Finding Text
Finding 2025-001 – Student Financial Assistance Cluster Federal Agency – U.S. Department of Education Grant Period – Year ended August 31, 2025 Compliance Requirement – N. Gramm-Leach-Bliley Act–Student Information Security Criteria – Institutions participating in Title IV programs are required to comply with various laws and regulations as part of their signed Program Participation Agreement (PPA), including but not limited to, the Federal Trade Commission’s Gramm-Leach-Bliley Act (GLBA) Safeguards Rule (Title 16, Chapter I, Subchapter C, Part 314). Condition – The College has not performed a formal risk assessment of their technology environment. In addition, the College’s management indicated that the majority of the elements required are in place; however, they are not formally documented. This includes policies related to vendor management, user access, transmission and destruction of student data, change management, and a formal inventory of where student data is stored, collected and transmitted. per the 2025 Compliance Supplement. Cause – The College has experienced significant changes in administration with additional vacancies and turnover in the technology and finance departments. Along with budget constraints the ability to complete a risk assessment and formal documentation of the IT policies and procedures has been delayed. Effect – The College was not in compliance with the Department of Education’s requirements for GLBA. Recommendation – The College should review the GLBA safeguarding rules and as soon as practical implement and document the controls necessary for compliance with the rule, this would include the completion of a documented, thorough, and standardized risk assessment. As part of this process, IT policies should be updated and documented to align with the College’s current IT environment and be formally approved and implemented throughout the College. Management response - Over the past year, the College experienced significant changes in leadership, including vacancies and turnover within the finance and technology departments. As a result, finalizing the remaining GLBA documentation has been delayed. Some of the required work has already been completed operationally, and we are committed to finalizing the written policies and procedures in the coming months.