Ϲ

header-logo
Main Campus Entrance-MKE
Gramm-Leach-Bliley Act (GLBA) Compliance Program

Gramm-Leach-Bliley Act (GLBA) Compliance Program

Ϲ's Commitment

The Gramm-Leach-Bliley Act (GLBA) requires financial institutions, including universities that offer financial aid, to protect the privacy and security of consumer financial information. The GLBA Safeguards Rule mandates the implementation of an Information Security Program to safeguard sensitive data.

This page outlines the Ϲ’s commitment to GLBA compliance and the measures we take to protect student and employee financial information.

The program applies to all Ϲ departments and personnel who handle:

  • Student financial aid records
  • Tuition payment and billing information

The GLBA Information Security Program is overseen by the Ϲ Chief Information Officer. Consistent with the University Information Security Policy who may designate other qualified representatives of the Ϲ to oversee and coordinate particular elements of the GLBA Information Security Program.

Safeguards and Controls

To comply with GLBA, the Ϲ has implemented the following safeguards:

Risk Assessment

  • Regular assessments of internal and external risks to data security
  • Identification of vulnerabilities in systems and processes

Access Controls

  • Role-based access to sensitive data
  • Bi-annual review of account access

Encryption and Data Protection

  • Encryption of data for required reporting
  • Secure storage and disposal of physical and digital records

Employee Training

  • Annual cybersecurity awareness training
  • First-time FERPA training for new users

Vendor Management

  • Contracts with third-party service providers include data protection clauses
  • Periodic reviews of vendor compliance with GLBA standards

Incident Response

  • Documented procedures for responding to data breaches
  • Notification protocols for affected individuals and regulatory bodies

Reporting

  • Annual report written to the Ϲ to the Board of Trustees

Compliance Monitoring

  • Regular reviews of the Information Security Program and supporting policies
  • Penetration testing and vulnerability scans
  • Internal audits of data handling practices

Additional Resources