01Does the GLBA Safeguards Rule apply to banks?
It comes down to who regulates you. If you're a mortgage broker, payday lender or fintech, you're probably a non-bank financial institution, and the FTC's Safeguards Rule is yours. Banks and credit unions follow their own regulators' interagency safeguards guidelines under GLBA. They ask for much the same things. We map controls to the one that applies.
02Can you connect governance to our core banking platform?
Usually, through whatever the core provider supports, whether directory groups, flat-file feeds or APIs. Where a core only accepts changes through its admin console or a vendor ticket, we build ticketed fulfillment with tracked completion so the evidence is still there.
03How do we get MFA onto applications that don't support SAML or OIDC?
It depends on the application. Options include an access proxy or gateway in front of web apps, MFA at a privileged access jump host for thick clients, and documented compensating controls the CISO approves in writing for the few that are left, which Part 500 permits with annual review.
04How long does an IGA rollout take at a bank?
It depends mostly on how many applications need connectors and how clean HR and directory data are. We size it after a short discovery that counts both, rather than quoting before we have seen your estate.
05Do you work with our core banking vendor or around them?
With them, using whatever interfaces they support. Some cores will only take a change by ticket. We still track each of those requests to completion, because that's where the evidence comes from. And we only work in vendor systems you've given us access to.
