Finding Text
Federal Agency: U.S. Department of Education
AL Program: Student Financial Assistance Cluster - 84.063 Federal Pell Grant
Federal Award No.: Title IV HEA Program OPE ID 01034300
Area: Special Tests and Provisions: Gramm-Leach-Bliley Act Student
Information Security
Questioned Costs: $---
Criteria:
The Gramm-Leach-Bliley Act (GLBA) requires institutions to explain their information-sharing
practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade
Commission considers Title IV-eligible institutions that participate in Title IV Educational
Assistrance Programs as financial institutions and subject to the Gramm-Leach-Bliley Act
because they appear to be significantly engaged in wiring funds to consumers (16 CFR
313.3(k)(2)(vi)). Institutions should comply with GLBA in their Program Participation Agreement
with ED. Institutions must protect student financial aid information, with particular attention to
information provided to institutions by ED or otherwise obtained in support of the administration
of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA
485B(d)(2)).
Condition:
The College does not have a qualified individual to oversee the GLBA information security
program. Additionally, the Company does not have an existing GLBA information security
program in place.
Cause:
The non-compliance is due to a lack of awareness and understanding of the GLBA requirements
and the absence of a formalized process for establishing and maintaining an information security
program
Effect:
The College is in noncompliance with applicable GLBA requirements.
Recommendation:
The College should develop and implement a comprehensive GLBA information security program
that includes risk assessments, safeguards, and regular testing and monitoring of the effectiveness
of these safeguards. A qualified individual with the necessary expertise and authority to oversee
the GLBA information security program should also be designated. Provide training to relevant
staff on GLBA requirements and the importance of information security. Conduct periodic reviews
and updates of the information security program to ensure ongoing compliance with GLBA
requirements.
Views of responsible officials
The College acknowledges the finding. Refer to their corrective action plan.