Federal Program Information: Gramm-Leach-Bliley Act – Student Information Security
Criteria or Specific Requirement: Special Tests and Provisions – Gramm-Leach-Bliley Act – Student Information Security - The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). On December 9, 2021, the Federal Trade Commission (FTC) issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet.
Condition: The University did not fully comply with 1 out of the 9 elements included in the FTC’s regulations.
Cause: Lack of administrative oversight with respect to the new GLBA requirements.
Effect or Potential Effect: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Questioned Costs: None.
Context: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Identification as a Repeat Finding: There was no similar finding in the prior year.
Recommendation: We recommend that the University annually reviews the GLBA requirements for updates on a timely basis and implement the requirements before the due date.
Views of Responsible Officials: The University has executed an agreement with a vendor to perform penetration and vulnerability assessments, which is expected to be completed by June 30, 2024.
Federal Program Information: Gramm-Leach-Bliley Act – Student Information Security
Criteria or Specific Requirement: Special Tests and Provisions – Gramm-Leach-Bliley Act – Student Information Security - The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). On December 9, 2021, the Federal Trade Commission (FTC) issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet.
Condition: The University did not fully comply with 1 out of the 9 elements included in the FTC’s regulations.
Cause: Lack of administrative oversight with respect to the new GLBA requirements.
Effect or Potential Effect: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Questioned Costs: None.
Context: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Identification as a Repeat Finding: There was no similar finding in the prior year.
Recommendation: We recommend that the University annually reviews the GLBA requirements for updates on a timely basis and implement the requirements before the due date.
Views of Responsible Officials: The University has executed an agreement with a vendor to perform penetration and vulnerability assessments, which is expected to be completed by June 30, 2024.
Federal Program Information: Gramm-Leach-Bliley Act – Student Information Security
Criteria or Specific Requirement: Special Tests and Provisions – Gramm-Leach-Bliley Act – Student Information Security - The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). On December 9, 2021, the Federal Trade Commission (FTC) issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet.
Condition: The University did not fully comply with 1 out of the 9 elements included in the FTC’s regulations.
Cause: Lack of administrative oversight with respect to the new GLBA requirements.
Effect or Potential Effect: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Questioned Costs: None.
Context: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Identification as a Repeat Finding: There was no similar finding in the prior year.
Recommendation: We recommend that the University annually reviews the GLBA requirements for updates on a timely basis and implement the requirements before the due date.
Views of Responsible Officials: The University has executed an agreement with a vendor to perform penetration and vulnerability assessments, which is expected to be completed by June 30, 2024.
Federal Program Information: Gramm-Leach-Bliley Act – Student Information Security
Criteria or Specific Requirement: Special Tests and Provisions – Gramm-Leach-Bliley Act – Student Information Security - The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). On December 9, 2021, the Federal Trade Commission (FTC) issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet.
Condition: The University did not fully comply with 1 out of the 9 elements included in the FTC’s regulations.
Cause: Lack of administrative oversight with respect to the new GLBA requirements.
Effect or Potential Effect: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Questioned Costs: None.
Context: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Identification as a Repeat Finding: There was no similar finding in the prior year.
Recommendation: We recommend that the University annually reviews the GLBA requirements for updates on a timely basis and implement the requirements before the due date.
Views of Responsible Officials: The University has executed an agreement with a vendor to perform penetration and vulnerability assessments, which is expected to be completed by June 30, 2024.
Federal Program Information: Gramm-Leach-Bliley Act – Student Information Security
Criteria or Specific Requirement: Special Tests and Provisions – Gramm-Leach-Bliley Act – Student Information Security - The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). On December 9, 2021, the Federal Trade Commission (FTC) issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet.
Condition: The University did not fully comply with 1 out of the 9 elements included in the FTC’s regulations.
Cause: Lack of administrative oversight with respect to the new GLBA requirements.
Effect or Potential Effect: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Questioned Costs: None.
Context: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Identification as a Repeat Finding: There was no similar finding in the prior year.
Recommendation: We recommend that the University annually reviews the GLBA requirements for updates on a timely basis and implement the requirements before the due date.
Views of Responsible Officials: The University has executed an agreement with a vendor to perform penetration and vulnerability assessments, which is expected to be completed by June 30, 2024.
