Finding 2023-002
Federal Agency Name: U.S. Department of Education
Federal Financial Assistance Listing: 84.063, 84.007, 84.268, 84.033, 84.038, 84.379
Program Name: Student Financial Assistance Cluster
Compliance Requirement: Special Tests & Provisions – Gramm-Leach-Bliley Act (GLBA) – Student
Information Security
Type of Finding: Material Weakness in Internal Controls
Finding Summary: During testing over GLBA compliance, it was noted that the University had not updated the information security program and was missing aspects of the required nine elements.
Responsible Individuals: Kella Helyer, Director of Financial Aid (DFA) and Michael Ellis, Assistant Director of University Computing Solutions (AD UCS)
Corrective Action Plan: Management agrees with this finding. See the GLBA Draft Corrective Action Plan table below.
Anticipated Completion Date: See the attached GLBA Draft Corrective Action Plan table below:
GLBA documentation
314.4 Reference
What WOU will do Complete by Date Who will do it Completion Date
Document full status of 314.4 4/1/24 AD UCS
a Complete
b Update our CIS18 controls - aka InfoSec Program 7/1/24 AD UCS
b.2 Risk assessment for on-prem servers with FinAid* data 4/1/24 AD UCS, Lead Windows Admin, Warehouse Programmer
c.1 Document current processes and access controls 4/1/24 AD UCS, DFA
c.2 Document current information, including Business Office 12/20/23 Financial Aid Accountant 12/13/23
c.3 Encrypte NetApp volumes, and ensure encryption on DB links 8/1/24 AD UCS, Lead Windows Admin, Warehouse Programmer
c.4 Assess warehouse & BannerRPT 7/1/24 AD UCS, Warehouse Programmer, Operating Systems/Security Analyst
c.5 Complete
c.6 Review PowerFAIDS electronic files for purging
Review paper files for purging
Have Business Office review files for purging 8/1/24 DFA
c.7 Audit FinAid data access upon addition to Warehouse 8/1/24 Warehouse Programmer and/or Operating Systems/Security Analyst
c.8 Add access logs to WOU central logging system 8/1/24 AD UCS, Web & Banner Programmer
d.2.i Annual pentest by Campus Guard 2/29/24 AD UCS
e Complete
f Document all 3rd party providers who interact with FinAid data. Audit yearly 8/1/24 DFA, AD UCS
g Complete
h Complete
i Verbal report given in 2023. Anticipated written report to Board on 7/1/24 7/1/24 AD UCS