Required Information Security Page

PROGRAM:

Gramm-Leach-Bliley Act (GLBA) Required Information Security Program

STATEMENT:

This document summarizes the Georgetown University’s comprehensive written information security program mandated by the Federal Trade Commission’s Safeguards Rule and the Gramm-Leach-Bliley Act (GLBA).

APPLICABILITY:

The GLBA Information Security Program applies to any record containing nonpublic financial information about a student or other third party who has a relationship with Georgetown University, whether in paper, electronic or other form, which is handled or maintained by or on behalf of Georgetown University or its affiliates. For these purposes, the term nonpublic financial information shall mean any information (i) a student or other third party provides in order to obtain a financial service from Georgetown University, (ii) about a student or other third party resulting from any transaction with Georgetown University involving a financial service, or (iii) otherwise obtained about a student or other third party in connection with providing a financial service to that person.

DEFINITIONS:

Financial Service:

A “Financial Service” is defined by federal law to include, but not be limited to, such activities as the lending of money; investing for others; providing or underwriting insurance; giving financial, investment or economic advisory services; marketing securities and the like.

GUIDING PRINCPLES/PURPOSE

In particular, this document describes the elements of the GLBA Information Security Program pursuant to which Georgetown University intends to (i) ensure the security and confidentiality of covered records, (ii) protect against any anticipated threats or hazards to the security of such records, and (iii) protect against the unauthorized access or use of such records or information in ways that could result in substantial harm or inconvenience to customers. The GLBA Information Security Program incorporates by reference Georgetown University’s policies and procedures enumerated below, and is in addition to any institutional policies and procedures that may be required pursuant to other federal and state laws and regulations, including, without limitation, FERPA.

RESPONSIBILITY(IES):

Georgetown University’s University Information Security Officer (UISO) with overall responsibility for overseeing university information security is responsible for coordinating and overseeing the information security program. Consistent with the University Information Security Policy, the UISO may designate other representatives of Georgetown University to oversee and coordinate particular elements of the GLBA Information Security Program. Any questions regarding implementation or the interpretation of this document should be directed to the UISO or his/her designees.

ADMINISTRATION AND IMPLEMENTATION:

1. Risk Identification and Assessment. Georgetown University intends, as part of the GLBA Information Security Program, to undertake to identify and assess external and internal risks to the security, confidentiality, and integrity of nonpublic financial information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information. In implementing the GLBA Information Security Program, the UISO or his/her designee will establish procedures for identifying and assessing such risks in each relevant area of Georgetown University’s operations, including:
   • Employee training and management. The UISO will coordinate with representatives in Georgetown University’s Financial Aid offices to evaluate the effectiveness of the university’s procedures and practices relating to access to and use of student records, including financial aid information. This evaluation will include assessing the effectiveness of Georgetown University’s current policies and procedures in this area, including:

     Release of Student Information Policy
     http://www12.georgetown.edu/undergrad/bulletin/#student
     Confidential Information Policy
     http://data.georgetown.edu/hr/employment_services/policies/gu403.html

   • Information Systems and Information Processing and Disposal. The UISO will assess the risks to nonpublic financial information associated with Georgetown University’s information systems, including network and software design, information processing, and the storage, transmission and disposal of nonpublic financial information. These risks will be evaluated in view of Georgetown University’s Computer Systems Acceptable Use Policy, the University Information Security Policy and the Records Retention Policy.
   • Detecting, Preventing and Responding to Attacks. Consistent with the provisions of the University Information Security Policy, the UISO and/or his/her designee will evaluate procedures for and methods of detecting, preventing and responding to attacks or other system failures and existing network access and security policies and procedures, as well as procedures for coordinating responses to network attacks and developing incident response teams and policies. The UISO may elect to delegate to local information security personnel the responsibility for monitoring and participating in the dissemination of information related to the reporting of known security attacks and other threats to the integrity of networks utilized by Georgetown University.
2. Designing and Implementing Safeguards. The risk assessment and analysis described above shall apply to all methods of handling or disposing of nonpublic financial information, whether in electronic, paper or other form. The UISO, in collaboration with the Internal Audit and Management Department, will, on a regular basis, implement safeguards to control the risks identified through such assessments and to regularly test or otherwise monitor the effectiveness of such safeguards. Such testing and monitoring may be accomplished through existing network monitoring and problem escalation procedures.
3. Overseeing Service Providers. The UISO or his/her designee shall coordinate with those responsible for the third party service procurement activities among UIS and other affected departments to raise awareness of, and to institute methods for, selecting and retaining only those service providers that are capable of maintaining appropriate safeguards for nonpublic financial information of students and other third parties to which they will have access. In addition, the UISO will work with the Office of General Counsel and Financial Affairs Administrative Services to develop and incorporate standard, contractual protections applicable to third party service providers, which will require such providers to implement and maintain appropriate safeguards. Any deviation from these standard provisions will require the approval of the Office of General Counsel. These standards shall apply to all existing and future contracts entered into with such third party service providers, provided that amendments to contracts entered into prior to June 24, 2002 are not required to be effective until May 2004.
4. Adjustments. The UISO is responsible for evaluating and adjusting the GLBA Information Security Program based on the risk identification and assessment activities undertaken, as well as any material changes to Georgetown University’s operations or other circumstances that may have a material impact it.

ENFORCEMENT:

As described in the University Information Security Policy, anyone found to have violated this policy may be subject to disciplinary action, up to and including suspension of services or termination of employment.

RESOURCE(S):

The University Information Security Policy, the Records Retention Policy and Computer Systems Acceptable Use Policy.

APPROVAL:

Approved by H. David Lambert, Vice President for Information Services and Chief Information Officer, May 22, 2003

REVIEW CYCLE:

This program will be reviewed and updated as needed, at least annually, based on the recommendations of the University Information Security Officer.