2023-003 – Student Financial Assistance Cluster – Special Tests and Provisions – Student Information Security
Criteria or specific requirement
The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and are subject to the GBLA. 16 CFR Part 314 requires that information safeguarding standards be implemented by institutions and establishes minimum standards that must be met. Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. This written information is required to include seven elements, and institutions were required to be in compliance no later than June 9, 2023.
Condition
During testing, it was determined that the College’s written policies did not reflect one of the seven required elements.
Context
The element that was not in compliance is as follows: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards referenced above include: implement and periodically review access controls; conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted; encrypt customer information on the institution’s system and when it is in transit; assess apps developed by the institution; implement multi-factor authentication for anyone accessing customer information on the institution’s system; dispose of customer information securely; anticipate and evaluate changes to the information system or network; and maintain a log of authorized users’ activity and keep an eye out for unauthorized access. The College had not implemented multi-factor authentication for anyone accessing customer information on its system. The College also did not have a written policy regarding the secure disposal of customer information.
Cause
The College is in the process of implementing the required aspects of the element, but it was not in compliance by the required date.
Effect
The College’s written policies did not meet the minimum standards established by 16 CFR Part 314.
Recommendation
We recommend that the College’s written policies be updated to properly reflect all seven elements required.
Views of responsible officials
See Corrective Action Plan.
2023-004 – Student Financial Assistance Cluster – Special Tests and Provisions – NSLDS Enrollment Reporting
Criteria or specific requirement
Institutions are required to report enrollment information under the Pell Grant Program and the Federal Direct Student Loans via the National Student Loan Data System (NSLDS). Because the administration of the Title IV programs depends heavily upon the accuracy and timeliness of the enrollment information reported by institutions, they must review, update, and certify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file.
Condition
During testing, it was determined that six of the 20 students tested for enrollment status changes did not have those changes properly reflected within their NSLDS records.
Context
Three of the six students graduated and did not enroll in a subsequent semester, but they did not have their graduated status reported. Two of the students were reported at a higher enrollment level than their actual credit hours reflected. The final student attended the College in the spring of 2023, but they did not enroll in any subsequent semesters. Their withdrawn status was not reported within the required timeframe.
Cause
Technological errors occurred during the reporting process, such as errors not being sent back to the College by the Clearinghouse, as well as the time calculation report not properly calculating a student’s enrollment status.
Effect
Students did not have accurate, timely information reported within NSLDS.
Recommendation
We recommend that the College review its control policies to ensure that reporting is completed accurately and timely. Wherever possible, any technological errors discovered should be pursued with the responsible party in order to try to determine a cause, and a solution or preventative measure should be implemented to prevent future errors from occurring.
Views of responsible officials
See Corrective Action Plan.
2023-003 – Student Financial Assistance Cluster – Special Tests and Provisions – Student Information Security
Criteria or specific requirement
The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and are subject to the GBLA. 16 CFR Part 314 requires that information safeguarding standards be implemented by institutions and establishes minimum standards that must be met. Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. This written information is required to include seven elements, and institutions were required to be in compliance no later than June 9, 2023.
Condition
During testing, it was determined that the College’s written policies did not reflect one of the seven required elements.
Context
The element that was not in compliance is as follows: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards referenced above include: implement and periodically review access controls; conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted; encrypt customer information on the institution’s system and when it is in transit; assess apps developed by the institution; implement multi-factor authentication for anyone accessing customer information on the institution’s system; dispose of customer information securely; anticipate and evaluate changes to the information system or network; and maintain a log of authorized users’ activity and keep an eye out for unauthorized access. The College had not implemented multi-factor authentication for anyone accessing customer information on its system. The College also did not have a written policy regarding the secure disposal of customer information.
Cause
The College is in the process of implementing the required aspects of the element, but it was not in compliance by the required date.
Effect
The College’s written policies did not meet the minimum standards established by 16 CFR Part 314.
Recommendation
We recommend that the College’s written policies be updated to properly reflect all seven elements required.
Views of responsible officials
See Corrective Action Plan.
