2024-001 – Student Financial Assistance Cluster – (a) Federal Supplemental Educational Opportunity Grants (b) Federal Work Study Program (c) Federal Perkins Loan Program (d) Federal Pell Grant Program (e) Federal Direct Student Loans (f) Teacher Education Assistance for College and Higher Education Grants, Assistance Listing No. (a) 84.007 (b) 84.033 (c) 84.038 (d) 84.063 (e) 84.268 (f) 84.379 – Year Ended June 30, 2024
Criteria: Institutions shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue. The information security program shall include the elements set forth in § 314.4 and shall be reasonably designed to achieve the objectives of this part, as set forth in the objectives of section 501(b) of the Act (16 CFR 314.3(a)).
Base your information security program on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 314.4(b)).
Condition: The College did not implement a written information security program and a risk assessment as part of the Gramm-Leach-Bliley Act’s (GLBA) standards for safeguarding customer information. We consider this finding to be an instance of noncompliance in relation to Special Tests and Provisions. Statistical sampling was not used in making sample selections.
Corrective Action Plan: We are currently working with our IT vendors (CampusWorks and Lockstep) on policies and increasing GLBA compliance.
Responsible Person for Corrective Action Plan: Holly Tharp, Vice President for Finance and Business
Implementation Date for Corrective Action Plan: June 30, 2025