GLBA, NYDFS Part 500, CCPA/CPRA, and NIST framework tools for banks, credit unions, insurance companies, broker-dealers, RIAs, and fintechs. Free downloads. No paywalls. Built by senior practitioners for the compliance and security officers who have to implement these frameworks under audit pressure.
Find the right resource for your entity type below. Every download goes directly to your work email. This library is the financial-services proof lane on the site; healthcare and federal buyers should use their own regulated-industry pages instead of forcing a finserv lens onto the problem.
Cross-framework control matrices that let you map GLBA, NIST, NYDFS, and CCPA obligations simultaneously. Start here if you answer to multiple frameworks.
A cross-framework reference for mapping applicable GLBA, NYDFS Part 500 and CCPA/CPRA duties alongside voluntary NIST CSF 2.0 practices. Determine entity scope and actual authority; a mapping does not establish compliance.
Maps the NIST AI Risk Management Framework Govern/Map/Measure/Manage functions directly onto financial services model risk and AI governance obligations, practical, examiner-facing guidance.
Each financial institution type carries different charter obligations and regulatory expectations. Download the workbook built for your entity class.
A worksheet for bank and credit-union information-security programs. Map controlling bank/NCUA authority first; the borrowed FTC nine-element scaffold supplies optional DSE practices. Bank and federally insured credit-union notice clocks are distinct.
A reference for insurance carriers and agencies mapping controlling state-insurance duties and applicable NYDFS Part 500 requirements. Borrowed FTC worksheet practices are optional unless another applicable authority independently requires them.
A workbook for SEC Regulation S-P and applicable FINRA customer-data obligations. The borrowed FTC scaffold is an optional DSE practice; both Reg S-P compliance dates have passed, and provider notice has a separate trigger and recipient.
A combined compliance guide for investment advisers covering GLBA obligations, the 2024 Reg S-P cybersecurity amendments, and SEC exam expectations for AI systems used in advisory functions.
A GLBA compliance workbook for non-bank financial institutions and fintechs, covering which entities are covered, what a compliant ISP requires, and how to satisfy the Safeguards Rule without a legacy bank compliance team.
The workbooks above are self-serve. Start with the pillar overview, AI governance for financial services, which maps SR 26-2 model risk, NIST AI RMF, fair lending, and vendor AI risk into one program. When you are ready for a senior-led engagement, each financial-institution type also has a dedicated AI governance page mapped to the regulators that examine it. If you are solving for PHI or public-sector controls instead, start with healthcare AI governance or the federal capability lane.
New York Department of Financial Services Part 500 and 23 NYCRR Part 200 (BitLicense) compliance workbooks for NY-licensed entities navigating the most demanding state cybersecurity regime in the US. For how Part 500 reaches AI, start with the hub: NYDFS Part 500 AI compliance.
The most complete Part 500 compliance workbook available: a section-by-section gap assessment covering all 23 NYCRR Part 500 requirements, mapped to evidence expectations for DFS examiners.
Prepare the annual written CISO report under 500.4(b) and supporting evidence for the separate 500.17(b) electronic compliance notification. Confirm exemptions and actual executive/CISO or responsible-senior-officer roles; this aid does not replace the official filing.
A cybersecurity compliance workbook for BitLicense holders and virtual currency businesses, mapping 23 NYCRR Part 200 cybersecurity requirements alongside Part 500 and the unique obligations of crypto-native financial entities.
Tools that cut across regulatory frameworks: a GLBA/CCPA privacy navigator and a regulatory deadline tracker for the compliance calendar every CCO and GC needs.
A side-by-side navigator for financial institutions subject to both GLBA and CCPA/CPRA, mapping the partial CCPA exemption, where it applies, where it does not, and what your privacy program must cover under both regimes.
Selected historical milestones, current recurring duties, and conditional incident clocks across GLBA, NYDFS Part 500, CCPA/CPRA and Reg S-P; includes upcoming ordinary annual filing and ADMT compliance dates, subject to actual applicability.
Need help implementing these frameworks? A senior practitioner, not a junior analyst, scopes a fixed-fee readiness engagement on a 30-minute call. No pitch, just a clear picture of where you stand and what to fix first.
Schedule a complimentary scoping call →