2023-003 – Student Financial Assistance Cluster – Special Tests and Provisions – Student Information Security
Criteria or specific requirement
The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and are subject to the GBLA. 16 CFR Part 314 requires that information safeguarding standards be implemented by institutions and establishes minimum standards that must be met. Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. This written information is required to include seven elements, and institutions were required to be in compliance no later than June 9, 2023.
Condition
During testing, it was determined that the College’s written policies did not reflect one of the seven required elements.
Context
The element that was not in compliance is as follows: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards referenced above include: implement and periodically review access controls; conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted; encrypt customer information on the institution’s system and when it is in transit; assess apps developed by the institution; implement multi-factor authentication for anyone accessing customer information on the institution’s system; dispose of customer information securely; anticipate and evaluate changes to the information system or network; and maintain a log of authorized users’ activity and keep an eye out for unauthorized access. The College had not implemented multi-factor authentication for anyone accessing customer information on its system. The College also did not have a written policy regarding the secure disposal of customer information.
Cause
The College is in the process of implementing the required aspects of the element, but it was not in compliance by the required date.
Effect
The College’s written policies did not meet the minimum standards established by 16 CFR Part 314.
Recommendation
We recommend that the College’s written policies be updated to properly reflect all seven elements required.
Views of responsible officials
See Corrective Action Plan.
2023-003 – Student Financial Assistance Cluster – Special Tests and Provisions – Student Information Security
Criteria or specific requirement
The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and are subject to the GBLA. 16 CFR Part 314 requires that information safeguarding standards be implemented by institutions and establishes minimum standards that must be met. Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. This written information is required to include seven elements, and institutions were required to be in compliance no later than June 9, 2023.
Condition
During testing, it was determined that the College’s written policies did not reflect one of the seven required elements.
Context
The element that was not in compliance is as follows: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards referenced above include: implement and periodically review access controls; conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted; encrypt customer information on the institution’s system and when it is in transit; assess apps developed by the institution; implement multi-factor authentication for anyone accessing customer information on the institution’s system; dispose of customer information securely; anticipate and evaluate changes to the information system or network; and maintain a log of authorized users’ activity and keep an eye out for unauthorized access. The College had not implemented multi-factor authentication for anyone accessing customer information on its system. The College also did not have a written policy regarding the secure disposal of customer information.
Cause
The College is in the process of implementing the required aspects of the element, but it was not in compliance by the required date.
Effect
The College’s written policies did not meet the minimum standards established by 16 CFR Part 314.
Recommendation
We recommend that the College’s written policies be updated to properly reflect all seven elements required.
Views of responsible officials
See Corrective Action Plan.
2023-004 – Student Financial Assistance Cluster – Special Tests and Provisions – NSLDS Enrollment Reporting
Criteria or specific requirement
Institutions are required to report enrollment information under the Pell Grant Program and the Federal Direct Student Loans via the National Student Loan Data System (NSLDS). Because the administration of the Title IV programs depends heavily upon the accuracy and timeliness of the enrollment information reported by institutions, they must review, update, and certify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file.
Condition
During testing, it was determined that six of the 20 students tested for enrollment status changes did not have those changes properly reflected within their NSLDS records.
Context
Three of the six students graduated and did not enroll in a subsequent semester, but they did not have their graduated status reported. Two of the students were reported at a higher enrollment level than their actual credit hours reflected. The final student attended the College in the spring of 2023, but they did not enroll in any subsequent semesters. Their withdrawn status was not reported within the required timeframe.
Cause
Technological errors occurred during the reporting process, such as errors not being sent back to the College by the Clearinghouse, as well as the time calculation report not properly calculating a student’s enrollment status.
Effect
Students did not have accurate, timely information reported within NSLDS.
Recommendation
We recommend that the College review its control policies to ensure that reporting is completed accurately and timely. Wherever possible, any technological errors discovered should be pursued with the responsible party in order to try to determine a cause, and a solution or preventative measure should be implemented to prevent future errors from occurring.
Views of responsible officials
See Corrective Action Plan.
