Gramm-Leach-Bliley Act (GLBA) Compliance
Planned Corrective Action:
The school’s IT firm has taken the following steps to address GLBA Compliance in the following manner.
Element 1:
ADB Network Consultants LLC and its Delegated Partners will serve as the Morris Brown College Managed Cybersecurity Service Provider. ADB is responsible for overseeing and implementing and enforcing the institution’s information security program.
Element 2:
The risk assessment for MBC’s Cyber Security program is covered within the MBC Cyber-Security -Incident-Response document on pages 8 through 12 which includes Appendix B (Incident Categorization), Appendix C (Incident Impact Definitions and IRT Incident Severity & Response Classification Matrix), and Appendix D (IRT Incident Record Form). The system is designed to provide ongoing and updated Reporting.
Element 3:
Access to MBC’s network, data, and email system is permitted only to authorized users. Access is granted by MBC Authorized Personnel and/or IT service providers through the administrative console of the respective environment (Active Directory Domain Controller for network and data access, Microsoft 365 Admin Center for Outlook email access, and MBC Authorized Personnel and/or Security Guards for physical facilities access).
Element 4:
MBC Authorized Personnel and IT service providers will test the Cyber Security Incident Response Plan periodically, but at least annually to monitor the effectiveness of the safeguards it has implemented.
Element 5:
MBC’s IT service provider created a Cyber Security Incident Response Plan, which documents who and how MBC Authorized Personnel and IT service providers will respond to Cyber Security incidents.
Element 6:
MBC has a 2-year contract with its IT service provider, ADB Network Consultants LLC. The service contract lists and governs the services that the IT service provider and its partners will perform monthly.
Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)).
ADB Network Consultants LLC implemented a system that will log the activity of authorized users and prevent unauthorized network access. Email Threat Protection has also been setup.
Person Responsible for Corrective Action Plan: Shermanetta Carter, CFO
Anticipated Date of Completion: June 30, 2024