Finding Text
Federal Program: Student Financial Assistance Cluster Federal Assistance Listing Number: 84.063, 84.033, 84.038, 84.007, 84.268, and 84.379 Federal Agency: Department of Education Award Year: 2024 Criteria: Under the Gramm Leach Bliley Act (GLBA) Safeguards Rule, the University must develop, implement, and maintain a comprehensive information security program that includes administrative, technical, and physical safeguards. Condition: The University has not fully implemented or documented controls as required by the Gramm Leach Bliley Act. Specifically, the audit team observed that: • Customer data is not encrypted • Periodic inventories of data are not performed • While an annual risk assessment was performed, which included required elements, many of those elements were not found to be satisfactorily implemented. Cause: The University did not have adequate internal controls or monitoring procedures in place to ensure compliance with the GLBA Act. Context: Controls did operate properly for the University to comply with requirements of the GLBA Act Effect: Failure to implement and enforce access controls increases the risk of unauthorized access to sensitive customer data, potentially leading to data breaches, regulatory penalties, and reputational harm. Questioned Costs: None Repeat Finding: No Recommendations: The University should implement and document an overall quality assurance process including adequate controls to prevent overall noncompliance. Management's Response: Management agrees with the finding. See corrective action plan.