Action taken in response to finding:
To address the identified deficiencies in WAU’s written information security program and ensure compliance with 16 CFR § 314.4, the following actions have been taken:
1. Approval of the Information Security Program:
o Action: We have updated the written information security program as formally approved by the appropriate individual within the institution, Rosalee Pedapudi, ITS Director. This step designates a qualified individual responsible for overseeing and implementing the information security program as a requirement under 16 CFR § 314.4(a).
2. Design and Implementation of Safeguards:
o Action: According to 16 CFR § 314.4(c), institutions must implement safeguards to control identified risks, including encryption of customer information in transit and at rest. We have documented specific safeguards to control the risks identified through the institution's risk assessment, including a policy mandating the encryption of customer information both on the institution's systems and during transmission. As such, the university encrypts Non-Public Financial information both at rest and in transit using industry-standard encryption protocols (e.g. VPN). Where encryption is not feasible, compensating controls are implemented to protect sensitive data. The university also requires Multifactor Authentication (MFA) for systems that process, store, or transmit protected financial information. Access is governed by the principle of least privilege, with privileged access granted by authorized university officers, ensuring that only approved personnel can access sensitive data.
3. Regular Testing and Monitoring of Safeguards:
o Action: According to 16 CFR § 314.4(d), WAU is required to regularly test and monitor the effectiveness of their safeguards to ensure the security of customer information. We have established procedures for annual penetration testing through Applied Technology Services and monitoring of the effectiveness of the implemented safeguards.
Name(s) of the contact person(s) responsible for corrective action: Rosalee Pedapudi
Planned completion date for corrective action plan: July 15, 2025.