Finding Text
U.S. Department of Education
Student Financial Assistance Cluster
Federal Financial Assistance Listing Number(s): 84.063, 84.007, 84.268, 84.033, 84.038, 84.379 Compliance Requirement: Special Tests & Provisions – Gramm‐Leach‐Bliley Act (GLBA) – Student Information Security
Type of Finding: Material Weakness in Internal Control
Criteria: Under 16 CFR Part 314, Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require that the written information security program to include nine elements for institutions with 5,000 or more customers.
Condition: During our testing over GLBA compliance, we noted that the University had not updated their information security program since 2018 and that it was missing aspects of the required nine elements.
Cause: The University has not updated their written information security program since 2018.
Effect: The University did not have a system in place to ensure the required elements under GLBA were included in the comprehensive information security program and that the program was reviewed periodically.
Questioned Costs: None reported.
Context/Sampling: Sampling was not used.
Repeat Finding from Prior Year(s): No
Recommendation: The University should have a system in place to ensure that their comprehensive security program includes the required aspects under GLBA and that they are in documented in writing.
Views of Responsible Officials: Management agrees with the finding.