Finding 518135 (2023-003)

FINDING 2023-003: FAILURE TO MEET THE STANDARDS FOR SAFEGUARDING CUSTOMER INFORMATION FEDERAL AGENCY: U.S. DEPARTMENT OF EDUCATION PROGRAM NAME: FEDERAL DIRECT LOAN PROGRAM ALN: 84.268 FEDERAL AWARD YEAR: 2022-2023 & 2023-2024 Compliance Requirement: Special Tests and Provisions (N.) - Administrative Requirements Criteria: Institutions shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue. The information security program shall include the elements set forth in § 314.4 and shall be reasonably designed to achieve the objectives of this part, as set forth in the objectives of section 501(b) of the Act (16 CFR 314.3(a)). Condition: The Institution failed to implement the new Gramm-Leach-Bliley Act's (GLBA) standards for safeguarding customer information to their student information security policy. We consider this finding to be a material weakness in the Special Tests and Provisions Compliance Requirement. Cause: The condition was caused by the Institution's security officer being unaware of the requirement to establish a policy based off a risk assessment. Question Costs: $0 Recommendation: We recommend the Institution update their student information security program to adhere to the regulations and await guidance from the Department of Education. Views of Responsible Officials: The Institution agrees with the Single Audit Finding and a response is included in the Corrective Action Plan.