Finding Text
Gramm-Leach-Bliley Act (GLBA) Compliance Significant Deficiency
DEPARTMENT OF EDUCATION
ALN #: 84.268, 84.063, 84.007, and 84.033
Federal Award Identification #: 2022-2023 Financial Aid Year
Condition: The University did not sufficiently comply with the updated requirements of GLBA.
Criteria: 16 CFR 314.4
Questioned Costs: $0
Context: The University has not sufficiently documented its security risk assessment and safeguards, including data retention and deletion, implemented internal vulnerability scanning or sufficient vendor management policies and reviews. Additionally, the University has not implemented policies and procedures that support employee training, awareness, and skills, or provided a written, annual report to the board that includes all required areas based on the updated regulations.
Cause: The University has limited resources and has allocated certain staff time and dollars as available to address and document compliance with the requirements of GLBA.
Effect: The University has not adequately addressed the requirements of GLBA, which may lead to unintended exposure of student information to security risks.
Identification as repeat finding, if applicable: Not applicable
Recommendation: We commend the University for the work completed on GLBA. We recommend the University continue to allocate sufficient resources to address the remaining requirements of GLBA.
Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.