Finding Text
2024-001 – Student Financial Assistance Cluster – (a) Federal Supplemental Educational Opportunity Grants (b) Federal Work Study Program (c) Federal Perkins Loan Program (d) Federal Pell Grant Program (e) Federal Direct Student Loans (f) Teacher Education Assistance for College and Higher Education Grants, Assistance Listing No. (a) 84.007 (b) 84.033 (c) 84.038 (d) 84.063 (e) 84.268 (f) 84.379 – Year Ended June 30, 2024
Criteria: Institutions shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue. The information security program shall include the elements set forth in § 314.4 and shall be reasonably designed to achieve the objectives of this part, as set forth in the objectives of section 501(b) of the Act (16 CFR 314.3(a)).
Base your information security program on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 314.4(b)).
Condition: The College did not implement a written information security program and a risk assessment as part of the Gramm-Leach-Bliley Act’s (GLBA) standards for safeguarding customer information. We consider this finding to be an instance of noncompliance in relation to Special Tests and Provisions. Statistical sampling was not used in making sample selections.
Questioned Costs: N/A
Effect: The result is the College did not meet the requirements for protecting and securing data obtained from the Department of Education’s systems for the purpose of administering the Title IV programs.
Recommendation: We recommend the College complete a formal security information program and risk assessment to adhere to the regulations and await guidance from the Department of Education.
Views of Responsible Officials: Management agrees with this Single Audit Finding and response is included in the Corrective Action Plan.