Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Assistance Cluster
Assistance Listing Number: 84.007 – Federal Supplemental Education Opportunity Grants
84.033 – Federal Work Study Program
84.038 – Federal Perkins Loans
84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.379 – Teacher Education Assistance for College and Higher Education Grants
Pass-Through Agency: N/A
Pass-Through Number(s): N/A
Award Period: June 1, 2023 to May 31, 2024
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: There is one item missing entirely from the WISP: CLA was not able to verify that the WISP provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution). These risks could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information. Additionally, the WISP should assess the sufficiency of any safeguards in place to control these risks.
There are five items included in draft policies; however, they are not implemented as of the end of the fiscal year: The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were in draft form in the WISP:
• Implement and periodically review access controls.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
In addition, the draft policy relating to how the institution will oversee its information system service providers (16 CFR 314.4(f)) was not formally implemented.
Questioned Costs: N/A
Context: These new GLBA requirements became applicable on June 9, 2023. However, there are a few elements missing from their WISP.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance as well as there was a general lack of capacity in IT staffing to formally implement the WISP during the year.
Effect: The student personal information could be vulnerable.
Repeat Finding: Yes – 2023-003
Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements and is formally implemented.
Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Assistance Cluster
Assistance Listing Number: 84.007 – Federal Supplemental Education Opportunity Grants
84.033 – Federal Work Study Program
84.038 – Federal Perkins Loans
84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.379 – Teacher Education Assistance for College and Higher Education Grants
Pass-Through Agency: N/A
Pass-Through Number(s): N/A
Award Period: June 1, 2023 to May 31, 2024
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: There is one item missing entirely from the WISP: CLA was not able to verify that the WISP provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution). These risks could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information. Additionally, the WISP should assess the sufficiency of any safeguards in place to control these risks.
There are five items included in draft policies; however, they are not implemented as of the end of the fiscal year: The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were in draft form in the WISP:
• Implement and periodically review access controls.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
In addition, the draft policy relating to how the institution will oversee its information system service providers (16 CFR 314.4(f)) was not formally implemented.
Questioned Costs: N/A
Context: These new GLBA requirements became applicable on June 9, 2023. However, there are a few elements missing from their WISP.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance as well as there was a general lack of capacity in IT staffing to formally implement the WISP during the year.
Effect: The student personal information could be vulnerable.
Repeat Finding: Yes – 2023-003
Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements and is formally implemented.
Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Assistance Cluster
Assistance Listing Number: 84.007 – Federal Supplemental Education Opportunity Grants
84.033 – Federal Work Study Program
84.038 – Federal Perkins Loans
84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.379 – Teacher Education Assistance for College and Higher Education Grants
Pass-Through Agency: N/A
Pass-Through Number(s): N/A
Award Period: June 1, 2023 to May 31, 2024
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: There is one item missing entirely from the WISP: CLA was not able to verify that the WISP provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution). These risks could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information. Additionally, the WISP should assess the sufficiency of any safeguards in place to control these risks.
There are five items included in draft policies; however, they are not implemented as of the end of the fiscal year: The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were in draft form in the WISP:
• Implement and periodically review access controls.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
In addition, the draft policy relating to how the institution will oversee its information system service providers (16 CFR 314.4(f)) was not formally implemented.
Questioned Costs: N/A
Context: These new GLBA requirements became applicable on June 9, 2023. However, there are a few elements missing from their WISP.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance as well as there was a general lack of capacity in IT staffing to formally implement the WISP during the year.
Effect: The student personal information could be vulnerable.
Repeat Finding: Yes – 2023-003
Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements and is formally implemented.
Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Assistance Cluster
Assistance Listing Number: 84.007 – Federal Supplemental Education Opportunity Grants
84.033 – Federal Work Study Program
84.038 – Federal Perkins Loans
84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.379 – Teacher Education Assistance for College and Higher Education Grants
Pass-Through Agency: N/A
Pass-Through Number(s): N/A
Award Period: June 1, 2023 to May 31, 2024
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: There is one item missing entirely from the WISP: CLA was not able to verify that the WISP provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution). These risks could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information. Additionally, the WISP should assess the sufficiency of any safeguards in place to control these risks.
There are five items included in draft policies; however, they are not implemented as of the end of the fiscal year: The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were in draft form in the WISP:
• Implement and periodically review access controls.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
In addition, the draft policy relating to how the institution will oversee its information system service providers (16 CFR 314.4(f)) was not formally implemented.
Questioned Costs: N/A
Context: These new GLBA requirements became applicable on June 9, 2023. However, there are a few elements missing from their WISP.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance as well as there was a general lack of capacity in IT staffing to formally implement the WISP during the year.
Effect: The student personal information could be vulnerable.
Repeat Finding: Yes – 2023-003
Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements and is formally implemented.
Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Assistance Cluster
Assistance Listing Number: 84.007 – Federal Supplemental Education Opportunity Grants
84.033 – Federal Work Study Program
84.038 – Federal Perkins Loans
84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.379 – Teacher Education Assistance for College and Higher Education Grants
Pass-Through Agency: N/A
Pass-Through Number(s): N/A
Award Period: June 1, 2023 to May 31, 2024
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: There is one item missing entirely from the WISP: CLA was not able to verify that the WISP provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution). These risks could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information. Additionally, the WISP should assess the sufficiency of any safeguards in place to control these risks.
There are five items included in draft policies; however, they are not implemented as of the end of the fiscal year: The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were in draft form in the WISP:
• Implement and periodically review access controls.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
In addition, the draft policy relating to how the institution will oversee its information system service providers (16 CFR 314.4(f)) was not formally implemented.
Questioned Costs: N/A
Context: These new GLBA requirements became applicable on June 9, 2023. However, there are a few elements missing from their WISP.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance as well as there was a general lack of capacity in IT staffing to formally implement the WISP during the year.
Effect: The student personal information could be vulnerable.
Repeat Finding: Yes – 2023-003
Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements and is formally implemented.
Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Assistance Cluster
Assistance Listing Number: 84.007 – Federal Supplemental Education Opportunity Grants
84.033 – Federal Work Study Program
84.038 – Federal Perkins Loans
84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.379 – Teacher Education Assistance for College and Higher Education Grants
Pass-Through Agency: N/A
Pass-Through Number(s): N/A
Award Period: June 1, 2023 to May 31, 2024
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: There is one item missing entirely from the WISP: CLA was not able to verify that the WISP provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution). These risks could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information. Additionally, the WISP should assess the sufficiency of any safeguards in place to control these risks.
There are five items included in draft policies; however, they are not implemented as of the end of the fiscal year: The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were in draft form in the WISP:
• Implement and periodically review access controls.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
In addition, the draft policy relating to how the institution will oversee its information system service providers (16 CFR 314.4(f)) was not formally implemented.
Questioned Costs: N/A
Context: These new GLBA requirements became applicable on June 9, 2023. However, there are a few elements missing from their WISP.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance as well as there was a general lack of capacity in IT staffing to formally implement the WISP during the year.
Effect: The student personal information could be vulnerable.
Repeat Finding: Yes – 2023-003
Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements and is formally implemented.
Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Assistance Cluster
Assistance Listing Number: 84.007 – Federal Supplemental Education Opportunity Grants
84.033 – Federal Work Study Program
84.038 – Federal Perkins Loans
84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.379 – Teacher Education Assistance for College and Higher Education Grants
Pass-Through Agency: N/A
Pass-Through Number(s): N/A
Award Period: June 1, 2023 to May 31, 2024
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: There is one item missing entirely from the WISP: CLA was not able to verify that the WISP provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution). These risks could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information. Additionally, the WISP should assess the sufficiency of any safeguards in place to control these risks.
There are five items included in draft policies; however, they are not implemented as of the end of the fiscal year: The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were in draft form in the WISP:
• Implement and periodically review access controls.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
In addition, the draft policy relating to how the institution will oversee its information system service providers (16 CFR 314.4(f)) was not formally implemented.
Questioned Costs: N/A
Context: These new GLBA requirements became applicable on June 9, 2023. However, there are a few elements missing from their WISP.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance as well as there was a general lack of capacity in IT staffing to formally implement the WISP during the year.
Effect: The student personal information could be vulnerable.
Repeat Finding: Yes – 2023-003
Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements and is formally implemented.
Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Assistance Cluster
Assistance Listing Number: 84.007 – Federal Supplemental Education Opportunity Grants
84.033 – Federal Work Study Program
84.038 – Federal Perkins Loans
84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.379 – Teacher Education Assistance for College and Higher Education Grants
Pass-Through Agency: N/A
Pass-Through Number(s): N/A
Award Period: June 1, 2023 to May 31, 2024
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: There is one item missing entirely from the WISP: CLA was not able to verify that the WISP provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution). These risks could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information. Additionally, the WISP should assess the sufficiency of any safeguards in place to control these risks.
There are five items included in draft policies; however, they are not implemented as of the end of the fiscal year: The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were in draft form in the WISP:
• Implement and periodically review access controls.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
In addition, the draft policy relating to how the institution will oversee its information system service providers (16 CFR 314.4(f)) was not formally implemented.
Questioned Costs: N/A
Context: These new GLBA requirements became applicable on June 9, 2023. However, there are a few elements missing from their WISP.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance as well as there was a general lack of capacity in IT staffing to formally implement the WISP during the year.
Effect: The student personal information could be vulnerable.
Repeat Finding: Yes – 2023-003
Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements and is formally implemented.
Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Assistance Cluster
Assistance Listing Number: 84.007 – Federal Supplemental Education Opportunity Grants
84.033 – Federal Work Study Program
84.038 – Federal Perkins Loans
84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.379 – Teacher Education Assistance for College and Higher Education Grants
Pass-Through Agency: N/A
Pass-Through Number(s): N/A
Award Period: June 1, 2023 to May 31, 2024
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: There is one item missing entirely from the WISP: CLA was not able to verify that the WISP provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution). These risks could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information. Additionally, the WISP should assess the sufficiency of any safeguards in place to control these risks.
There are five items included in draft policies; however, they are not implemented as of the end of the fiscal year: The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were in draft form in the WISP:
• Implement and periodically review access controls.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
In addition, the draft policy relating to how the institution will oversee its information system service providers (16 CFR 314.4(f)) was not formally implemented.
Questioned Costs: N/A
Context: These new GLBA requirements became applicable on June 9, 2023. However, there are a few elements missing from their WISP.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance as well as there was a general lack of capacity in IT staffing to formally implement the WISP during the year.
Effect: The student personal information could be vulnerable.
Repeat Finding: Yes – 2023-003
Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements and is formally implemented.
Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Assistance Cluster
Assistance Listing Number: 84.007 – Federal Supplemental Education Opportunity Grants
84.033 – Federal Work Study Program
84.038 – Federal Perkins Loans
84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.379 – Teacher Education Assistance for College and Higher Education Grants
Pass-Through Agency: N/A
Pass-Through Number(s): N/A
Award Period: June 1, 2023 to May 31, 2024
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: There is one item missing entirely from the WISP: CLA was not able to verify that the WISP provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution). These risks could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information. Additionally, the WISP should assess the sufficiency of any safeguards in place to control these risks.
There are five items included in draft policies; however, they are not implemented as of the end of the fiscal year: The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were in draft form in the WISP:
• Implement and periodically review access controls.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
In addition, the draft policy relating to how the institution will oversee its information system service providers (16 CFR 314.4(f)) was not formally implemented.
Questioned Costs: N/A
Context: These new GLBA requirements became applicable on June 9, 2023. However, there are a few elements missing from their WISP.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance as well as there was a general lack of capacity in IT staffing to formally implement the WISP during the year.
Effect: The student personal information could be vulnerable.
Repeat Finding: Yes – 2023-003
Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements and is formally implemented.
Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Assistance Cluster
Assistance Listing Number: 84.007 – Federal Supplemental Education Opportunity Grants
84.033 – Federal Work Study Program
84.038 – Federal Perkins Loans
84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.379 – Teacher Education Assistance for College and Higher Education Grants
Pass-Through Agency: N/A
Pass-Through Number(s): N/A
Award Period: June 1, 2023 to May 31, 2024
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: There is one item missing entirely from the WISP: CLA was not able to verify that the WISP provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution). These risks could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information. Additionally, the WISP should assess the sufficiency of any safeguards in place to control these risks.
There are five items included in draft policies; however, they are not implemented as of the end of the fiscal year: The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were in draft form in the WISP:
• Implement and periodically review access controls.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
In addition, the draft policy relating to how the institution will oversee its information system service providers (16 CFR 314.4(f)) was not formally implemented.
Questioned Costs: N/A
Context: These new GLBA requirements became applicable on June 9, 2023. However, there are a few elements missing from their WISP.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance as well as there was a general lack of capacity in IT staffing to formally implement the WISP during the year.
Effect: The student personal information could be vulnerable.
Repeat Finding: Yes – 2023-003
Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements and is formally implemented.
Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Assistance Cluster
Assistance Listing Number: 84.007 – Federal Supplemental Education Opportunity Grants
84.033 – Federal Work Study Program
84.038 – Federal Perkins Loans
84.063 – Federal Pell Grant Program
84.268 – Federal Direct Student Loans
84.379 – Teacher Education Assistance for College and Higher Education Grants
Pass-Through Agency: N/A
Pass-Through Number(s): N/A
Award Period: June 1, 2023 to May 31, 2024
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program (WISP) to include nine elements for institutions with 5,000 or more customers (16 CFR 314.3(a)). The WISP for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its WISP are outlined in 16 CFR 314.4. At a minimum, the institution’s WISP must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), including assessing apps developed by the institution. Additionally, the written security program must provide for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
Condition: There is one item missing entirely from the WISP: CLA was not able to verify that the WISP provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution). These risks could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information. Additionally, the WISP should assess the sufficiency of any safeguards in place to control these risks.
There are five items included in draft policies; however, they are not implemented as of the end of the fiscal year: The following minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) were in draft form in the WISP:
• Implement and periodically review access controls.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
In addition, the draft policy relating to how the institution will oversee its information system service providers (16 CFR 314.4(f)) was not formally implemented.
Questioned Costs: N/A
Context: These new GLBA requirements became applicable on June 9, 2023. However, there are a few elements missing from their WISP.
Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance as well as there was a general lack of capacity in IT staffing to formally implement the WISP during the year.
Effect: The student personal information could be vulnerable.
Repeat Finding: Yes – 2023-003
Auditor’s Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements and is formally implemented.
Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.