Finding Text
Student Financial Assistance Cluster
U.S. Department of Education ALNs 84.268, 84.063, 84.033, 84.379, 84.007
Federal Direct Student Loans - Award Year 2023
Federal Pell Grant Program - Award Year 2023
Federal Work-Study Program - Award Year 2023
Teacher Education Assistance for College and Higher Education Grants - Award Year 2023
Federal Supplemental Educational Opportunities Grant - Award Year 2023
Criteria or Specific Requirement – Special Tests & Provisions: Gramm-Leach-Bliley Act The Gramm-Leach-Bliley Act requires financial institutions to explain their information-sharing to their customers and to safeguard sensitive data. The Federal Trade Commision considers Title IV-eligible institutions that participate in Title IV Educational Assistance Program as "financial institutions" and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers. Under 16 CFR 314, institutions are required to develop, implement and maintain a comprehensive information security program that adresses the implementation of eight minimum safeguards.
Condition – The University does not have a written information security program that addresses the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8), nor the requirements identified in 16 CFR 314.4(d) and (g).
Questioned Costs – None noted.
Context – Through inquirty of management and review of information policies published on the University's website, it was determined the eight requirements were not all included in a comprehensive policy that met the minimum requirements.
Effect – The University was not in compliance with the Gramm-Leach-Bliley Act.
Cause – The University's policy was not finalized.
Identification as a Repeat Finding – Not applicable.
Recommendation – We recommend management takes necessary steps to finalize a written information security policy that complies with the safeguards identified within 16 CFR 314.
Views of Responsible Officials and Planned Corrective Actions – Management agrees with the stated finding and has implemented a corrective action plan.