DELTA COLLEGE

2019-001 Information Security Program and Risk Assessment Student Financial Aid Cluster; Grant period ? year ended June 30, 2019 Criteria: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to safeguard sensitive data in compliance with 16 CFR 314. The Federal Trade Commission considers Title IV institutions that participate in Education Assistance Programs to be ?financial institutions? and subject to the Gramm-Leach-Bliley Act. Under the Gramm-Leach-Bliley Act, institutions must protect student financial aid information, including assessing risks to that information. Condition: The College did not complete a risk assessment that addresses the three areas noted in 16 CFR 314.4(b) which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (3) detecting, preventing, and responding to attacks, intrusions, or other systems failures. Under 16 CFR 314.4(b) the College must also document safeguards for identified risks. Cause: The College uses a third-party IT service provider for IT related tasks and relied on that service provider to ensure that all compliance requirements were met. However, neither the College nor the third-party service provider performed an IT risk assessment tailored specifically to identifying risks or addressing risks as required by GLBA. Effect: The College may not be aware of risks to student information and therefore may not have implemented proper security controls. Recommendation: We recommend that the College formalize a risk assessment which, at a minimum, addresses the required areas. Views of Responsible Officials and Planned Corrective Actions: The College agrees with the findings and is in the process of formalizing a risk assessment to address, at a minimum, the required areas described above.