Colleges and universities that take part in Title IV federal student aid must comply with the FTC’s GLBA Safeguards Rule (16 CFR Part 314). That means a written information security program, owned by a named Qualified Individual and built on a written risk assessment, that covers nine elements, from MFA and encryption to vendor oversight, incident response and an annual report to the board. The Department of Education checks it through the annual Single Audit or compliance audit and resolves findings in its administrative capability review. Institutions that pass cleanly map GLBA, FERPA and their other frameworks, such as NIST SP 800-171 for research data, to one set of controls in a GRC platform such as Compyl, so evidence is collected once and used everywhere.
The risk behind the rule is real. In Sophos’ State of Ransomware in Education 2025, exploited vulnerabilities were the leading technical root cause of ransomware attacks on higher education (35%), and attackers encrypted data in 58% of higher-ed attacks. Cybersecurity also ranks #3 on the 2027 EDUCAUSE Top 10, with data governance at #7.
Last updated November 2, 2026.
Key takeaways
- GLBA applies to every Title IV institution, which agrees to it in its Program Participation Agreement and Student Aid Internet Gateway (SAIG) Enrollment Agreement.
- The amended Safeguards Rule took effect June 9, 2023. Institutions holding information on 5,000 or more consumers must address all nine elements, including a written incident response plan and an annual board report.
- Two breach clocks apply: notify the FTC within 30 days when unencrypted data on 500+ consumers is acquired (effective May 13, 2024), and report to Federal Student Aid (FSA) within 24 hours.
- Auditors check that you named a Qualified Individual and that your written program covers the required elements. FSA can then require a corrective action plan, take administrative action or cut off system access.
- GLBA, FERPA and NIST SP 800-171 share the same core controls. One crosswalk turns three efforts into one evidence set.
Why does GLBA apply to colleges and universities?
GLBA regulates “financial institutions,” and the FTC has treated Title IV institutions as financial institutions for more than two decades. The 2025 OMB Compliance Supplement explains that the FTC considers them financial institutions “because they appear to be significantly engaged in wiring funds to consumers.” Thompson Coburn’s 2025 higher-ed GLBA FAQ quotes the FTC’s 2000 position that it “disagrees with those commenters who suggested that colleges and universities are not financial institutions.”
Your institution has also agreed to it in writing. Per FSA’s GENERAL-23-09 electronic announcement, every Title IV institution agrees in its Program Participation Agreement to comply with the Safeguards Rule, and the SAIG Enrollment Agreement commits it to protect all FSA applicant information from unauthorized access or disclosure.
Only the security half of GLBA creates much campus work. A Title IV institution that complies with FERPA is deemed to comply with the GLBA privacy rule (Regulation P), as the Thompson Coburn FAQ notes. There is no such shortcut for security. FSA defines “customer information” as information obtained by providing a financial service to a current or former student: administering Title IV aid, making institutional loans or income share agreements, or certifying or servicing private education loans. Aid, bursar and student-account data is in scope wherever it lives, including the ERP, the student information system (SIS), imaging systems, shared drives and vendor platforms.
What are the GLBA Safeguards Rule requirements for colleges and universities?
The FTC’s amended rule at 16 CFR 314.4 sets nine elements. FSA confirmed in GENERAL-23-09 that institutions maintaining student information on 5,000 or more consumers must address all nine, and smaller ones the first seven. Most universities clear 5,000 easily.
| Element (16 CFR 314.4) | What the rule requires | What it means on a campus | Evidence an auditor or FSA expects |
|---|---|---|---|
| 1. Qualified Individual (a) | One person who oversees, implements and enforces the program. Can be a service provider, but the institution keeps responsibility and names a senior overseer. | Usually the CISO, with authority that reaches financial aid, the bursar and distributed IT. | Designation letter, org chart, and the ability to hand over the full written program. |
| 2. Written risk assessment (b) | Written criteria for rating risks, judging confidentiality, integrity and availability, and mitigating or accepting each risk. Repeated periodically. | Covers the SIS, ERP, imaging, FSA system access, servicers and third-party aid tools. | Dated assessment, scoring method, risk register and risk acceptances. |
| 3. Safeguards (c)(1) to (8) | Access controls, data and asset inventory, encryption in transit and at rest, secure development, MFA, secure disposal, change management, and user-activity logging. | The control set itself, reaching departmental systems as well as central IT. | Access reviews, inventory, encryption settings, MFA report, retention schedule, change tickets, log retention. |
| 4. Testing and monitoring (d) | Continuous monitoring, or an annual penetration test plus vulnerability assessments at least every six months and after material changes. | Scope tests from the risk assessment; scan systems that hold or move aid data. | Pen test reports, dated scan results, remediation tickets. |
| 5. Personnel and training (e) | Security awareness training, qualified security staff, and ongoing training for those staff. | Aid and bursar staff trained on phishing and identity-verification fraud. | Completion records and training content. |
| 6. Service provider oversight (f) | Select capable providers, require safeguards by contract, and reassess them based on risk. | Aid and loan servicers, payment processors, SaaS tools, cloud hosts. | Vendor inventory, security questionnaires or SOC 2 reports, contract clauses, review dates. |
| 7. Evaluate and adjust (g) | Update the program after testing, material changes and new risk assessments. | New aid platforms and reorganizations trigger a review. | Revision history and minutes. |
| 8. Incident response plan (h) | A written plan covering goals, processes, roles and decision authority, communications, remediation, documentation and post-incident review. | Must include FTC and FSA notification steps, not only state laws. | The plan, tabletop records, incident logs. |
| 9. Report to the board (i) | A written report from the Qualified Individual, at least annually, on program status and material matters. | The board of trustees or regents, or its audit committee. | Dated report and board or committee minutes. |
Where do university programs usually fall short?
