FAC Explorer

Finding 917 (2023-001)

-
Requirement
N
Questioned Costs
-
Year
2023
Accepted
2023-10-30
Audit: 1702
Organization: The Master's University & Seminary and Subsidiary (CA)
Auditor: Capincrouse LLP

AI Summary

  • Core Issue: The Master’s University & Seminary did not fully comply with updated GLBA requirements, particularly regarding information security.
  • Impacted Requirements: Key areas include the need for multi-factor authentication for systems with PII and a comprehensive annual report to the board.
  • Recommended Follow-Up: Update the information security program to align with GLBA changes and implement necessary security measures promptly.

Finding Text

Gramm-Leach-Bliley Act (GLBA) Compliance DEPARTMENT OF EDUCATION ALN #: 84.268, 84.063, 84.007 and 84.033 - Student Financial Assistance Cluster Federal Award Identification #: 2022-2023 Financial Aid Year Condition: The Master’s University & Seminary and Subsidiary did not sufficiently comply with the updated requirements of GLBA. Criteria: 16 CFR 314.3, 16 CFR 314.4 Questioned Costs: $0 Context: The Master’s University & Seminary and Subsidiary developed a risk assessment matrix and evaluation process. The written information security program has not been fully updated to comply with the recent changes in GLBA. The two largest areas are implementing multi-factor authentication on all systems that contain personally identifiable information (PII) and providing a written report to the board covering all the required areas. Cause: The Master’s University & Seminary and Subsidiary has experienced turnover in the information technology department that has hindered the ability to document and implement all the updated changes. Effect: The Master’s University & Seminary and Subsidiary has not adequately addressed the updated requirements of GLBA, which may lead to unintended exposure of student information to security risks. Identification as repeat finding, if applicable: Not applicable. Recommendation: We recommend The Master’s University & Seminary and Subsidiary update the information security program in light of the revised regulations, including the implementation of multi-factor authentication on all systems containing PII and the written, annual report to the the board. Views of Responsible Officials and Planned Corrective Action: Management agrees with the finding. See corrective action plan.

Corrective Action Plan

Gramm-Leach-Bliley Act (GLBA) Compliance Planned Corrective Action: 16 CFR 314.4(b)(1) - Written Documentation of Risk Assessment TMUS has established a risk assessment but has not recently completed due diligence due to staffing fluctuations which are currently being addressed. We will re-establish the routine of analyzing and updating the risk assessment to rightly inform our security efforts and ensure appropriate personnel resources are dedicated to this effort. 16 CFR 314.4(c)(1-8) - Multi-factor Authentication The majority of the applications utilized by TMUS are leveraging MFA. We will direct resources to evaluate the minority of systems that do not currently utilize MFA and seek to migrate to an MFA enabled solution this year. In addition, we will complete an internal evaluation of our existing usage of MFA to ensure it is appropriately utilized and triggered per the recommendations noted. 16 CFR 314.4(i) - Annual Board Report TMUS utilizes a security and risk committee as part of our governing board. We plan to expand the scope of our committee meetings to review the status of the information security program and current levels of compliance. In addition, we will take steps to provide appropriate materials to the entire governing board to keep them informed regarding the effectiveness of the program. Person Responsible for Corrective Action Plan: Paul Sedy, Chief Information Officer Anticipated Date of Completion: By 6/30/2024

Categories

Subrecipient Monitoring

Other Findings in this Audit

Programs in Audit

ALN Program Name Expenditures
84.268 Federal Direct Student Loans $7.64M
84.063 Federal Pell Grant Program $1.85M
84.007 Federal Supplemental Educational Opportunity Grants $89,430
84.033 Federal Work-Study Program $61,909