 order carries the same 10 years of assessments (FTC).
Payday lending and check cashing: operators of "more than 300 retail stores in nine states" settled in 2012 with a US$101,500 civil penalty over documents in dumpsters, with Safeguards and Privacy Rule violations also alleged (FTC).
For colleges, FSA enforces through Title IV compliance audits; for New York licensees, DFS enforces Part 500.
How this ranking was built
Vendor claims come from each firm's own website and accreditations from its CREST Marketplace profile, all checked on 13 October 2026. Firms had to sell penetration testing as a core service; show evidence that fits the rule (a GLBA or Safeguards Rule page, financial services testing, or firm-level CREST Penetration Testing accreditation); cover networks, applications and people; and deliver to US institutions from US or Canadian offices.
Quick comparison: FTC Safeguards Rule penetration testing companies
Company | HQ | Credentials checked | Best for |
|---|---|---|---|
1. Stingrai | Toronto, Canada | CREST Penetration Testing (Stingrai Inc) | Full-scope tests by named testers, annual or continuous |
2. NetSPI | Minneapolis, USA | CREST Penetration Testing, Threat Led specialism | Large multi-entity programs |
3. TrustedSec | Fairlawn, Ohio, USA | CREST Penetration Testing | Testing plus incident response readiness |
4. Raxis | Atlanta, USA | OSCP, CEH, GPEN, GFACT (own site) | A test framed around the Safeguards Rule |
5. Praetorian | Austin, USA | CREST Penetration Testing | Continuous programs |
6. GuidePoint Security | Reston, Virginia, USA | CREST Penetration Testing | Enterprises consolidating security vendors |
7. Coalfire | Chicago mailing address, USA | CREST Penetration Testing (Coalfire Systems) | Lenders that also carry PCI DSS |
8. Sprocket Security | Madison, Wisconsin, USA | CREST Penetration Testing | Year-round external testing at a published price |
9. Rapid7 | Boston, USA | Metasploit contributors (own site) | Institutions already on Rapid7 |
10. Schellman | Tampa, USA | CREST Penetration Testing (Schellman Compliance LLC) | Fintech lenders with SOC 2 and PCI audits |
1. Stingrai (top rated for FTC Safeguards Rule penetration testing)
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
For a lender, servicer or finance company, that means a test built to 314.4(d)(2) and the 314.2(n) definition, run by people an examiner can name. Stingrai Inc, the contracting entity, holds firm-level Penetration Testing accreditation on its CREST Marketplace profile, and has an office in London, UK. Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, reviewed by the team lead and an engagement partner. The team has 18 published CVEs and bug bounty Hall of Fame listings at the US Department of Defense and the US Federal Reserve; Stingrai is rated 5.0 out of 5 on Clutch (20 reviews).
Services and scope
Outside and inside: internal and external network testing, including segmentation between systems that hold customer information and those connected to them, and Active Directory assessed for ACL abuse and Kerberos and delegation paths to domain admin.
Borrower, payment and servicing portals: web application and API testing authenticated across every role, hunting IDOR and broken authorization, plus iOS and Android apps where borrowers apply or pay.
Identity and cloud: Entra ID consent grants and Conditional Access gaps, where MFA exceptions hide, plus AWS, Azure and Google Cloud.
People: social engineering, with phishing and vishing aimed at the help desk and the staff who change payment instructions, and red team scenarios for enterprises.
Delivery and evidence
Whether the engagement is a one-time annual test or a continuous program, every confirmed finding, at every severity, is posted to the PTaaS platform the same day it is confirmed, with a working proof of concept and prioritized remediation guidance, and pushes to Jira and Slack. Retesting is included, and every human-led and hybrid report ships with an attestation letter: pentest evidence for your Safeguards Rule program and the Qualified Individual's board report.
Where Snipe fits
Snipe, Stingrai's autonomous AI agent, covers web applications and associated APIs only, such as a lender's online application. On the Autonomous Pentest, Snipe tests alone with no penetration testers; on the Hybrid Pentest, Snipe and penetration testers test together throughout, with the testers directing its focus. Everything else is tested by the penetration testers.
Pricing and fit: The Autonomous Pentest is US$3,000 per assessment or US$650 per month on a 12-month plan, and the Hybrid Pentest is US$6,800 per assessment or US$1,275 per month; both cover one web application and associated APIs (pricing). A full Safeguards Rule scope is quoted through get a quote. Best for: mid-market and enterprise lenders, servicers and finance companies that want one accredited firm to test the whole 314.2(n) scope with named testers, annually or continuously.
