GLBA Program

Southern= Methodist University

Program = for the Security of Non-Public Personal Information

Overview=

The Financial Services Modernization Act of 1999 (the Gramm-Leach-Bliley Act or “GLB”) regulates the disclosure of non-public personal information by financial institutions. Institutions of higher education s= uch as Southern Methodist University are considered to be financial institutions because they participate in financial activities, such as the Federal Perki= ns Loan Program.

The goal of this document is to set forth the University’s program to (i) ensure the security and confidentiality of non-public information covered by GLB, (ii) protect against anticipated thr= eats or hazards to the security of such information, and (iii) protect against t= he unauthorized access or use of such records or information in ways that could result in harm or inconvenience to consumers. This document will define the University's Program for the Security of Non-Public Personal Information, designate employees responsible for the coordination and administration of = the Program, and provide an outline to assure ongoing compliance with federal regulations related to the Program and other privacy and security considerations.

In order to protect critical information and data as r= equired by GLB, this program documents certain practices in the University informat= ion environment and institutional information security procedures. These practices cover both paper a= nd electronic information and data and impact diverse areas of the University.= Since safeguarding non-public information is a good business practice irrespective of legislative requirements, the University has expanded the Program to cover areas handli= ng both GLB-protected information and other information protected by state and other federal privacy laws, including, but not limited to:

¨ Information Technology Services

¨ Business Services

¨ Enrollment Services

¨ Development and External Affairs

¨ Residence Life and Student Housing

¨ Health Center

¨ Other Student Affairs offices

¨ Libraries

¨ Athletics

¨ Police Department

¨ Copy Center

¨ Impressions

¨ Computer Corner

¨ Payroll

¨ Risk Management

¨ Division of Education and Lifelong Learning<= /p>

¨ Advanced Computer Education Centers

¨ Student Association

¨ Hart eCenter

¨ Other, including ticket offices, short cours= es and seminars, law clinic, summer camps, Upward Bound, and the International Office

¨ Various third party contractors, including dining services and the bookstore

Designation of Representatives

The University considers compliance with GLB to be an institution-wide responsibility. It has designated three representatives to be responsible for coordinating compliance. The University Information Security Officer, empowered in University Policy 12.5 is responsible for coordinating and overseeing the Program pertaining to electronic data. The Universi= ty Information Security Officer is responsible for ensuring adherence to the University’s policies and procedures related to electronic data, and = that the elements of this program are in place to safeguard electronic informati= on described in Scope of Program, below. The Associate Provost = for Educational Programs is responsible for coordinating and overseeing the Pro= gram protecting printed data pertaining to students. The Associate Provost is responsib= le for ensuring adherence to the University’s policies and procedures relate= d to printed data pertaining to students, and that the elements of this program = are in place to safeguard printed information described in Scope of Program, below. The Business and Finance designee is responsible for coordinating and overseeing the Program protecting all other printed data. The Business and Finance designee = is responsible for ensuring adherence to the University’s policies and p= rocedures related to this printed data, and that the elements of this program are in place to safeguard printed information described in Scope of Program, below. These individuals, hereinafter referred to as Program Officers, will work with the appropriate vice presidents to designate representatives to o= versee, coordinate and carry out various requirements of this program for departmen= ts in their areas handling or maintaining non-public financial data covered wi= thin the scope of this program.

The Program Officers assist University departments to = identify reasonably foreseeable internal and external= risks to the security, confidentiality, and integrity of consumer non-public information; evaluate the effectiveness of the current safeguards for controlling these risks; design and implement a safeguards program, and regularly monitor and test the program. Any questions regarding the Progra= m or this document should be directed to a Program Officer.

Scope of Program

The Program applies to any record containing non-public information about students, faculty, staff or other third parties who have a relationship with the University, whether it is in paper, electronic or other form that is collected, handled or maintained by or on behalf of the University. For these purposes, non-public information includes, but is not limited to information pertaining to a stu= dent or other third party:

¨ Provided in order to obtain a financial serv= ice from the University

¨ Resulting from any transaction involving a financial service provided by the University

¨ Resulting from providing financial services = to a student, faculty, staff or other third party.

