Which of the following protects personally identifiable information (PII) used by financial services organizations?

NIST SP 800-53 is a catalog of security and privacy controls for federal information systems and organizations, not a law or regulation specifically targeting PII protection in financial services.

The Gramm-Leach-Bliley Act (GLBA) was enacted specifically to regulate how financial services organizations-such as banks, insurance companies, and investment firms-collect, store, and protect consumers' personally identifiable financial information. It includes the Safeguards Rule, which requires financial institutions to implement security programs to protect customer PII, and the Privacy Rule, which governs disclosure of that information to third parties.

PCI-DSS is a security standard focused on protecting payment card data (cardholder data) during transactions, not broadly protecting PII held by financial services organizations.

HIPAA is a U.S. federal law that protects the privacy and security of individuals' medical and health information, and applies to healthcare entities, not financial services organizations.