2. NetSPI
NetSPI lists Minneapolis as its headquarters and Toronto among its offices on its contact page, and its home page cites "350+ experts, and 50+ pentesting services" since "its inception in 2001". Its social engineering assessments cover "real-world email, text, phone, and physical scenarios". Its Marketplace entry lists Penetration Testing and the Threat Led Penetration Testing (Formerly STAR ILPT) specialism after 10 years of membership, and its merger page says the merger with Synack "officially closed in October 2026".
Best for: large lenders and servicers running multi-entity programs on a PTaaS platform.
3. TrustedSec
TrustedSec's home page says it was "Founded by innovator David Kennedy in 2012" and gives a Fairlawn, Ohio address. Its penetration testing page ends the testing process with "Validation Testing: After you've addressed identified vulnerabilities, we retest to confirm they've been successfully mitigated," and the firm also sells incident response, useful when the 30-day clock in 314.4(j) starts. Its Marketplace entry lists Penetration Testing after 2 years of membership.
Best for: institutions that want testing and incident response readiness from one team.
4. Raxis
Raxis describes "Manual penetration testing by senior U.S. engineers since 2011" beside an Atlanta, Georgia address. Its GLBA Safeguards Rule page promises reports "structured for your Qualified Individual's board reporting obligations" and says "Raxis retests after your team remediates to confirm fixes are effective." It sells point-in-time tests and a PTaaS service, Raxis Attack, and lists OSCP, CEH, GPEN and GFACT among its testers' certifications.
Best for: institutions that want a test framed around the Safeguards Rule's controls and the board report.
5. Praetorian
Praetorian's newsroom places its headquarters in Austin, Texas, and a 2018 release says it "was founded in 2010". Its home page describes a Guard platform that "combines Agentic AI, Workflow Automation, and Offensive Capabilities with our veteran team of offensive security engineers", sells continuous penetration testing beside conventional engagements, and names GLBA and NYDFS among the annual testing requirements it says the platform meets. Its Marketplace entry lists Penetration Testing after 2 years of membership.
Best for: institutions that want a continuous program and the annual test from the same firm.
6. GuidePoint Security
GuidePoint Security's Company page says it "was founded in 2011" and partners with "more than 5,900 organizations", and its site lists GuidePoint Security LLC at 1900 Reston Metro Plaza in Reston, Virginia. Its penetration testing page covers "internal or external networks, applications, cloud, ICS, security awareness or facilities", a Penetration Testing as a Service platform that "can be paired with an expert penetration tester", and red and purple team assessments, and the firm also sells incident response and managed security services. Its Marketplace entry lists Penetration Testing after 3 years of membership.
Best for: enterprises that want testing from a partner that also runs incident response and managed security.
7. Coalfire
Coalfire runs its offensive work under the DivisionHex brand, which its security services page describes as "Offensive, Defensive + Managed Security", and its contact page gives a Chicago mailing address. Its assessment services cite "15+ years as a PCI Qualified Security Assessor", FedRAMP 3PAO accreditation and "PCI + FedRAMP compliance assessments with penetration testing to validate controls". Its Marketplace entry, Coalfire Systems, lists Penetration Testing after 7 years of membership with a United Kingdom head office, so name the delivering entity in the contract.
Best for: BNPL providers and lenders that carry PCI DSS or federal obligations alongside the Safeguards Rule.
8. Sprocket Security
Sprocket Security's About page gives a Madison, Wisconsin address and quotes founder Casey Cammilleri: "In 2015 an idea was formed to modify the penetration testers' processes ... I called it Continuous Penetration Testing." Its finance and insurance page says continuous testing supports "robust safeguards as required by GLBA", and it publishes prices. Its Marketplace entry lists Penetration Testing after 1 year of membership.
Best for: mid-market institutions that want year-round external testing at a published price.
9. Rapid7
Rapid7 lists its global headquarters on Causeway Street in Boston on its contact page, and its company page cites "more than 11,500 customers worldwide". Its penetration testing services page covers "networks, applications, devices and/or people", and says its testers "provide direct contributions to Rapid7's Metasploit Project" and spend "up to 20% of bench time focused on attacker research and skill development". Its GLBA compliance brief offers to help financial institutions adjust "programs based on penetration testing and assessment results".
Best for: institutions already on Rapid7's platform that want the annual test from the same vendor.
10. Schellman
Schellman gives a Tampa, Florida address on its About page, and its penetration testing page says it "began as a SOC audit firm 20+ years ago" and still issues "more than 2,000 SOC reports each year". It tests applications, networks and people, and its financial services and fintech page pairs testing with SOC, PCI DSS and ISO work. Its Marketplace entry, Schellman Compliance LLC, lists Penetration Testing after 2 years of membership.
Best for: fintech lenders and BNPL providers that already buy SOC 2 or PCI DSS assessments and want CREST-accredited testing from the same firm.
