Business, Management, and Financial

Gramm – Leach – Bliley Act (GLBA)

This document summarizes the Institution’s comprehensive written information security Information Security Program mandated by the Federal Trade Commission’s Safeguards Rule and the Gramm – Leach – Bliley Act (GLBA).  In particular, this document describes the Program elements pursuant to which the Institution intends to (i) ensure the security and confidentiality of covered records, (ii) protect against any anticipated threats or hazards to the security of such records, and (iii) protect against the unauthorized access or use of such records or information in ways that could result in substantial harm or inconvenience to customers. The Program incorporates by reference the Institution’s policies and procedures enumerated below and is in addition to any institutional policies and procedures that may be required pursuant to other federal and state laws and regulations, including, without limitation, FERPA.  

Designation of Representatives

The Institution’s Director of Information Technology, is designated as the Program Officer who shall be responsible for coordinating and overseeing the Program.  The Program Officer may designate other representatives of the Institution to oversee and coordinate particular elements of the Program.  Any questions regarding the implementation of the Program or the interpretation of this document should be directed to the Program Officer or his or her designees. 

Scope of Program

The Program applies to any record containing nonpublic financial information about a student or other third party who has a relationship with the Institution, whether in paper, electronic or other form, that is handled or maintained by or on behalf of the Institution or its affiliates.  For these purposes, the term nonpublic financial information shall mean any information (i) a student or other third party provides in order to obtain a financial service from the Institution, (ii) about a student or other third party resulting from any transaction with the Institution involving a financial service, or (iii) otherwise obtained about a student or other third party in connection with providing a financial service to that person. 

Elements of the Program

Risk Identification and Assessment. The Institution intends, as part of the Program, to undertake to identify and assess external and internal risks to the security, confidentiality, and integrity of nonpublic financial information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information.  In implementing the Program, the Program Officer will establish procedures for identifying and assessing such risks in each relevant area of the Institution’s operations, including: 

Employee training and management.  The Program Officer will coordinate with Colby Community College to evaluate the effectiveness of the Institution’s procedures and practices relating to access to and use of student records, including financial aid information.  This evaluation will include assessing the effectiveness of the Institution’s current policies and procedures in this area, including compliance requirements resulting from the following external provisions:

Family Educational Rights & Privacy Act (FERPA)

Health Insurance Portability & Accountability Act (HIPAA)

Federal Trade Commission – Red Flag Policies

General Data Protection Regulation (GDPR)

Gramm-Leach-Bliley Act (GLBA)

Information Systems and Information Processing and Disposal.  The Program Officer will coordinate with representatives of the Institution’s Department of Information Technology to assess the risks to nonpublic financial information associated with the Institution’s information systems, including network and software design, information processing, and the storage, transmission and disposal of nonpublic financial information.  This evaluation will include assessing the Institution’s current policies and procedures relating to the following:

Use of Computers/College Computing and Information Systems

Use of Colby Community College Individual Email Account

Intellectual Property

Copyright Infringement Policy

Record Retention Policy

The Program Officer will also coordinate with the Institution’s Department of Information Technology to assess procedures for monitoring potential information security threats associated with software systems and for updating such systems by, among other things, implementing patches or other software fixes designed to deal with known security flaws. 

Detecting, Preventing and Responding to Attacks.  The Program Officer will coordinate with the Institution’s Department of Information Technology to evaluate procedures for and methods of detecting, preventing and responding to attacks or other system failures and existing network access and security policies and procedures, as well as procedures for coordinating responses to network attacks and developing incident response teams and policies.  In this regard, the Program Officer may elect to delegate to a representative of the Department of Information Technology the responsibility for monitoring and participating in the dissemination of information related to the reporting of known security attacks and other threats to the integrity of networks utilized by the Institution. 

Designing and Implementing Safeguards.  The risk assessment and analysis described above shall apply to all methods of handling or disposing of nonpublic financial information, whether in electronic, paper or other form.  The Program Officer will, on a regular basis, implement safeguards to control the risks identified through such assessments and to regularly test or otherwise monitor the effectiveness of such safeguards.  Such testing and monitoring may be accomplished through existing network monitoring and problem escalation procedures. 

Additionally, the College has implemented the following safety protocols:

• • • Implemented and periodically reviewed access controls
    • The College will conduct a periodic inventory of data, noting where it’s collected, stored, and transmitted.
    • Encrypted customer information on the institution’s system and while it is in transit.
    • Assess apps developed by the institution.
    • Implemented multi-factor authentication for anyone accessing customer information on the institution’s system.
    • Dispose of customer information securely.
    • Anticipate and evaluate changes to the information system or network.
    • Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
      
      

Overseeing Service Providers.  The Program Officer shall coordinate with those responsible for the third-party service procurement activities among the Department of Information Technology and other affected departments to raise awareness of, and to institute methods for, selecting and retaining only those service providers that are capable of maintaining appropriate safeguards for nonpublic financial information of students and other third parties to which they will have access.

Adjustments to Program. The Program Officer is responsible for evaluating and adjusting the Program based on the risk identification and assessment activities undertaken pursuant to the Program, as well as any material changes to the Institution’s operations or other circumstances that may have a material impact on the Program.  

 

[Added November 2021]
[Revised October 2023]