Assign employee training
Deliver courses through the employee portal and maintain assignment history.
GLBA Awareness Support
Security Awareness Training to Support a Broader GLBA Program
Build a practical employee awareness workflow with training, controlled phishing simulations, and centralized activity records.
Phishmake supports the people-focused work around a broader safeguards program without claiming to provide legal advice, certification, or automatic compliance.
Training assignments • Simulations • Employee activity • Records
01Plain-English Context
Where Security Awareness Fits Within the GLBA Safeguards Rule
The Gramm-Leach-Bliley Act established safeguards for customer information. The exact rules and enforcing regulator depend on the institution.
For institutions covered by the FTC Safeguards Rule, the information security program includes personnel security awareness training updated to reflect risks identified by the risk assessment.
Source: FTC Safeguards Rule guidance
02Practical Support
GLBA Security Awareness Training With Measurable Activity
Run controlled simulations
Use built-in or custom phishing scenarios to exercise everyday decisions.
Track employee activity
Review supported campaign events and training progress at employee level.
Prepare useful records
Keep campaign results and completion evidence available for internal review.
03Workflow
A Practical GLBA Awareness Workflow
- 01Assess risk
- 02Plan
- 03Train
- 04Simulate
- 05Review
- 06Reinforce
- 07Retain records
04Evidence
Keep Training and Simulation Records Together
Phishmake centralizes campaign delivery and interaction events, assignments, progress, and completion. These records can support reporting and evidence collection, but do not prove that a program is sufficient or compliant.
05Financial Institutions
Support Awareness Programs Across Financial Teams
Banks
Connect simulations, employee learning, and organized records.
Credit unions
Create a repeatable awareness and testing workflow.
06Connected Program
Connect Awareness Training With Employee Phishing Tests
Training explains expected behavior; controlled simulations provide an opportunity to apply it. Together, they create a measurable cycle of education, practice, and reinforcement.
Common questions
What is the GLBA Safeguards Rule?
It consists of standards intended to protect customer information at covered financial institutions. Coverage and the responsible regulator depend on the institution.
Does the FTC Safeguards Rule require security awareness training?
Yes, for institutions covered by the FTC rule. It requires personnel training updated to reflect risks identified by the risk assessment. Other institutions may be governed by different agencies.
Does GLBA require phishing simulations?
The FTC guidance cited here calls for security awareness training but does not state a universal requirement to use phishing simulations. Simulations can reinforce and measure an awareness program.
Can Phishmake make an organization GLBA compliant?
No product can establish compliance on its own. Phishmake can support training, testing, and recordkeeping within a broader information-security program.
How often should phishing simulations be conducted?
There is no universal schedule. Frequency should reflect the organization's risk assessment, workforce, policies, threat environment, and applicable requirements. A repeatable program is more useful than an isolated test.
Can training and simulation results support compliance reporting?
They can provide evidence that awareness activities occurred and were monitored. Those records do not, by themselves, establish compliance or guarantee that an auditor or examiner will consider the evidence sufficient.
Published by Phishmake
Keep building your program
All resourcesPut it into practice
Make GLBA Awareness Activity Easier to Manage
Bring employee training, phishing simulations, and useful activity records into one repeatable workflow.