Finding Text
2023-002 – Gramm-Leach-Bliley Act (GLBA)
Federal Agency: U.S. Department of Education
Federal Program Title: Student Financial Assistance Cluster
Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268
Award Period: 7/1/2022 – 6/30/2023
Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi)).
Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protest student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs.
Questioned costs: None.
Context: During our testing of the University’s information technology, it was noted that the University does not have an active written information security program in place that addressed all seven elements as required by the Gramm-Leach-Bliley Act.
Cause: The University has continued to make progress in updating the Universities written security program to become compliance with all requirements; however, due to capacity and demands on the information technology individuals, this is still a work in process.
Effect: The student personal information could be vulnerable.
Repeat finding: No.
Recommendation: We recommend the University designate an individual to oversee the information security function and work to update the Universities written security program to ensure compliance with all the standards.
Views of responsible officials: Management agrees with the finding.