AMERICAN CONSERVATORY THEATRE FOUNDATION

Federal Program: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education CFDA Title and Number: Federal Direct Loan Program 84.268, Federal Work Study 84.033, Federal Pell Grant Program 84.063, Federal Perkins Loan Program 84.038 Award Year: July 1, 2019 ? June 30, 2020 Criteria or Specific Requirement: Special Tests and Provisions - Gramm-Leach-Bliley Act - Student Information Security - The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information sharing-practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(iv)). Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, institutions must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal financial aid programs. Institutions are required to designate an individual to coordinate the information security program and perform a risk assessment that addresses (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing, and responding to attacks, intrusions or other systems failures. Institutions are also required to document the safeguards in place and perform regular testing of safeguards to address each of the risk identified in the areas listed above. Condition: A.C.T. does not have documented evidence of regular testing performed over safeguards. Effect: Safeguards in place to mitigate risks over Student Information Security may not be operating effectively. Context: During testing of Gramm-Leach-Bliley Act and review of management assessment, it was determined evidence of testing performed over safeguards in place are not documented. Cause: Transitions in both systems and personnel due to remote working environment necessitated by COVID-19. Questioned Costs: None noted Repeat Finding: No Recommendation: We recommend A.C.T. to regular perform and properly document testing over safeguards.