Federal Program Information: Gramm-Leach-Bliley Act – Student Information Security
Criteria or Specific Requirement: Special Tests and Provisions – Gramm-Leach-Bliley Act – Student Information Security - The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). On December 9, 2021, the Federal Trade Commission (FTC) issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet.
Condition: The University did not fully comply with 1 out of the 9 elements included in the FTC’s regulations.
Cause: Lack of administrative oversight with respect to the new GLBA requirements.
Effect or Potential Effect: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Questioned Costs: None.
Context: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Identification as a Repeat Finding: There was no similar finding in the prior year.
Recommendation: We recommend that the University annually reviews the GLBA requirements for updates on a timely basis and implement the requirements before the due date.
Views of Responsible Officials: The University has executed an agreement with a vendor to perform penetration and vulnerability assessments, which is expected to be completed by June 30, 2024.
Federal Program Information: Federal Work Study (ALN #84.033)
Criteria or Specific Requirement: Special Tests and Provisions – Disbursements to or on Behalf of Students – Federal Work Study - The University shall ensure that the student is paid at least once per month for wages earned.
Condition: Instances where the University did not retain adequate support for wages earned.
Cause: Lack of administrative oversight with respect to recordkeeping for timesheets.
Effect or Potential Effect: The University was not in compliance with disbursements to or on behalf of students for federal work study payments.
Questioned Costs: None above threshold
Context: For 2 of 25 payments selected for testing, the University was unable to locate the approved timesheets.
Identification as a Repeat Finding: There was no similar finding in the prior year.
Recommendation: We recommend the University retain the appropriate records for hours earned by work study students.
Views of Responsible Officials: For these 2 disbursements, the students did not report their time through the online payroll system but instead with physical timesheets. Due to the turnover and changing of positions of the payroll office, the timesheets were misfiled. The payroll department will scan and file all manual timesheets electronically in order to retain adequate records.
Federal Program Information: Federal Perkins Loan Program (ALN #84.038)
Criteria or Specific Requirement: Special Tests and Provisions – Perkins Loan Recordkeeping and Record Retention - Institutions must retain original or true and exact copies of promissory and master promissory notes (MPN), repayment records, and cancellation and deferment requests for each Perkins loan made, in a locked, fireproof container. (34 CFR 674.19.(e))
Condition: Instances where the University did not retain the original or true and exact copies of promissory notes.
Cause: Lack of administrative oversight with respect to recordkeeping and record retention related to the Federal Perkins Loan program (“Perkins”), including improper tracking and storage of records.
Effect or Potential Effect: The University was not in compliance with the Perkins loan recordkeeping and record retention requirements.
Questioned Costs: None.
Context: For 6 of 35 borrowers with open loans selected for testing, the University did not retain an original or true and exact copy of the promissory note. For 5 of 40 borrowers with retired loans within the previous three fiscal years and current fiscal year, the University did not retain the appropriate records.
Identification as a Repeat Finding: Yes – Finding 2022-003
Recommendation: We recommend the University retain the appropriate records for the required timeframe. We also recommend a full review of records on-hand.
Views of Responsible Officials: The Policy and Procedures manual has been updated to reflect this process. The Business Office has implemented measures to ensure that Perkins Promissory Notes are identified, stored, and accessible during their repayment and collection period. In addition to the current filing system, the Business Office will utilize management software for ease of access and recording.
To ensure that all remaining promissory notes are kept in accordance with Department of Education regulations, the Business Office will:
• Record all incoming promissory notes internally and externally.
• Promissory notes created prior to 2013 will be made digitally accessible through Perceptive Content, a secure content management system. Access to these promissory notes will only be accessible by parties with authorized access.
• Promissory notes created after 2013 will continue to be made available through Heartland ECSI’s third party filing system. ECSI records paid, completed, cancelled, and retired promissory notes that were created after 2013.
• In accordance with the Perkins Assignment and Liquidation Guide from the Department of Education (EA ID: General-21-53), all accounts with promissory notes unable to be located will be written off and/or purchased from the Department of Education. The University recorded an entry to repurchase open default loans as of June 30, 2023.