Also considered
Kroll LLC holds Incident Response, Penetration Testing and Security Operations Centre accreditations on its CREST Marketplace profile, but its FTC Safeguards Rule service page could not be loaded for verification on 13 October 2026, so it is not ranked. A-LIGN says its penetration testing is "handled by two separate, independent teams" from its compliance work, a fit for institutions that already buy SOC 2 or ISO 27001 from it.
What an FTC Safeguards Rule penetration test costs
The rule sets no price; scope does: legal entities, external ranges, internal sites, portals and APIs, cloud accounts and social engineering targets. Stingrai's Autonomous Pentest is US$3,000 per assessment or US$650 per month on a 12-month plan, and its Hybrid Pentest is US$6,800 per assessment or US$1,275 per month, each covering one web application and associated APIs (pricing); network, Active Directory, cloud, mobile and social engineering scopes are quoted. Sprocket Security's pricing page lists a Starter Package at US$15,000 for continuous testing of up to 20 external hosts and internal network testing as a US$13,000 add-on, without stating a billing period. For market ranges, see the penetration testing cost guide, the pentest cost calculator and how to compare quotes.
Questions to put in the RFP
[ ] Which legal entity signs and delivers the test, and does its CREST Marketplace profile list Penetration Testing?
[ ] Who are the named testers, and what certifications do they hold?
[ ] How will scope come from our risk assessment, and what is tested from outside and from inside (314.2(n))?
[ ] Will you test MFA on every sign-in path, including legacy protocols, vendor accounts and approved exceptions (314.4(c)(5))?
[ ] Are help desk and payment-change social engineering in scope?
[ ] Will you sign the service provider terms 314.4(f) requires?
[ ] What will the report give our Qualified Individual for 314.4(i), and is the retest included?
[ ] Can you run the six-month vulnerability assessments and retest after material changes?
[ ] For New York licensees: does the plan meet 500.5(a)(1) from inside and outside?
Frequently Asked Questions
Who are the best FTC Safeguards Rule penetration testing companies in 2026?
The best FTC Safeguards Rule penetration testing companies in 2026 are Stingrai, NetSPI, TrustedSec, Raxis, Praetorian, GuidePoint Security, Coalfire, Sprocket Security, Rapid7 and Schellman. Stingrai ranks first for non-bank financial institutions: a CREST-accredited firm whose named penetration testers test the perimeter from outside, the network and Active Directory from inside, borrower and payment portals across every role, MFA and the help desk, with retesting and an attestation letter, annually or continuously.
Does the FTC Safeguards Rule require a third-party penetration test?
No. The rule refers to "assessors" (314.2(n)) and requires "qualified information security personnel employed by you or an affiliate or service provider" (314.4(e)(2)). An outside tester who can reach customer information is a service provider that 314.4(f) requires you to select, bind by contract and assess. New York's 500.5(a)(1) allows "a qualified internal or external party", and state examiners ask who ran the test.
Can continuous penetration testing replace the annual test under the Safeguards Rule?
It can if it amounts to "effective continuous monitoring or other systems to detect, on an ongoing basis, changes in information systems that may create vulnerabilities" (314.4(d)(2)). The FTC said the rule "requires one, not both", so the institution should be able to show coverage of every system in scope. New York DFS licensees have no monitoring alternative.
Does the Safeguards Rule apply to BNPL providers, loan servicers and debt collectors?
Generally yes, when no other regulator covers them under 15 U.S.C. 6805(a). Section 314.1(b) names finance companies, account servicers and collection agencies, extending credit and servicing loans are financial activities under 12 CFR 225.28(b)(1), and a debt buyer has a continuing relationship with anyone obligated on an account it buys "unless you do not locate the consumer or attempt to collect any amount" (314.2(e)(2)(i)(J)).
Are title and escrow companies covered by the FTC Safeguards Rule?
Real estate settlement service providers are: 314.2(h)(2)(x) names them, and obtaining settlement services creates a customer relationship (314.2(e)(2)(i)(K)). Settlement services "do not include providing title insurance as principal, agent, or broker" (12 CFR 225.28), and insurance answers to state insurance authorities, so a title agency that also runs closings should map which entity does which.
What do state examiners ask about penetration testing at licensed non-bank lenders?
The CSBS Baseline and Enhanced Nonbank Cybersecurity Exam Programs, version 1.1 of 21 October 2024, ask "Are penetration tests conducted? If yes, indicate by whom and frequency," citing 16 CFR 314.4(d)(2), and whether key controls are tested "through the IT audit process and network penetration testing and scanning".
What does Federal Student Aid expect from colleges on GLBA testing?
Each Title IV institution agrees in its Program Participation Agreement to comply with 16 CFR Part 314, and FSA's GENERAL-23-09 says the written program must include nine elements, including regularly testing or monitoring safeguards. GLBA findings affect Title IV participation, GENERAL-24-46 reminds institutions to report breaches within 24 hours, and FSA's May 2026 Canvas alert urged MFA across all school systems.
