Gramm-Leach-Bliley Act (GLBA) Compliance Program
Ϲ's Commitment
The Gramm-Leach-Bliley Act (GLBA) requires financial institutions, including universities that offer financial aid, to protect the privacy and security of consumer financial information. The GLBA Safeguards Rule mandates the implementation of an Information Security Program to safeguard sensitive data.
This page outlines the Ϲ’s commitment to GLBA compliance and the measures we take to protect student and employee financial information.
The program applies to all Ϲ departments and personnel who handle:
- Student financial aid records
- Tuition payment and billing information
The GLBA Information Security Program is overseen by the Ϲ Chief Information Officer. Consistent with the University Information Security Policy who may designate other qualified representatives of the Ϲ to oversee and coordinate particular elements of the GLBA Information Security Program.
- For questions about the GLBA Compliance Program, please contact the Ϲ Provost Office at provostoffice@mcw.edu.
- For questions specific to the GLBA Security Program, please contact Ϲ Information Services at InformationServices@mcw.edu.
Safeguards and Controls
To comply with GLBA, the Ϲ has implemented the following safeguards:
Risk Assessment
- Regular assessments of internal and external risks to data security
- Identification of vulnerabilities in systems and processes
Access Controls
- Role-based access to sensitive data
- Bi-annual review of account access
Encryption and Data Protection
- Encryption of data for required reporting
- Secure storage and disposal of physical and digital records
Employee Training
- Annual cybersecurity awareness training
- First-time FERPA training for new users
Vendor Management
- Contracts with third-party service providers include data protection clauses
- Periodic reviews of vendor compliance with GLBA standards
Incident Response
- Documented procedures for responding to data breaches
- Notification protocols for affected individuals and regulatory bodies
Reporting
- Annual report written to the Ϲ to the Board of Trustees
Compliance Monitoring
- Regular reviews of the Information Security Program and supporting policies
- Penetration testing and vulnerability scans
- Internal audits of data handling practices