Federal Program Information: Gramm-Leach-Bliley Act – Student Information Security
Criteria or Specific Requirement: Special Tests and Provisions – Gramm-Leach-Bliley Act – Student Information Security - The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). On December 9, 2021, the Federal Trade Commission (FTC) issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet.
Condition: The University did not fully comply with 1 out of the 9 elements included in the FTC’s regulations.
Cause: Lack of administrative oversight with respect to the new GLBA requirements.
Effect or Potential Effect: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Questioned Costs: None.
Context: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Identification as a Repeat Finding: There was no similar finding in the prior year.
Recommendation: We recommend that the University annually reviews the GLBA requirements for updates on a timely basis and implement the requirements before the due date.
Views of Responsible Officials: The University has executed an agreement with a vendor to perform penetration and vulnerability assessments, which is expected to be completed by June 30, 2024.
Federal Program Information: Gramm-Leach-Bliley Act – Student Information Security
Criteria or Specific Requirement: Special Tests and Provisions – Gramm-Leach-Bliley Act – Student Information Security - The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). On December 9, 2021, the Federal Trade Commission (FTC) issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet.
Condition: The University did not fully comply with 1 out of the 9 elements included in the FTC’s regulations.
Cause: Lack of administrative oversight with respect to the new GLBA requirements.
Effect or Potential Effect: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Questioned Costs: None.
Context: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Identification as a Repeat Finding: There was no similar finding in the prior year.
Recommendation: We recommend that the University annually reviews the GLBA requirements for updates on a timely basis and implement the requirements before the due date.
Views of Responsible Officials: The University has executed an agreement with a vendor to perform penetration and vulnerability assessments, which is expected to be completed by June 30, 2024.
Federal Program Information: Gramm-Leach-Bliley Act – Student Information Security
Criteria or Specific Requirement: Special Tests and Provisions – Gramm-Leach-Bliley Act – Student Information Security - The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). On December 9, 2021, the Federal Trade Commission (FTC) issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet.
Condition: The University did not fully comply with 1 out of the 9 elements included in the FTC’s regulations.
Cause: Lack of administrative oversight with respect to the new GLBA requirements.
Effect or Potential Effect: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Questioned Costs: None.
Context: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Identification as a Repeat Finding: There was no similar finding in the prior year.
Recommendation: We recommend that the University annually reviews the GLBA requirements for updates on a timely basis and implement the requirements before the due date.
Views of Responsible Officials: The University has executed an agreement with a vendor to perform penetration and vulnerability assessments, which is expected to be completed by June 30, 2024.
Federal Program Information: Gramm-Leach-Bliley Act – Student Information Security
Criteria or Specific Requirement: Special Tests and Provisions – Gramm-Leach-Bliley Act – Student Information Security - The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). On December 9, 2021, the Federal Trade Commission (FTC) issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet.
Condition: The University did not fully comply with 1 out of the 9 elements included in the FTC’s regulations.
Cause: Lack of administrative oversight with respect to the new GLBA requirements.
Effect or Potential Effect: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Questioned Costs: None.
Context: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Identification as a Repeat Finding: There was no similar finding in the prior year.
Recommendation: We recommend that the University annually reviews the GLBA requirements for updates on a timely basis and implement the requirements before the due date.
Views of Responsible Officials: The University has executed an agreement with a vendor to perform penetration and vulnerability assessments, which is expected to be completed by June 30, 2024.
Federal Program Information: Gramm-Leach-Bliley Act – Student Information Security
Criteria or Specific Requirement: Special Tests and Provisions – Gramm-Leach-Bliley Act – Student Information Security - The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). On December 9, 2021, the Federal Trade Commission (FTC) issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet.
Condition: The University did not fully comply with 1 out of the 9 elements included in the FTC’s regulations.
Cause: Lack of administrative oversight with respect to the new GLBA requirements.
Effect or Potential Effect: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Questioned Costs: None.
Context: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Identification as a Repeat Finding: There was no similar finding in the prior year.
Recommendation: We recommend that the University annually reviews the GLBA requirements for updates on a timely basis and implement the requirements before the due date.
Views of Responsible Officials: The University has executed an agreement with a vendor to perform penetration and vulnerability assessments, which is expected to be completed by June 30, 2024.
