Finding Text
2025-103 Multi-factor Authentication Not Required When Accessing Student Information Assistance Listing Number: 84.063 Program Title: Federal Pell Grant Program Compliance Requirement: Special Tests and Provisions – Gramm-Leach Bliley Act- Student Information Security Federal Agency: United States Department of Education FAIN and year: P063P203385, 2024-2025 Finding Type: Material Weakness in Internal Control Known Questioned Costs: $0 Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The institution’s written information security policy must address the implementation of safeguards identified in 16 CFR 314.4(c) which includes the implementation of multi-factor authentication for anyone accessing student information on the institution’s system. Condition: Multi-factor authentication has not been implemented on the District’s system in regards to access of student information. Cause: The security parameters for accessing student information do not include multi-factor authentication in conjunction with passwords when accessing student information from the District’s information system. Effect: Student information could be inappropriately accessed. Recommendation: The requirement for multi-factor authentication policy should be put in place. Management Response: See attached Corrective Action Plan.