HERKIMER COUNTY COMMUNITY COLLEGE

Condition: It was noted that the College has not designated an individual for implementing and monitoring of the College’s information security program and no written information security program is available. Criteria: The GLBA requires the College to explain its information sharing practices to its customers and to safeguard sensitive information. On December 9, 2021, the Federal Trade Commission issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. Institutions are required to be in compliance with the revised or final requirements no later than June 9, 2023. Cause: Unknown Effect or Potential Effect: Currently, the College is not in compliance with the GLBA, a required Program Eligibility compliance for the Student Financial Assistance program. Known Questioned Costs: None noted Context: Adherence to the GLBA is part of program eligibility requirements for the Student Financial Assistance Program. Repeat Finding: No Recommendation: We recommend that the College designate an individual that would take responsibility for implementing and monitoring of the College’s information security program including drafting the Information Security Program for approval by the Board of Trustees.

Views of Responsible Officials: The college verbally assigned GLBA responsibilities to an individual in a meeting several years ago regarding GLBA which was attended by all departments affected by its regulations. However, that assignment was not formalized in writing. This individual separated employment with the college in January 2026. As a result, the college is currently in the process of transitioning its information technology (IT) department under the auspices of the State University of New York Information Technology Exchange Center (SUNY ITEC) where the college has access to a wide range of resources including experts in GLBA. With this transition, SUNY ITEC will appoint the Chief Information Officer / IT Director as the qualified individual (QI) for GLBA compliance. SUNY ITEC’s Security Services will support the Director; informing and advising them of relevant IT Security Program and Security Operations activities and compliance, and the Director will be the signing QI.

Findings and Questioned Costs ? Major Federal Award Programs Audit 2019-01 Federal Uniform Guidance Policies and Procedures Condition: The College currently has effective procedural controls in place over the management of Federal awards as concluded through the testing of grant expenditures. However, key changes under the Uniform Guidance expanded the rules regarding the documentation of internal controls over Federal Awards to require that they be documented in writing in the College?s policies and that management should evaluate and document the results of ongoing monitoring to identify internal control issues. The written internal controls should specifically address each of the applicable twelve (12) compliance requirements of the Federal award programs. Criteria: On December 26, 2014 the Office of Management and Budget?s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, more commonly referred to as the ?Uniform Guidance,? became effective for all Federal awards, whether the funds are provided directly from a Federal agency or passed-through another state or local agency. Cause: Unknown Effect or Potential Effect: The College is more at risk of noncompliance with Federal Grant regulations related to Uniform Administrative Requirements by not having fully effective procedural controls in place. Known Questioned Costs: None noted. Context: The College manages multiple federal programs in a single year. Repeat Finding: No Recommendation: The College should document policies and procedures in accordance with the new Uniform Guidance. This should include monitoring procedures to ensure that internal controls over compliance for the various programs are working effectively. Management?s Response: The College will develop policies and procedures for the new Uniform Guidance. Policies and procedures will be documented and monitored to ensure internal controls over compliance are working effectively.

May 26, 2020 Oversight Agency: State University of New York Herkimer County Community College respectfully submits the following corrective action plan for the year ended August 31, 2019. Independent Public Accounting Firm: D?Arcangelo & Co., LLP PO Box 4300 Rome, NY 13440 Finding: 2019-001 Federal Uniform Guidance Policies and Procedures Planned Action: The College will develop required written policies and procedures as required by the OMB?s Uniform Guidance. Contact Responsible: Jackie Woudenberg, Controller Anticipated Date of Completion: July 15, 2020