The TCK Bank adopts cloud for storing the private data of its customers. The bank usually explains its information sharing practices to its customers…

GLBA specifically requires financial institutions like banks to explain information sharing practices and implement safeguards for customer data. The scenario directly mentions these two key GLBA requirements. When security loopholes lead to potential data breaches, GLBA provides for civil penalties and enforcement actions by federal banking regulators.

B. ITAR: Regulates military/defense exports, not banking customer data protection.
C. NIST: Provides standards and frameworks but lacks enforcement/penalty authority.
D. GDPR: While applicable to EU data, the scenario's language specifically mirrors GLBA requirements.

1. Federal Trade Commission. "How To Comply with the Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act." FTC Bureau of Consumer Protection, Section 501(b), pp. 1-3.

2. Office of the Comptroller of the Currency. "OCC Bulletin 2001-47: Third-Party Relationships Risk Management Principles." November 1, 2001, Sections on Information Security.

3. Congressional Research Service. "The Gramm-Leach-Bliley Act (GLBA, P.L. 106-102): A Brief Overview." Report R45616, 2019, pp. 2-4.

4. Federal Reserve Board. "Supervision and Regulation Letters SR 13-19: Guidance on Managing Outsourcing Risk." December 5, 2013, Attachment on GLBA Compliance.

5. U.S. Department of Treasury. "Financial Crimes Enforcement Network: Bank Secrecy Act/Anti-Money Laundering Examination Manual." 2014, Chapter on Information Security Program Requirements, pp. 45-48.