Finding 2024-008
Personnel Responsible for Corrective Action: Chief Information Officer - Vacant
Anticipated Completion Date: August 31, 2025
Corrective Action Plan: Harris-Stowe State University acknowledges the audit finding regarding noncompliance with the Gramm-Leach-Bliley Act (GLBA) and t...
Finding 2024-008
Personnel Responsible for Corrective Action: Chief Information Officer - Vacant
Anticipated Completion Date: August 31, 2025
Corrective Action Plan: Harris-Stowe State University acknowledges the audit finding regarding noncompliance with the Gramm-Leach-Bliley Act (GLBA) and the FTC Safeguards Rule. In response, the University has collaborated with Omega Technical Solutions and ileap Group to execute a comprehensive cybersecurity compliance and modernization initiative. As of the audit period close, over 90% of related deficiencies have been remediated.
Specific corrective actions taken or underway include:
1. Written Information Security Program (WISP): A formal WISP has been developed and implemented. It outlines oversight structures, risk management strategies, testing protocols, and required safeguards in alignment with 16 CFR 314.4.
2. Risk Assessment: A comprehensive risk scorecard was created. All Active Directory accounts were reviewed and flagged for deactivation or role reassignment as appropriate.
3. Access and Encryption Controls: Encryption is now deployed across all active endpoints. Logical access control and encryption policies have been adopted and published. Multi-factor authentication (MFA) is enforced for all systems handling student data.
4. Account Management and Role-Based Access: RBAC policies have been established and account provisioning is now formally documented and managed.
5. Retention, Change Management, and Training: A written data retention policy and formal change management procedures are now in place. An onboarding cybersecurity training program has been developed, with full implementation scheduled by August 31, 2025.
6. Legacy Server Risk Mitigation: One legacy Microsoft 2008 server has failed and is decommissioned. The remaining server is isolated, monitored with NIST- and Microsoft Sentinel-aligned tools, and pending full replacement as part of the upcoming infrastructure upgrade.
7. Ongoing Monitoring and Vendor Oversight: TCPM-aligned monitoring practices and vendor oversight protocols are now active and included in the WISP framework.
The University’s IT Security SharePoint site houses all related documentation and is structured to support transparency, audit readiness, and continued compliance oversight.