Action Plan For the Year Ended May 31, 2022 Finding 2022-002 Section III ? Federal and State Awards Findings and Questioned Costs Assistance listing number(s), federal agency, and program name: 84.063, 84.007, 84.033, and 84.268; United States Department of Education (DOE), Student financial aid clu...
Action Plan For the Year Ended May 31, 2022 Finding 2022-002 Section III ? Federal and State Awards Findings and Questioned Costs Assistance listing number(s), federal agency, and program name: 84.063, 84.007, 84.033, and 84.268; United States Department of Education (DOE), Student financial aid cluster. Finding type: Noncompliance Criteria: The Institute is responsible for safeguarding sensitive data under the Gramm-Leach-Bliley Act, including performing a risk assessment that addresses three required areas noted in 16 CFR 314.4 (b). Statement of condition: A formal risk assessment is not documented which addresses required areas noted in 16 CFR 314.4 (b). Questioned costs: Questioned costs could not be determined. Context: The Institute has safeguards for each area identified within 16 CFR 314.4 (b) in place; however a formal risk assessment and documentation of the relevant safeguards implemented by the Institute to address the risks is not documented. Cause: There is no formal risk assessment documented. Effect: The Institute has no verifiable evidence of the risk assessment performed and the related safeguard for each risk identified. Recommendation: We recommend management review 16 CFR 314.4 (b) to perform a risk assessment that addresses the three required areas, which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures. Management?s Response: Management agrees with the finding. Corrective Action: MIAD will review 16 CFR 314.4 (b) and develop a written Information Security Plan (ISP) that outlines the procedures and practices to protect non-public personal information (NPI) and manage information security risks. MIAD will provide routinely scheduled training to all current and new employees on the importance of protecting NPI and the procedures they must follow, to ensure that employees are up-to-date with the latest information security best practices. MIAD will continue to conduct regular risk assessments to identify potential security vulnerabilities, both internal and external, to evaluate the effectiveness of the ISP. MIAD will develop a plan to investigate and respond to security incidents that may compromise NPI. If an incident occurs MIAD will follow the ISP to remedy the incident, and revise the ISP as needed. Matt Ogden Director of Technology 414.847.3223 mattogden@miad.edu February 14th 2023