Finding Text
2024-001 – Gramm-Leach-Bliley Act Assistance Listing Number: Various – U.S. Department of Education – Student Financial Assistance Cluster Criteria Under the University’s Program Participation Agreement and the Student Aid Internet Gateway Agreement, institutions must have the Gramm-Leach-Bliley Act (GLBA) safeguards in place, GLBA requirements are related to protecting student financial aid information, specifically information provided in support of the administration of Title IV federal student financial aid. GLBA safeguards include a documented formal risk assessment of specific areas and controls including those over monitoring of appropriate access levels to information systems. Condition The University has maintained a formal documented risk assessment to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information and assess the sufficiency of any safeguards in place to control these risks. In addition, controls over access to the financial aid information system lacked monitoring procedures to ensure appropriate access levels were maintained as users changed roles at the University. Context During our testing of the University’s IT system, we inquired if the University has performed a risk assessment that addresses the three required areas noted above. Although there appear to policies and procedures in place, we were unable to obtain written formal documentation relating to a risk assessment as required. As it relates to access controls the University does not periodically review users’ access with management to ensure appropriate access is maintained by employees who change roles within the University. Cause The University has not documented a formal risk assessment of key IT controls relating to the security of information and review of monitoring procedures related to access controls. Effect Information may be at risk of unauthorized disclosure, misuse, alteration, destruction or compromise of such information. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the University document a formal risk assessment, along with recommendations for remediation of any open items and/or deficiencies, including implementing a process to review access levels with management for active employees. Responsible Personnel Marcus D Walton Deputy Chief Operating Officer & CIO