2023-003 – Student Financial Assistance Cluster – Special Tests and Provisions – Student Information Security
Criteria or specific requirement
The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and are subject to the GBLA. 16 CFR Part 314 requires that information safeguarding standards be implemented by institutions and establishes minimum standards that must be met. Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. This written information is required to include seven elements, and institutions were required to be in compliance no later than June 9, 2023.
Condition
During testing, it was determined that the College’s written policies did not reflect one of the seven required elements.
Context
The element that was not in compliance is as follows: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards referenced above include: implement and periodically review access controls; conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted; encrypt customer information on the institution’s system and when it is in transit; assess apps developed by the institution; implement multi-factor authentication for anyone accessing customer information on the institution’s system; dispose of customer information securely; anticipate and evaluate changes to the information system or network; and maintain a log of authorized users’ activity and keep an eye out for unauthorized access. The College had not implemented multi-factor authentication for anyone accessing customer information on its system. The College also did not have a written policy regarding the secure disposal of customer information.
Cause
The College is in the process of implementing the required aspects of the element, but it was not in compliance by the required date.
Effect
The College’s written policies did not meet the minimum standards established by 16 CFR Part 314.
Recommendation
We recommend that the College’s written policies be updated to properly reflect all seven elements required.
Views of responsible officials
See Corrective Action Plan.
2023-004 – Student Financial Assistance Cluster – Special Tests and Provisions – NSLDS Enrollment Reporting
Criteria or specific requirement
Institutions are required to report enrollment information under the Pell Grant Program and the Federal Direct Student Loans via the National Student Loan Data System (NSLDS). Because the administration of the Title IV programs depends heavily upon the accuracy and timeliness of the enrollment information reported by institutions, they must review, update, and certify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file.
Condition
During testing, it was determined that six of the 20 students tested for enrollment status changes did not have those changes properly reflected within their NSLDS records.
Context
Three of the six students graduated and did not enroll in a subsequent semester, but they did not have their graduated status reported. Two of the students were reported at a higher enrollment level than their actual credit hours reflected. The final student attended the College in the spring of 2023, but they did not enroll in any subsequent semesters. Their withdrawn status was not reported within the required timeframe.
Cause
Technological errors occurred during the reporting process, such as errors not being sent back to the College by the Clearinghouse, as well as the time calculation report not properly calculating a student’s enrollment status.
Effect
Students did not have accurate, timely information reported within NSLDS.
Recommendation
We recommend that the College review its control policies to ensure that reporting is completed accurately and timely. Wherever possible, any technological errors discovered should be pursued with the responsible party in order to try to determine a cause, and a solution or preventative measure should be implemented to prevent future errors from occurring.
Views of responsible officials
See Corrective Action Plan.
2023-003 – Student Financial Assistance Cluster – Special Tests and Provisions – Student Information Security
Criteria or specific requirement
The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and are subject to the GBLA. 16 CFR Part 314 requires that information safeguarding standards be implemented by institutions and establishes minimum standards that must be met. Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. This written information is required to include seven elements, and institutions were required to be in compliance no later than June 9, 2023.
Condition
During testing, it was determined that the College’s written policies did not reflect one of the seven required elements.
Context
The element that was not in compliance is as follows: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards referenced above include: implement and periodically review access controls; conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted; encrypt customer information on the institution’s system and when it is in transit; assess apps developed by the institution; implement multi-factor authentication for anyone accessing customer information on the institution’s system; dispose of customer information securely; anticipate and evaluate changes to the information system or network; and maintain a log of authorized users’ activity and keep an eye out for unauthorized access. The College had not implemented multi-factor authentication for anyone accessing customer information on its system. The College also did not have a written policy regarding the secure disposal of customer information.
Cause
The College is in the process of implementing the required aspects of the element, but it was not in compliance by the required date.
Effect
The College’s written policies did not meet the minimum standards established by 16 CFR Part 314.
Recommendation
We recommend that the College’s written policies be updated to properly reflect all seven elements required.
Views of responsible officials
See Corrective Action Plan.