How much does an FTC Safeguards Rule penetration test cost?
It depends on scope. Stingrai's packages for one web application and associated APIs are US$3,000 per assessment (Autonomous) and US$6,800 per assessment (Hybrid), or US$650 and US$1,275 per month on a 12-month plan; network, Active Directory, cloud and social engineering scopes are quoted.
Related reading
Best Penetration Testing Companies for Auto Dealerships (2026)
Best Penetration Testing Companies for Mortgage Lenders and Servicers (2026)
Best Penetration Testing Companies for Accounting and CPA Firms (2026)
References
eCFR, 16 CFR Part 314, Standards for Safeguarding Customer Information, current to 8 October 2026. https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314
FTC, Standards for Safeguarding Customer Information, final rule, 86 FR 70272, 9 December 2021. https://www.federalregister.gov/documents/2021/12/09/2021-25736/standards-for-safeguarding-customer-information
FTC, breach notification amendment, 88 FR 77499, 13 November 2023. https://www.federalregister.gov/documents/2023/11/13/2023-24412/standards-for-safeguarding-customer-information
FTC, Agency Information Collection Activities, 91 FR 54872, 25 August 2026. https://www.federalregister.gov/documents/2026/08/25/2026-17331/agency-information-collection-activities-proposed-collection-comment-request-extension
FTC, FTC Safeguards Rule: What Your Business Needs to Know, December 2024. https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
FTC, cases tagged Gramm-Leach-Bliley Act. https://www.ftc.gov/legal-library/browse/cases-proceedings?sort_by=field_date&field_mission%5B29%5D=29&field_consumer_protection_topics=1425
FTC, TaxSlayer settlement, 29 August 2017. https://www.ftc.gov/news-events/news/press-releases/2017/08/operator-online-tax-preparation-service-agrees-settle-ftc-charges-it-violated-financial-privacy
FTC, PayPal (Venmo) settlement, 27 February 2018. https://www.ftc.gov/news-events/news/press-releases/2018/02/paypal-settles-ftc-charges-venmo-failed-disclose-information-consumers-about-ability-transfer-funds
FTC, payday lending and check cashing settlement, 7 November 2012. https://www.ftc.gov/news-events/news/press-releases/2012/11/companies-own-manage-payday-lending-check-cashing-stores-settle-ftc-charges-they-tossed-sensitive
FSA, GENERAL-23-09, 9 February 2023. https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements
FSA, GENERAL-24-46, 24 April 2024. https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2024-04-24/service-provider-relationships-glba-compliance
FSA, GENERAL-26-27, Canvas alert, 12 May 2026. https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2026-05-12/technology-security-alert-ongoing-cybersecurity-incident-involving-canvas-learning-management-system-updated-may-29-2026
FSA, GENERAL-26-60, 2 October 2026. https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2026-10-02/active-confirmation-required-dec-31-2026-maintain-access-fsa-systems
NYDFS, Second Amendment to 23 NYCRR 500, adopted text, November 2023. https://www.dfs.ny.gov/system/files/documents/2023/10/rf_fs_2amend23NYCRR500_text_20231101.pdf
NYDFS, Applications and Filings. https://www.dfs.ny.gov/apps_and_licensing
CSBS, Baseline and Enhanced Nonbank Cybersecurity Exam Programs, version 1.1, 21 October 2024. https://www.csbs.org/sites/default/files/other-files/Baseline%20Nonbank%20Cybersecurity%20Exam%20Program%20V1.1.pdf and https://www.csbs.org/sites/default/files/other-files/Enhanced%20Nonbank%20Cybersecurity%20Exam%20Program%20V1.1.pdf
IRS, Publication 1345, Rev. 12-2025. https://www.irs.gov/pub/irs-pdf/p1345.pdf
US Code, 15 U.S.C. 6805, 2023 edition. https://www.govinfo.gov/content/pkg/USCODE-2023-title15/html/USCODE-2023-title15-chap94-subchapI-sec6805.htm
eCFR, 12 CFR 225.28. https://www.ecfr.gov/current/title-12/chapter-II/subchapter-A/part-225/subpart-C/section-225.28
CREST, Marketplace supplier directory. https://marketplace.crest.org/suppliers/
Talk to Stingrai
A Safeguards Rule test has three readers: the Qualified Individual, the examiner and the partner asking for proof. Stingrai's named penetration testers cover your perimeter, network, Active Directory, portals and the people who release payments, with findings posted the day they are confirmed, retesting and an attestation letter, as a one-time annual test or a continuous program. Book a free scoping call, get a quote, or see the pricing page.
