Policies & Procedures

IT9004.1 Qualified Individual Procedure

Purpose

The purpose of this procedure is to ensure SUNY Broome Community College (the “College”) appoints an individual who maintains Information and Information Systems in support of the College’s educational mission and operations. This Information Security Policy (this “Policy”) has been adopted to protect the confidentiality, integrity, and availability of the College’s Information and Information Systems. This procedure has also been adopted to comply with laws governing the College’s Information and/or Information Systems and is validated/reviewed annually.

Postsecondary institutions and third-party servicers must protect student financial aid information provided to them by the Department or otherwise obtained in support of the administration of the Federal Student Financial Aid Programs (Title IV programs), authorized under Title IV of the Higher Education Act of 1965, as amended (HEA). Each institution participating in the Title IV programs has agreed in its Program Participation Agreement (PPA) to comply with the GLBA Safeguards Rule under 16 C.F.R. Part 314. Institutions and servicers also sign the Student Aid Internet Gateway (SAIG) Enrollment Agreement, which states that they will ensure that all Federal Student Aid applicant information is protected from access by, or disclosure to, unauthorized personnel and that they are aware of and will comply with all of the requirements to protect and secure data obtained from the Department’s systems to administer the Title IV programs.

Statement of the Procedure

The appointed Qualified Individual shall verify annually that SUNY Broome has a written Information Security Program and that the written information security program addresses the GLBA required minimum elements.

The Qualified Individual is required to report in writing regularly and at least annually to the Board of Directors. The report must include information on:

• The overall status of the Information Security Program and the College’s compliance with the Information Security Program;
• Material matters related to the Information Security Program, addressing issues such as risk assessment, risk management, and control decisions, service provider arrangements, results of testing, security events or violations, management responses to events/violations, and recommendations for changes in the Information Security Program.

The Qualified Individual will notify the State University of New York (SUNY) Chief Information Security Officer (CISO) if a security incident or significant security event occurs.

SUNY Broome’s Information Security program is based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks.

In accordance with Gramm-Leach-Bliley Act (GLBA) section 16 C.F.R. 314.4(a), the Chief Information Officer is hereby appointed as the “Qualified Individual” for the SUNY Broome Community College Information Security Program. The responsibilities of this appointment are to ensure that SUNY Broome has implemented and is monitoring its Information Security program.

Related Policies

IT9004

To Whom it Applies

This procedure applies to all students, faculty, affiliates, emeriti, and staff of the College (part-time and full-time), as well as all independent contractors, interns, consultants, and other third parties, inclusive of anyone who has access to network or email services. The procedure applies regardless of the user’s physical location (e.g., College offices, hotels, airports, user homes, etc.).

Appendix

Appendix GLBA Updates to the Gramm-Leach-Bliley Act Cybersecurity Requirements

Action (Created, Reviewed, Retired)