Further, for purposes of this program, covered data and non-public information includes, but is not limited to bank and credit card informatio= n, income and credit histories and tax information, in both paper and electron= ic format, received directly or indirectly in the course of business by the University. In addition to no= n-public financial information, data such as names, addresses, phone numbers, credit card numbers, social security numbers and credit histories are covered under GLB.

Risk Identification and Assessment

The Program Officers must work= with all relevant areas of the University to identify potential and actual risks= to security and privacy of information, assessing external and internal risks to the security, confidentiality, and integrity of non-public financi= al information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information. Risk identification and assessment will include evaluation of (i) employee train= ing and management; (ii) adequacy of information systems, information processin= g, storage, transmission and disposal; and (iii) detection, prevention and response to attack on systems. The Program Officers will establish procedures to reassess risks and monitor compliance at the University no less frequently than annually. In addition, the department representatives designated by the vice presidents will document departmental procedures to safeguard non-public financial information in their areas, any incidents of breach of procedures, and responses thereto. The Program Officers will review t= his documentation no less frequently than annually and implement corrective actions, as necessary.

Safeguards

The University has or will imp= lement policies and procedures to safeguard the non-public financial information covered herein. Existing poli= cies address the privacy and confidentiality of personal information handled or maintained at the University. To the extent that non-public financial information is included with the records referenced in those policies, the privacy and confidentiality requirements = of those policies also applies to non-public financial information. Further, to the extent that curren= t policies address a standard of conduct and responsibility pertaining to one type of = data or media (e.g., electronic), the same standard of conduct and responsibility also pertains to other types (e.g., printed). Relevant policies include:

1.12 Policy on Privacy of Health Information

1.18 Family Educational Righ= ts and Privacy Act (“FERPA”) Policy

12.3 Computing and Communications = Policy

12.4 Electronic Payment Processing=

12.5= Information Secu= rity

12.6= Password Managem= ent

1= 3.8 Policy for Service of Subpoenas and Responding to Subpoenas or Other Requests for Reco= rds of Current or Former Students and Employees

Elements of the UniversityR= 17;s program to safeguard non-public financial information include, but are not limited to:

Employment training and management. The Program Officers will arrange appropriate training and communication through Human Resources’ Professional Development Program. Through training and communication, faculty and staff handling or responsible for maintaining non-public financial information will be educat= ed about the confidentiality and privacy requirements pertaining to the non-pu= blic financial data to which they have access.&= nbsp; Review of the adequacy of training and communication as well as compliance with these requirements will be no less frequently that annually= .

Information Systems and Information Processing and Disposal. This program requires the University to establish and maintain requirements to control access to University and third party systems to minimize the risk o= f a system breach, including, but not limited to password requirements, firewall and router specifications and encryption requirements. In addition, the Program requires = each department to establish and maintain controls pertaining to the processing, storage, transmission and disposal of non-public financial data it manages = or handles, including, but not limited to password requirements, deletion procedures, document shredding and the use of locked offices and file cabin= ets. The adequacy of and compliance with these requirements and specifications should be reviewed regularly, but no less frequently than annually.

Detecting, Preventing and Responding to Attacks. The University Information Security Officer is responsible for assessing= the risks to non-public financial information associated with the University’s electronic information systems, including network and software design, information processing, and the storage, transmission and disposal of non-public financial information. This evaluation will include asses= sing the Institution’s current polices and procedures relating to University’s network and network security, document retention and destruction. The University Information Security Officer will also assess procedures for monitoring potential information security threats associated with software systems and= for updating such systems by, among other things, implementing patches or other software fixes designed to deal with known security flaws.

Service Provi= ders and Contracts

The University will select and retain service provider= s who maintain appropriate safeguards for covered data and information. Vice Presidents will provide the P= rogram Officers with a list of all service providers that have access to non-public financial information pursuant to their business relationship with the University. The Program Offic= ers will work with University contacts of those service providers and Legal Aff= airs to develop appropriate addenda to all current service provider contracts requiring GLB compliance. Fur= ther, Legal Affairs will take steps to ensure that all relevant future contracts include a privacy clause and that all existing contracts are in compliance = with GLB.

