Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: WAU agrees with the recommendation to update our formal process to identify and maintain an inventory of data, devices, and systems that support or process customer f...
Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: WAU agrees with the recommendation to update our formal process to identify and maintain an inventory of data, devices, and systems that support or process customer financial aid information. While we currently use the Spiceworks Inventory System to track hardware and software assets and Google Workspace to manage user cloud access and data storage, we acknowledge that a formal, documented inventory process covering all required categories has not yet been fully established. The IT Director has been assigned to develop and document this process within 30 days. We acknowledge this finding and the associated risk arising from the absence of an independent risk assessment. As of March 25, 2026, the University has engaged TeamLogic Cybersecurity to strengthen our managerial, technical, and operational controls and to (1) develop and document a formal, GLBA aligned risk assessment process; (2) conduct annual independent, comprehensive risk assessment of our information systems and data environment; and (3) provide written findings and recommendations. Based on these results, we will implement appropriate safeguards, and institutionalize an annual risk assessment cycle to ensure that risks are consistently identified, assessed, mitigated, and monitored in accordance with GLBA requirements. Name(s) of the contact person(s) responsible for corrective action: Rosalee Pedapudi, IT Director, Information Technology Services Planned completion date for corrective action plan: April 26, 2026