Gramm-Leach-Bliley Student Financial Information Security Program

I. GLB Student Financial Information Security Program Coordinators

In order to comply with GLB, the Provost has designated three administrative officers to coordinate the protection of student financial information:  the Director of Financial Aid, the Director of Financial Services and the IT Security Officer. They will work together and with the Coordinator of IT Policy and Planning to assist the relevant offices of the University in identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of student financial information; to evaluate the effectiveness of the current safeguards for controlling these risks; to design and implement a safeguards program; and to regularly monitor and test the program.  These three officers, together with the Coordinator of IT Policy and Planning, will evaluate the program periodically to make appropriate adjustments and to send educational reminders to the University community.  Questions regarding interpretations and applicability of the GLB and implementing federal regulations will be coordinated with the Office of the General Counsel.  

II. Risk Assessment and Safeguards

The IT Security Officer will work with all relevant areas of the University to identify potential and actual risks to security and privacy of the systems that contain student financial information. Each School or Department head, or designee, will conduct an annual data security review with guidance from the IT Security Officer for systems and from the Directors of Financial Aid and Financial Services for data. Vice Provosts will be asked to identify any employees in their respective areas who work with covered data and information.

Information Technology bears primary responsibility for internal and external risk assessment, but all members of the University community are involved in risk assessment. The IT Security Officer, working in conjunction with the relevant University offices, will conduct regular risk assessments of systems, including but not limited to the categories listed by GLB.

The Coordinator of IT Policy and Planning, working in cooperation with relevant University departments, will develop and maintain a data handbook listing those persons or offices responsible for each covered data field in relevant software systems (financial, student administration, development, etc.). Information Technology is developing an authentication and authorization system that will permit access by designated members of the University community to covered data and information. 

Information Technology will assure the physical security of all central systems that contain or have access to covered data and information and the network that is utilized to access the systems. Information Technology will work with other relevant areas of the University to develop guidelines for physical security of any covered servers in locations outside the central server area. Units will conduct a survey of other physical security risks, including the storage of covered paper records in non-secure environments, and other procedures that may expose the University to risks.

Information Technology has developed written plans and procedures to detect any actual or attempted attacks on covered systems and has developed incident response procedures for actual or attempted unauthorized access to covered data or information.

The IT Security Officer will periodically review the University's disaster recovery program for critical systems and present a report to the Provost.  The Vice Provost for Student Success will periodically review the access protocols to covered data and present a report to the Provost.

III. Employee training and education

While directors and supervisors are ultimately responsible for ensuring compliance with information security practices, Information Technology and the Directors of Student Financial Aid, and Financial Services will develop training and education programs for all employees who have access to covered data. These employees typically fall into three categories: professionals in information technology who have general access to all University data; data stewards; and those employees who use the data as part of their essential job duties.

IV. Oversight of Service Providers and Contracts

GLB requires the University to take reasonable steps to select and retain service providers who maintain appropriate safeguards for covered data and information. The Director of Financial Services will develop and send form letters to all covered contractors requesting assurances of GLB compliance. Steps will be taken to ensure that all relevant future contracts include a privacy clause and that all existing contracts are in compliance with GLB.

V. Evaluation and Revision of the Information Security Program

GLB mandates that this Student Financial Information Security Program be subject to periodic review and adjustment. Processes such as data access procedures and the training program should undergo regular review in relevant offices of the University.  The plan itself as well as the related data retention policy should be reevaluated annually in order to assure ongoing compliance with current laws and regulations.  The Coordinator of IT Policy and Planning will remind relevant offices each year of the need to review policies and procedures.