Evaluation and Revision of the Program

GLB mandates that this Program for the Security of Non-Public Personal Information be subject to periodic review and adjustment. Generally, review requirements of elements of this program are no less frequently than annually. However, some revie= ws, such as those in Information Technology Services, will occur more frequently than annually, due to constantly changing technology and constantly evolving risks. Further, the Program a= nd associated policies are subject to regular review and modification, as appropriate, to assure ongoing compliance with existing and future laws and regulations.

Southern Methodis= t University

Information Security Program Addendum I

Information Technology Services Responsibilities

In order to protect the securi= ty and integrity of the University network and its data registry of all computers attached to the University network will be developed and maintained. The University op= erates under a distributed technology support model. Information Technology Services (ITS) will work with the appropria= te areas of the University to ensure proper registry records are maintained for those systems under the direct responsibility of those areas. This registry will include, where relevant, IP addres= s or subnet, MAC address, physical location, operating system, intended use (ser= ver, personal computer, lab machine, residence hall machine, etc.), and the pers= on, persons, or department primarily responsible for the machine

ITS assumes the responsibility= of assuring that patches for operating systems or software environments are reasonably up to date for those systems under their direct responsibility. ITS will work= with the other support organizations to ensure proper processes and procedures a= re in place for maintaining software patch currency. All support organizations will keep records of patching activity. ITS will review its procedures for patches to operating systems and software, and will keep current on potenti= al threats to the network and its data. Risk assessments will be updated regularly, but no less frequently t= han annually.

ITS bears primary responsibili= ty for the identification of internal and external risk assessment, but all member= s of the University community are involved in risk assessment. ITS, working in conjunction with t= he relevant University offices, will conduct regular risk assessments, includi= ng but not limited to the categories listed by GLB.

The University Information Sec= urity Officer, working in cooperation with relevant University offices, will deve= lop and maintain a data handbook, listing those persons or offices responsible = for each non-public financial data field in relevant software systems (Financia= ls, Student Administration, Advancement, and Human Resources). The University’s Internal Auditor, ITS and the= relevant offices will conduct ongoing audits of activity and will report any significant questionable activities.

The University Information Off= icer will work with the relevant offices (Human Resources, the Division of Enrollment Services, Development and External Affairs, and the Contr= oller’s Office ) to develop and maintain a registry of = those members of the University community who have access to non-public financial information. The University Information Officer, in cooperation with the various offices noted above, w= ill work to keep this registry rigorously up to date.

ITS will ensure the physical security of all servers and terminals which contain or have access to non-p= ublic financial information. ITS wi= ll work with appropriate areas of the University to develop guidelines for physical security of any covered servers in locations outside the central server area. The University will conduct a survey of other physical security risks, including the storage of covered paper records in non-secure environments, and other procedures, which may expose the University to risk= s.

While the University has discontinued usage of social security numbers as student identifiers, one of the largest security risks = may be the possible non-standard practices concerning social security numbers, = e.g. continued reliance by some University employees on the use of social securi= ty numbers. Social security numb= ers are considered protected information under both GLB and the Family Educatio= nal Rights and Privacy Act (FERPA). By necessity, student social security numbers still remain in the University student information system. However, the University will conduct an assessment to determine who = has access to social security numbers, in what systems the numbers are still us= ed, and in what instances students are inappropriately being asked to provide a social security number. This assessment will cover University employees as well as subcontractors such as the bookstore and food services.

ITS will utilize software programs and tools with writ= ten procedures to detect any actual or attempted attacks on covered systems and will develop incident response procedures for actual or attempted unauthori= zed access to covered data or information.

The University Internal Auditor will periodically revi= ew the University's disaster recovery program and data-retention policies and pres= ent a report to the Vice President for Business and Finance, et al.