Audit 391461

Finding number: 2025-001 Federal agency: U.S. Department of Education Programs: Student Financial Assistance (SFA) Cluster Assistance Listing Number: 84.007, 84.033, 84.268, 84.063 Award year: 2025 Criteria The Code of Federal Regulations, consisting of 2 CFR 200.303, 16 CFR 314.3(a), and 16 CFR 314, requires that financial institutions, including institutions participating in Title IV programs, develop, implement, and maintain a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to the sensitivity of the information being protected aligned with federal information security standards. Condition During our testing of the SFA Cluster, we requested the College’s Written Information Security Plan (WISP). The Colleges were unable to provide a formal, documented WISP. The Colleges' general IT policies and procedures provided did not fully meet WISP requirements. Cause The Colleges have not developed or formalized a standalone WISP. Effect Without a formalized WISP, the Colleges are at a heighted risk of inadequate safeguarding of sensitive data, inconsistent application of security practices and procedures, and an increased likelihood of unauthorized access, data loss or misuse. Questioned Costs N/A Perspective Due to its nature, this deficiency is systemic, affecting the entire SFA Cluster population and related programs. Identification as a Repeat Finding, if applicable N/A Recommendation The Colleges should develop, approve, and implement a Written Information Security Plan (WISP) aligned with 16 CFR Part 314 requirements and tailored to the systems and data associated with the SFA Cluster. View of Responsible Officials The Colleges agree with the finding. This issue was the result of information security policies that did not reflect actual current practices. Such current practices were updated over the last two years in response to industry standards, insurance requirements, and Gramm Leach Billey Act requirements, which are believed to meet the requirements of these regulations. However, because they were not documented formally in a comprehensive policy form, they could not be adequately provided during the audit. In early Fall 2025, the Colleges hired a new Chief Information Security Officer (CISO), who has begun overhauling the information security policies to reflect current practices. The CISO has also created a preliminary draft of a WISP that reflects the Colleges current policies and procedures. This WISP is expected to be completed and implemented during fiscal year 2026, pending board review and approval.