Topics Map > Policies
Topics Map > Security
Information Security Program - Sec 3: Specific Compliance with FTC Safeguard Rules
The Gramm-Leach-Bliley (GLB) Act requires financial institutions to ensure the security and confidentiality of personal information that is collected from customers, such as their names, addresses and phone numbers; bank and credit card account numbers; income and credit histories; and Social Security numbers. This policy is to comply with rules established by the Federal Trade Commission for financial institutions for the safeguarding of Non-Public Personal Information (NPI) under the GLB Act. The University meets the definition for a financial institution under the GLB Act. Provisions of the GLB Act relating to privacy are covered under the University policy with respect to the Family Educational Rights and Privacy Act (FERPA). This policy covers the safeguarding of customer records and information. Listed below is a compliance assessment for the University of Wisconsin-Platteville as of May 23, 2003.
The Gramm-Leach-Bliley (GLB) Act requires financial institutions to ensure the security and confidentiality of personal information that is collected from customers, such as their names, addresses and phone numbers; bank and credit card account numbers; income and credit histories; and Social Security numbers. This policy is to comply with rules established by the Federal Trade Commission for financial institutions for the safeguarding of Non-Public Personal Information (NPI) under the GLB Act. The University meets the definition for a financial institution under the GLB Act. Provisions of the GLB Act relating to privacy are covered under the University policy with respect to the Family Educational Rights and Privacy Act (FERPA). This policy covers the safeguarding of customer records and information. Listed below is a compliance assessment for the University of Wisconsin-Platteville as of May 23, 2003.
1. Designate one or more employees to coordinate the safeguards.
The designated employee for the coordination and execution of this information security plan is John Krogman, Assistant Vice Chancellor for Information Services & Chief Information Officer (CIO). All correspondence and inquiries should be directed to: Chief Information Officer, University of Wisconsin - Platteville, 1 University Plaza, Platteville, Wisconsin 53818.
2. Identify and assess the risks to customer information in each relevant area of institution's operation, and evaluate the effectiveness of the current safeguards for controlling these risks.
The following campus operations have been identified as relevant areas requiring compliance to this policy:
- Financial Aid Office
- Perkins Student Loan Office
- Cashier/Student Accounts Receivable Office
- Student Records (Registrar's Office)
- Admissions Office
- Office of Information Technology
The risks to customer information and the plans for safeguarding such information are as follows:
The basic risk is the ability of unauthorized individuals or organizations to access, by any means, the confidential non-public personal information (NPI) of our customers. Such information is gathered in the course of our business operations to provide resources and services to such customers.
Such risks present themselves in hardcopy and electronic formats. Data gathering is accomplished by a variety of methods and forms. As such, the risks exist from the time of acquisition, through the storage phase (hardcopy/electronic), and until physical destruction of hardcopy files or purging of electronic records.
Storage facilities may consist of file cabinets, lateral files, cardboard boxes, or other appropriate medium including electronic data storage on numerous servers across campus. Third party vendors could also retain NPI in any of the mentioned formats.
The storage medium shall dictate the precautions necessary to preserve confidentiality of the NPI.
3. Design and implement a safeguards program, and regularly monitor and test it.
The CIO will coordinate with the internal auditor's office to maintain the information safeguarding/security program.
The CIO will provide guidance in complying with all privacy regulations. Each relevant area is responsible to secure customer information in accordance with all privacy guidelines. The addendum to this policy details the information security policies and processes for compliance by each relevant area. Copies of the policy shall be made available to anyone upon request.
In addition, Information Technology Services (ITS) will maintain and provide access to policies and procedures that protect against any anticipated threats to the security or integrity of electronic customer information and that guard against the unauthorized use of such information. ITS will also provide periodic training for departments accessing customer information.
4. Select appropriate service providers and contract with them to implement safeguards.
The University of Wisconsin - Platteville, in conjunction with the University of Wisconsin System, will select appropriate service providers that are given access to customer information in the normal course of business and will contract with them to provide adequate safeguards. In the process of choosing a service provider that will have access to customer information, the evaluation process shall include the ability of the service provider to safeguard customer information. Contracts with service providers shall include provisions similar to the following:
- an explicit acknowledgment that the contract allows the contract partner access to confidential information;
- a specific definition of the confidential information being provided;
- a stipulation that the confidential information will be held in strict confidence and accessed only for the explicit business purpose of the contract;
- a guarantee from the contract partner that it will ensure compliance with the protective conditions outlined in the contract;
- a guarantee from the contract partner that it will protect the confidential information it accesses according to commercially acceptable standards and no less rigorously than it protects its own customers' confidential information;
- a provision allowing for the return or destruction of all confidential information received by the contract partner upon completion of the contract;
- a stipulation allowing the entry of injunctive relief without posting bond in order to prevent or remedy breach of the confidentiality obligations of the contract;
- a stipulation that any violation of the contract's protective conditions amounts to a material breach of contract and entitles the University of Wisconsin Platteville to immediately terminate the contract without penalty;
- a provision allowing auditing of the contract partners' compliance with the contract safeguard requirements; and
- a provision ensuring that the contract's protective requirements shall survive any termination agreement.
5. Designation of monitoring and evaluation provisions.
This information safeguarding/security plan shall be evaluated and adjusted in light of relevant circumstances, including changes in the University of Wisconsin - Platteville's business arrangements or operations, or as a result of testing and monitoring the safeguards. Periodic reviews will be performed by internal audit to identify and assess the risks to customer information and evaluate the effectiveness of current safeguards in controlling these risks. The services of the University of Wisconsin System's Office of Operations Review and Audit and Office of General Counsel shall be consulted as needed in evaluating risk.