Finding Text
Criteria: The Gramm-Leach-Bliley Act (Public Law 106-102) (GLBA) requires the College, on an annual
basis, to identify reasonably foreseeable internal and external risks to the security, confidentiality, and
integrity of customer (student) information that could result in the unauthorized disclosure, misuse, alteration,
destruction, or other compromise of such information, and assess the sufficiency of any safeguards in place
to control these risks. At a minimum, the GLBA risk assessment should include consideration of risk in each
relevant area of operations, including:
Employee training and management.
Information systems, including network and software design, as well as information processing,
storage, transmission, and disposal.
Detecting, preventing, and responding to attacks, intrusions, or other system failures.
Condition: During our testing, we noted the following:
The annual risk assessment was performed during the audit year; however, results were not
communicated to management and there is no mention of any risks to technology, information
security, data protections, assets, cybersecurity, or regulatory compliance.
Annual security awareness training for employees is in place; however, completion of the training is
not enforced.
A vendor management program is not in place.
Mobile device management is not in place.
While protections are in place for data backups, a Disaster Recovery Plan and Business Continuity
Plan are not in place.
GBLA rules also require that a basic set of policies and procedures, as well as a program for annual
risk assessment and reporting, is in place. The polices supplied by the College were missing the
expected areas.
Cause: The expected documentation supporting the required controls to adequately confirm compliance
with GLBA safeguards was not complete.
Effect: Without demonstrable, documented controls supporting compliance with the GLBA standards for
safeguarding the protected data, compliance with the law and the requirements in the federal PPA may not
be assured.
Context: Inquiry and observation of the information received from the College related to compliance with
GLBA.
Auditor’s Recommendation: The College should review the GLBA safeguarding rules and as soon as
practical implement and document the controls necessary for compliance with the rule, focusing on the
completion of a documented, thorough, and standardized risk assessment and management reporting
framework. The College should perform comprehensive risk assessments on a regular basis, which is
suggested to be at least annually, and at any significant change in infrastructure or business process.
View of Responsible Officials: The College agrees that it should become compliant with GLBA
Safeguarding rules as soon as reasonably possible. A project to create, approve, implement, and monitor a
comprehensive risk assessment process is in process and the College will commit the resources necessary
to bring us into compliance in a timely fashion. Progress update meetings will be scheduled accordingly and
reported to the Audit and Finance Committee of the College's Board of Trustees.