2023-003 – Student Financial Assistance Cluster – Special Tests and Provisions – Student Information Security
Criteria or specific requirement
The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and are subject to the GBLA. 16 CFR Part 314 requires that information safeguarding standards be implemented by institutions and establishes minimum standards that must be met. Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. This written information is required to include seven elements, and institutions were required to be in compliance no later than June 9, 2023.
Condition
During testing, it was determined that the College’s written policies did not reflect one of the seven required elements.
Context
The element that was not in compliance is as follows: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards referenced above include: implement and periodically review access controls; conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted; encrypt customer information on the institution’s system and when it is in transit; assess apps developed by the institution; implement multi-factor authentication for anyone accessing customer information on the institution’s system; dispose of customer information securely; anticipate and evaluate changes to the information system or network; and maintain a log of authorized users’ activity and keep an eye out for unauthorized access. The College had not implemented multi-factor authentication for anyone accessing customer information on its system. The College also did not have a written policy regarding the secure disposal of customer information.
Cause
The College is in the process of implementing the required aspects of the element, but it was not in compliance by the required date.
Effect
The College’s written policies did not meet the minimum standards established by 16 CFR Part 314.
Recommendation
We recommend that the College’s written policies be updated to properly reflect all seven elements required.
Views of responsible officials
See Corrective Action Plan.
2023-003 – Student Financial Assistance Cluster – Special Tests and Provisions – Student Information Security
Criteria or specific requirement
The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and are subject to the GBLA. 16 CFR Part 314 requires that information safeguarding standards be implemented by institutions and establishes minimum standards that must be met. Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. This written information is required to include seven elements, and institutions were required to be in compliance no later than June 9, 2023.
Condition
During testing, it was determined that the College’s written policies did not reflect one of the seven required elements.
Context
The element that was not in compliance is as follows: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards referenced above include: implement and periodically review access controls; conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted; encrypt customer information on the institution’s system and when it is in transit; assess apps developed by the institution; implement multi-factor authentication for anyone accessing customer information on the institution’s system; dispose of customer information securely; anticipate and evaluate changes to the information system or network; and maintain a log of authorized users’ activity and keep an eye out for unauthorized access. The College had not implemented multi-factor authentication for anyone accessing customer information on its system. The College also did not have a written policy regarding the secure disposal of customer information.
Cause
The College is in the process of implementing the required aspects of the element, but it was not in compliance by the required date.
Effect
The College’s written policies did not meet the minimum standards established by 16 CFR Part 314.
Recommendation
We recommend that the College’s written policies be updated to properly reflect all seven elements required.
Views of responsible officials
See Corrective Action Plan.
2023-004 – Student Financial Assistance Cluster – Special Tests and Provisions – NSLDS Enrollment Reporting
Criteria or specific requirement
Institutions are required to report enrollment information under the Pell Grant Program and the Federal Direct Student Loans via the National Student Loan Data System (NSLDS). Because the administration of the Title IV programs depends heavily upon the accuracy and timeliness of the enrollment information reported by institutions, they must review, update, and certify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file.
Condition
During testing, it was determined that six of the 20 students tested for enrollment status changes did not have those changes properly reflected within their NSLDS records.
Context
Three of the six students graduated and did not enroll in a subsequent semester, but they did not have their graduated status reported. Two of the students were reported at a higher enrollment level than their actual credit hours reflected. The final student attended the College in the spring of 2023, but they did not enroll in any subsequent semesters. Their withdrawn status was not reported within the required timeframe.
Cause
Technological errors occurred during the reporting process, such as errors not being sent back to the College by the Clearinghouse, as well as the time calculation report not properly calculating a student’s enrollment status.
Effect
Students did not have accurate, timely information reported within NSLDS.
Recommendation
We recommend that the College review its control policies to ensure that reporting is completed accurately and timely. Wherever possible, any technological errors discovered should be pursued with the responsible party in order to try to determine a cause, and a solution or preventative measure should be implemented to prevent future errors from occurring.
Views of responsible officials
See Corrective Action Plan.