The Gramm-Leach-Bliley Act

The following table illustrates the mapping of the departments that fall under the scope of the GLBA Safeguard Rules.

GLBA Safeguard Rules Scope for Title IV Schools

This section discusses the main roles and responsibilities required to effectively execute the GLBA Compliance program.

The GLBA Compliance Program Coordinator (Coordinator) serves as the University’s FTC‑designated ‘Qualified Individual,’ with authority and expertise to develop, implement, and oversee the information security program required under 16 CFR Part 314.

The GLBA Compliance Program Coordinator (Qualified Individual) implements and reports on the program and may delegate specific elements to appropriate offices while maintaining overall accountability. The Coordinator is appointed by the Vice President for Business Affairs.

The Coordinator:

• Works closely with the University Registrar, Human Resources, the Office of the General Counsel, the Office of the Bursar, the Office of Student Financial Aid, the Internal Audit Department, and such other offices and units as they have an interface with or control over covered data.

• Consults with responsible offices to identify units and areas of the University with access to covered data. As part of this Compliance Program, the Coordinator has identified University units and areas with access to covered data.

• Conducts surveys or utilizes other reasonable measures to confirm that all areas with covered information are included within the scope of this Compliance Program. The Coordinator maintains a list of University areas and units with access to covered data.

• Ensures that risk assessments and monitoring are carried out for each unit or area that has covered data and that appropriate controls are in place for the identified risks.

• Works to ensure adequate training and education are developed and delivered for all employees with access to covered data.

• Verifies that existing policies, standards, and guidelines that provide for the security of covered data are reviewed and adequate.

• Makes recommendations for revisions to policy, or the development of new policy, as appropriate.

• Updates this Compliance Program, including this and related documents, from time to time.

• Ensures the written security plan is maintained and makes the plan available to the University community.

Keeping security risks at a low is St. John’s priority. The University’s information security structure ensures that risks of any kind are minimized. There is quality assurance that comprehensive processes are in place for best practices and information protection. The areas are listed below:

• Risk Assessment
  • Third-party Risk Management
• Vulnerability Assessment and Penetration Testing
• Vulnerability and Patch Management
• Access Control
• Acceptable Use
• Cryptography
• Security Awareness, Training, and Education
• Incident Response

The Compliance Program identifies the flow of the data processed throughout the University to assist in the identification of risks to privacy and security. This activity includes determining

• The types of data being processed by the various business units
• The format of the data processed, and the location of the data being used and stored
• The purpose of the data being processed

• Identifies reasonably foreseeable external and internal risks to the security, confidentiality, and integrity of covered data that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromises of such information; and
• Assesses the sufficiency of any safeguards in place to control these risks.
• The Coordinator works with all relevant departments to carry out comprehensive risk assessments

Risk assessments are conducted at least annually and upon material changes to business processes, technology, or the threat landscape. Assessments identify reasonably foreseeable internal and external threats, evaluate likelihood and impact, and document decisions regarding risk mitigation, acceptance, or remediation. Findings drive the design, testing, and monitoring of safeguards.

This process includes system-wide risks as well as risks unique to each area with covered data, and the effectiveness of management practices currently in place to ensure compliance and security enhancement. Risk assessments shall include consideration of risks in each relevant area of operations and cover processes for handling, storing, and disposing of the paper records; processes for detecting, preventing, and responding to security failures; and employee training and management, including the appropriateness and frequency of staff and management security awareness training.

As a result of the risk assessment, recommendations are made as necessary to change management practices to improve business controls and/or to implement information safeguards. The University has developed a set of policies and procedures to guide the security and privacy of data covered by GLBA.

St. John’s University is diligent in its routine testing and monitoring of its systems, and the safeguards implemented are based on the outcomes of the risk assessment.

The University ensures vulnerability assessment on systems that transmit, process, or store covered data.

Access control is St. John’s University’s ability to maintain, implement, and control its policies, standards, and procedures.

To control the integrity and privacy of data that is processed, stored, and transmitted, the University uses industry acceptable and approved encryption algorithms and solutions for access control. St. John’s encrypts covered customer information both in transit and at rest. Where encryption is not feasible, documented compensating controls are approved by the qualified individual and reviewed routinely.

Multifactor Authentication is required for all users accessing systems that store or process covered customer information.

St. John’s University is diligent in its data collection, retention, and disposal efforts. The University’s record retention process is in accordance with the GBLA. The program

• Removes the maintenance of unnecessary documents from the onset of data collection to the end of the retention process.

• Supports the maintenance of records filing systems to better facilitate retrieval and use.

• Protects most important, up-to-date information while less valueless information is disposed of or transferred to the appropriate secured storage area.

• Safeguards information essential to St. John’s daily business operations.

The following shall guide the training and management of employees:

• St. John’s University implements required training programs to ensure administrators and staff are aware of protocols for protecting customer information.
• All training programs or materials incorporate concepts relevant to both electronic and paper-based customer information.
• Department managers and supervisors keep employees informed about policies and programs that pertain to their work, including those that govern GLBA compliance.
• Managers and supervisors ascertain which positions deal with customer information and assess whether these positions should be classified as “critical positions” requiring background checks, as provided for by St. John’s personnel policy.
• Department managers and supervisors ensure employees complete the mandatory core security training and specific GLBA training as assigned.
• All University employees who interact with the covered PII data during their daily activities are required to complete the GLBA Compliance training course describing their responsibilities while handling the personally identifiable information (PII).
  • Annual cybersecurity training for all personnel;
  • Role‑based GLBA training for staff handling covered customer information;
  • Phishing exercises that have been designed and implemented by the IT department (and approval from security governance) to help employees to identify fake emails from authentic ones and not respond to questionable emails or communications;
  • Informative campus-wide communications regarding phishing, spear phishing, and other types of spam email; and
  • Mandatory security training for specific users working with electronic protected health information (EPHI).

St. John’s University’s documented and outlined Incident Response Plan and Procedures address possible threats that could arise concerning information technology, privacy, and cyber incidents. The University’s preparation in planning regarding these threats includes instruction for University employees to take against potential threats. These steps are listed below:

1. Formal and detailed documented responses/reports for investigative purposes or for resolving cyber issues.
2. Detection tools that readily identify cyberattacks or system anomalies.
3. Official tabletop exercises to prepare teams for common and emerging threats.
4. Incident Response Tickets that capture status, impact, assessment, evidence, containment, eradication, recovery, and postincident actions.

The University may appropriately share covered data with third parties. When third-party business is conducted, however, appropriate risk management activities are in place to minimize any corresponding potential risks. These activities include, but are not limited to, reputational, financial, operational, strategic, and compliance risks. The decision to engage with third parties must be consistent with the University’s business objectives, and they must be made after careful consideration of the risks involved are contracted for implementing and maintaining such safeguards.

The Coordinator, working with responsible units and offices, monitors, evaluates, and adjusts the Compliance Program in light of the results of testing and monitoring of the risks identified, as well as in response to any material changes to operations or business arrangements and any other circumstances which may reasonably have an impact on the Compliance Program. This program document will be reviewed, at a minimum, annually by the CIO and GLBA working committee.