Federal Program Information: Gramm-Leach-Bliley Act – Student Information Security
Criteria or Specific Requirement: Special Tests and Provisions – Gramm-Leach-Bliley Act – Student Information Security - The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). On December 9, 2021, the Federal Trade Commission (FTC) issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet.
Condition: The University did not fully comply with 1 out of the 9 elements included in the FTC’s regulations.
Cause: Lack of administrative oversight with respect to the new GLBA requirements.
Effect or Potential Effect: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Questioned Costs: None.
Context: The penetration and vulnerability assessments were not completed as of June 30, 2023.
Identification as a Repeat Finding: There was no similar finding in the prior year.
Recommendation: We recommend that the University annually reviews the GLBA requirements for updates on a timely basis and implement the requirements before the due date.
Views of Responsible Officials: The University has executed an agreement with a vendor to perform penetration and vulnerability assessments, which is expected to be completed by June 30, 2024.
Federal Program Information: Federal Work Study (ALN #84.033)
Criteria or Specific Requirement: Special Tests and Provisions – Disbursements to or on Behalf of Students – Federal Work Study - The University shall ensure that the student is paid at least once per month for wages earned.
Condition: Instances where the University did not retain adequate support for wages earned.
Cause: Lack of administrative oversight with respect to recordkeeping for timesheets.
Effect or Potential Effect: The University was not in compliance with disbursements to or on behalf of students for federal work study payments.
Questioned Costs: None above threshold
Context: For 2 of 25 payments selected for testing, the University was unable to locate the approved timesheets.
Identification as a Repeat Finding: There was no similar finding in the prior year.
Recommendation: We recommend the University retain the appropriate records for hours earned by work study students.
Views of Responsible Officials: For these 2 disbursements, the students did not report their time through the online payroll system but instead with physical timesheets. Due to the turnover and changing of positions of the payroll office, the timesheets were misfiled. The payroll department will scan and file all manual timesheets electronically in order to retain adequate records.
Federal Program Information: Federal Perkins Loan Program (ALN #84.038)
Criteria or Specific Requirement: Special Tests and Provisions – Perkins Loan Recordkeeping and Record Retention - Institutions must retain original or true and exact copies of promissory and master promissory notes (MPN), repayment records, and cancellation and deferment requests for each Perkins loan made, in a locked, fireproof container. (34 CFR 674.19.(e))
Condition: Instances where the University did not retain the original or true and exact copies of promissory notes.
Cause: Lack of administrative oversight with respect to recordkeeping and record retention related to the Federal Perkins Loan program (“Perkins”), including improper tracking and storage of records.
Effect or Potential Effect: The University was not in compliance with the Perkins loan recordkeeping and record retention requirements.
Questioned Costs: None.
Context: For 6 of 35 borrowers with open loans selected for testing, the University did not retain an original or true and exact copy of the promissory note. For 5 of 40 borrowers with retired loans within the previous three fiscal years and current fiscal year, the University did not retain the appropriate records.
Identification as a Repeat Finding: Yes – Finding 2022-003
Recommendation: We recommend the University retain the appropriate records for the required timeframe. We also recommend a full review of records on-hand.
Views of Responsible Officials: The Policy and Procedures manual has been updated to reflect this process. The Business Office has implemented measures to ensure that Perkins Promissory Notes are identified, stored, and accessible during their repayment and collection period. In addition to the current filing system, the Business Office will utilize management software for ease of access and recording.
To ensure that all remaining promissory notes are kept in accordance with Department of Education regulations, the Business Office will:
• Record all incoming promissory notes internally and externally.
• Promissory notes created prior to 2013 will be made digitally accessible through Perceptive Content, a secure content management system. Access to these promissory notes will only be accessible by parties with authorized access.
• Promissory notes created after 2013 will continue to be made available through Heartland ECSI’s third party filing system. ECSI records paid, completed, cancelled, and retired promissory notes that were created after 2013.
• In accordance with the Perkins Assignment and Liquidation Guide from the Department of Education (EA ID: General-21-53), all accounts with promissory notes unable to be located will be written off and/or purchased from the Department of Education. The University recorded an entry to repurchase open default loans as of June 30, 2023.