Winthrop UniversityHigher Education

Findings and Questioned Costs Relating to Federal Awards, Department of Education, Finding 2021-001 Gramm-Leach-Bliley Act-Student Information Security-Student Financial Aid Cluster. Condition: The University has designated an individual to coordinate its information security system, has developed its Information Security Implementation Plan, and has yet to complete a risk assessment that addresses the three required areas noted in 16 CFR 314.4(b). Contact Persons: Jeremy Whitaker, Associate VP for Finance and Business, and Justin Oates, Vice President for Finance and Business Affairs. FY 2021 Corrective Action Taken: Since the original finding, Winthrop has worked to come into compliance with GLBA. On October 25, 2019, the Board of Trustees adopted a resolution authorizing the implementation of a Comprehensive Information Security Plan. In March 2020, the Coronavirus pandemic hit and unfortunately, this delayed progress on this implementation plan while the University had to spend most of its resources in addressing the pandemic issues and concerns. In December 2020, after the initial hit of the pandemic was over, the University's President and executive leadership approved an Information Security Implementation Plan that addressed compliance with the Gramm-Leach-Bliley Act. The University is committed to full implementation of this plan. The University has and will continue to provide adequate resources toward accomplishing this objective. During Fall 2020, the University had a failed solicitation to acquire software to be used to systematically test and monitor, on a routine basis, the effectiveness of our safeguards' key controls. During the fiscal year, the University experienced a significant decline in administrative personnel campus-wide, but especially in the Finance and Business Affairs division. In early Spring 2021, there was complete turnover in the Procurement Office. Due to budgetary constraints as well as the current market situation, the University was unable to remedy this staffing situation until June 2021. In the prior year Corrective Action response, the University stated that the remaining component of this plan is scheduled to be completed by September 30, 2021. During the summer, a successful solicitation was completed and a contract was awarded. As of the date of this letter, the software has been procured, installed, and has started logging data.

2020-001

FY 2019 Findings and Questions Costs Relating to Federal Awards, Department of Education, Finding 2019-001 Gramm-Leach-Bliley Act-Student Information Security-Student Financial Aid Cluster Condition: The University has designated an individual to coordinate its information security system, has developed its Information Security Implementation Plan, and has yet to complete a risk assessment that addresses the three required areas noted in 16 CFR 314.4(b). Contact Persons: Craig Sauvigne, Information Security Analyst, and Justin Oates, Vice President for Finance and Business Affairs FY2020 Corrective Action Taken: Since the original finding the University has worked to come into compliance with GLBA. On October 25, 2019, The Board of Trustees adopted a resolution authorizing the Implementation of a Comprehensive Information Security Plan. In December 2020, the University's President and executive leadership approved an Information Security Implementation Plan that includes completing a comprehensive risk assessment covering all three required areas noted in 16 CFR 314.4(b). The University is committed to full implementation of this plan and will provide adequate resources toward accomplishing this objective. The remaining component is scheduled to be completed by September 30, 2021. 314.4(a) Winthrop has a personnel role charged with developing and ensuring compliance with information security for the University. This role reports outside of the information technology chain of command as is best practice and mandated by South Carolina Division of Information Security. (b) Winthrop University has completed a full risk assessment of both internal and external risks related to the information systems and the data stored thereon. The first risk assessment was completed at the end of 2019 and will be reviewed annually. The most recent review was completed at the end of 2020. This risk assessment reviews controls related to 314.4(b) subsections (1)-(3). (c) Winthrop University is in the continual process of designing and implementing information safeguards to control the risks identified through risk assessment. The Risk Management Office is still waiting on the University Procurement Office to publish an appropriate solicitation related to regularly testing or otherwise monitoring the effectiveness of the safeguards' key controls, systems, and procedures. (d) Winthrop oversees service providers and/or third-party contractors, by: (1) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; and (2) Requiring University service provides by contract to implement and maintain such safeguards. (3) Reviewing data sharing and protection agreements along with the SC Materials Management Office. (e) The Information security office continues to evaluate and adjust the Winthrop information security program in light of the University environment or any other circumstances that are known or have reason to be known which may have a material impact on the information security program. However, the Risk Management Office is still waiting on the University Procurement Office to publish an appropriate solicitation related to the testing and monitoring required by paragraph (c) of this section.

2019-001

Response to 2018-19 Audit Finding Regarding Gramm-Leach-Bliley Act-Student Information Security to the Department of Education. Winthrop agrees that it is not currently in full compliance with some of the components of the Gramm-Leach-Bliley Act. Winthrop further agrees with the recommendation that the University complete the components of the Information Security Implementation Plan. After multiple failed searches, Winthrop did fill an information security position on June 1, 2019 as a new role charged with developing a mature information security plan for the University. Winthrop University does comply with 314.4(b)(1) by mandating annual security training for all employees. Winthrop University reviews all agreements with third party contractors on numerous facets to include data protection and security standards as required under 314.4(d). Corrective Action The University's President has approved an Information Security Implementation Plan that includes completing a comprehensive risk assessment covering all three required areas noted in 16 CFR 314.4(b). The University is committed to full implementation of this plan and will provide adequate resources toward accomplishing this objective.