MIDAMERICA NAZARENE UNIVERSITY AND AFFILIATES

Gramm-Leach-Bliley Act (GLBA) Compliance Planned Corrective Action: • The Finding addressed three areas of concern. This CAP will address them as follows: • Multi-Factor Authentication (MFA) Not Implemented on all systems: o MNU is working to integrate Elucian Banner with Microsoft Entra ID Single Sign On, which will then enforce MFA. This is planned for completion in January 2024. o MNU will work with the National Student Clearinghouse to enforce MFA for all users by December 31, 2023 • Implementation of frequency of reviews on critical vendors: o MNU will add the following systems for review to the annual Risk Assessment, conducted in June of each year: • Active Directory • CashNet • Clover-Go • Implementation of all required safeguards under the revised legislation: o MNU will adopt a formal data retention policy, specifying that customer (student) financial information shall not be kept more than 2 years since the date of last access, unless otherwise required by law or regulation. o MNU will perform an audit of student financial data as part of the annual review process to ensure that data is not being retained past the expiration window. Person Responsible for Corrective Action Plan: Mark Leinwetter, IT Director Anticipated Date of Completion: • MFA Implementation: 1/31/24 • Vendor Reviews: 6/30/24 • Data Retention Policy: 2/28/24