Finding 1173186 (2024-005)

Federal Agency: U.S. Department of Education AL Program: Student Financial Assistance Cluster - 84.063 Federal Pell Grant Federal Award No.: Title IV HEA Program OPE ID 01034300 Area: Special Tests and Provisions: Gramm-Leach-Bliley Act Student Information Security Questioned Costs: $--- Criteria: The Gramm-Leach-Bliley Act (GLBA) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistrance Programs as financial institutions and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers (16 CFR 313.3(k)(2)(vi)). Institutions should comply with GLBA in their Program Participation Agreement with ED. Institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). Condition: The College does not have a qualified individual to oversee the GLBA information security program. Additionally, the Company does not have an existing GLBA information security program in place. Cause: The non-compliance is due to a lack of awareness and understanding of the GLBA requirements and the absence of a formalized process for establishing and maintaining an information security program Effect: The College is in noncompliance with applicable GLBA requirements. Recommendation: The College should develop and implement a comprehensive GLBA information security program that includes risk assessments, safeguards, and regular testing and monitoring of the effectiveness of these safeguards. A qualified individual with the necessary expertise and authority to oversee the GLBA information security program should also be designated. Provide training to relevant staff on GLBA requirements and the importance of information security. Conduct periodic reviews and updates of the information security program to ensure ongoing compliance with GLBA requirements. Views of responsible officials The College acknowledges the finding. Refer to their corrective action plan.