2023-002 – Gramm Leach Bliley Missing Compliance Requirements. Auditor Description of Condition and Effect. The most recent written security policy fails to address how the College will oversee its information system service providers and the evaluation and adjustment of its information security pro...
2023-002 – Gramm Leach Bliley Missing Compliance Requirements. Auditor Description of Condition and Effect. The most recent written security policy fails to address how the College will oversee its information system service providers and the evaluation and adjustment of its information security program for any changes in the College's operations or the results of risk assessments. Additionally, the College's policy does not include performing annual penetration tests or biannual vulnerability assessments, as required by the Gramm Leach Bliley Act. As a result of this condition, the College isn't meeting the safeguard requirements necessary to comply with the FTC. In addition, the lack of safeguard controls creates an increased risk to highly sensitive data that is possessed by the College. Auditor Recommendation. We recommend that the College implement procedures to ensure that all Gramm Leach Bliley policies are met and confirmed by a second individual. Corrective Action. To address the missing element of Gramm Leach Bliley #6, procedures will be set in place to ensure oversight of our information service providers. A team will review and track who our providers are ensuring they meet our technical requirements in addition to the needs of our students and staff. To address the missing element of Gramm Leach Bliley #7, procedures will be set in place to ensure oversight of our information security protocols. A team will review our procedures at least annually, and make any necessary adjustments as changes to security protocols continue to evolve. Part of the procedures will include mandatory semi-annual information security training required by all staff, in addition to basic security information provided annually to students. Finally procedures to perform annual penetration testing will be established based on relevant identified risks. This could include any vulnerability assessments, in the form of systematic scans or review of information systems reasonably identified. These assessments should be completed at a minimum semi-annually, or whenever there may be material changes in operations that could be impacted. Responsible Party. Director of Information Technology and Student Services. Anticipated Completion Date. January 1, 2024.