Finding Text
Gramm-Leach-Bliley Act Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063 Federal Award Identification Number and Year: N/A Award Period: July 1, 2024 – June 30, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance; Noncompliance (Other Matters) Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: During our audit procedures, we noted three elements that are not addressed in the District’s written information security program: (1) it does not identify a qualified individual to coordinate the information security program, (2) it does not include a change management policy, (3) it does not document continuous monitoring capabilities. Questioned costs: N/A Context: The District has policies related to change management, continuous monitoring, and designating a qualified individual. However, those policies are not included in the District’s written information security program. Cause: The District’s written information security program does not include all required elements. Effect: Noncompliance with the Gramm-Leach-Bliley Act. Repeat Finding: No Recommendation: We recommend that the District update its written information security program to ensure it includes all required elements. Views of responsible officials: There is no disagreement with the audit finding.