Department of Education
2023-013 The Gramm-Leach-Bliley Act (GLBA)Compliance (ASU)
Student Financial Aid Cluster – Assistance Listing No. 84.007, 84.033, 84.063, 84.268
Auditors’ Recommendation: The Institution is required to perform Safeguards that address the required areas noted in GLBA 16 CFR 31...
Department of Education
2023-013 The Gramm-Leach-Bliley Act (GLBA)Compliance (ASU)
Student Financial Aid Cluster – Assistance Listing No. 84.007, 84.033, 84.063, 84.268
Auditors’ Recommendation: The Institution is required to perform Safeguards that address the required areas noted in GLBA 16 CFR 314.4, which are (1) the Institution designated a Qualified Individual responsible for implementing and monitoring the Institution’s information security program, (2) the Institution’s written information security program addresses the required minimum seven elements. CLA identified that the organization does not meet compliance requirements outlined in the GLBA Safeguards Rule. The institution’s policy identifies a qualified individual (such as a CIO, ISO, CISO) responsible for the Information Security program. In addition, the written information security program (WISP) did not address certain required elements. CLA recommends that the safeguards are updated/performed per GLBA requirements.
Explanation of disagreement with audit finding: There is no disagreement with the audit finding.
Action taken in response to finding: The Center for Information Technology Services is moving towards completion of the GLBA 16 CFR 314.4 requirements:
a) Fully Compliant
b) Fully Compliant
c) Partially Compliant
d) Fully Compliant
e) Fully Compliant
f) Vendor Management policy and program in design
g) Fully Compliant
h) IR Plan in draft
i) Not Completed
To address “Qualified Individual”, the university has retained vCISO services of Pileum, reporting to the CIO. Pileum is providing annual risk assessments and assisting with authoring/auditing required controls, policy, procedures, and security program documentation.
All in-progress requirements and the published university statement of compliance will be completed by May 31, 2024
Name(s) of the contact person(s) responsible for corrective action: Desmond L. Stewart, Interim Chief Information Officer
Planned completion date for corrective action plan: May 31, 2024
If the U.S. Department of Education has questions regarding these plans, please call Juanita Edwards at 601-877-6672.
2023-013 The Gramm-Leach-Bliley Act (GLBA) Compliance (MVSU)
Student Financial Aid Cluster – Assistance Listing No. 84.007, 84.033, 84.063, 84.268
Auditors’ Recommendation: The Institution is required to perform Safeguards that address the required areas noted in GLBA 16 CFR 314.4, which are (1) the Institution designated a Qualified Individual responsible for implementing and monitoring the Institution’s information security program, (2) the Institution’s written information security program addresses the required minimum seven elements. CLA identified that the organization does not meet the following compliance requirements outlined in the GLBA Safeguards Rule. (b.1b) The institution has been approved by the individual leading the information security program (b.3) The institution’s written information security program and verify the implementation of safeguards b.3.1 to b.3.8. (b.3.5) the institution's written information security program identifies the use of multi-factor authentication for individuals accessing sensitive information across systems. (b.3.7) the institution’s written information security program includes an adopted change management policy with procedures documented accordingly.
Explanation of disagreement with audit finding: There is no disagreement with the audit finding.
Action taken in response to finding: We have engaged with Pileum Corporation, who have given us a Cybersecurity Scorecard. This scorecard evaluated on five NIST controls: 1. Identify, 2. Protect, 3. Detect, 4. Respond, and 5. Recover. The scorecard tells us what is: 1. Effectively controlled, 2. Gaps identified, and 3. Not implemented. According to this report, there are 60% of the items listed that are not yet implemented. One of the main points of interest is the lack of a comprehensive plan which fully addresses: 1. Information systems, including network and software design, as well as information processing, storage, transmission, and disposal and 2. Detecting, preventing and responding to attacks, intrusion, or other systems failures. We are making this a priority to complete by the end of December 2024.
Name of the contact person responsible for corrective action: Dameon A. Shaw, Vice President for University Advancement, External Relations and Information Security.
Planned completion date for corrective action plan: December 2024.
If the Department of Education has any questions regarding this plan, please call Dameon Shaw at 662-254-3790.