It was also before the additional compliance burden of the updated Safeguards Rule. The FSA translated that rule into nine elements that colleges and universities must include in their information security program, such as:

Designate one person responsible for overseeing and implementing the security program. For institutions maintaining information on 5,000 or more students, that person is required to report on the security program “regularly and at least annually to those with control over the institution.”
Base the program on a risk assessment that identifies “reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information.”
Test or otherwise monitor the effectiveness of the safeguards implemented “regularly.” From there, institutions must evaluate and adjust their programs in light of the results, changes to their operations or vendor arrangements, and “any other circumstances that it knows or has reason to know may have a material impact on the information security program.”
Establish an incident response plan for cybersecurity breaches if the institution maintains information on 5,000 or more students.

As part of its Safeguards Rule announcement, the FSA also encouraged institutions to “begin incorporating” controls published by the National Institute of Standards and Technology: NIST 800-171. Those controls include technical components in areas such as access permissions, network integrity, encryption and vulnerability scanning.

Instant Insights /

With new safeguards rule, cybersecurity programs become even more critical for higher ed

Related Stories

Recommended For You