Three safeguards cause most of the friction on decentralized campuses. MFA is required “for any individual accessing any information system” unless the Qualified Individual approves an equivalent control in writing, so service accounts and departmental apps need documented exceptions. Disposal must happen within two years of last use unless retention is justified, which rarely matches how imaging systems and shared drives work. Data inventory breaks down when aid data spreads into spreadsheets and shadow systems that central IT cannot see.
What does the FTC breach notification rule require?
Per the FTC’s October 2023 amendment, effective May 13, 2024, when unencrypted customer information on at least 500 consumers is acquired without authorization, you must notify the FTC electronically “as soon as possible, and no later than 30 days after discovery.” The notice includes your contact details, the types of information involved, the date range if known, the number of consumers affected, a description of the event, and whether law enforcement requested a delay. Universities face two other obligations at the same time:
| Who you notify | Trigger | Deadline | How |
|---|---|---|---|
| Federal Student Aid | Any breach involving student aid information | Within 24 hours of the incident being known (GENERAL-24-46) | Cybersecurity Breach Intake form on FSA’s cybersecurity page |
| Federal Trade Commission | Unencrypted customer information on 500+ consumers acquired without authorization | As soon as possible, no later than 30 days after discovery | FTC online form |
| Individuals and state regulators | Varies by state breach law | Varies by state | Per each state statute |
Build all three into the incident response plan. The 24-hour FSA clock is the one that catches teams off guard. Rehearse it with a financial aid scenario from these incident response tabletop exercises.
How does the Department of Education enforce GLBA?
Through the annual audit every Title IV institution already undergoes, which for public and nonprofit institutions is usually the Single Audit. In the 2025 Compliance Supplement, GLBA appears as item 10, “Gramm-Leach-Bliley Act–Student Information Security,” under Special Tests and Provisions (III.N) in the Student Financial Assistance Cluster. The supplement applies to audits of fiscal years beginning after June 30, 2024, per Grant Thornton.
What do auditors test for GLBA?
The 2025 supplement sets two audit objectives: determine whether the institution designated a Qualified Individual, and whether the written information security program addresses the required minimum seven elements. The supplement adds ED’s expectation that the Qualified Individual “would be able to provide the written information security program” to auditors, so one indexed program document is the fastest route to a clean result. The procedures check that the program addresses each element, not whether controls operate. Treat that as a floor: FSA can request far more after a finding.
What happens after a GLBA finding?
Under GENERAL-23-09, the Department resolves GLBA findings in its determination of the institution’s administrative capability under 34 CFR 668.16(c), and they “will have the same effect on an institution’s participation in the Title IV programs as any other determination of non-compliance.”
- No breach: revise the program and submit a Corrective Action Plan (CAP) with timeframes.
- Repeated non-compliance: may lead to administrative action affecting Title IV participation.
- Substantial risk: FSA’s 2020 enforcement announcement says its Cybersecurity Team can temporarily or permanently disable access to Department systems, or refer the institution for a fine or other administrative action.
Before June 2023, findings were referred to the FTC and closed for the Department’s tracking. Since June 9, 2023, the Department resolves them itself.
What changed in 2025 and 2026?
- Draft 2026 Compliance Supplement: OMB released a draft on September 29, 2026, for planning audits of fiscal years ending after June 30, 2026, per Schneider Downs. Check the final GLBA text before fieldwork.
- Active confirmation by December 31, 2026: GENERAL-26-60 requires administrators to confirm every user’s access to SAIG mailboxes and FSA systems, or users are deactivated. FSA calls confirming access for someone who no longer needs it “a serious security violation.” Keep the records as GLBA access review evidence.
- The Department is not your vendor: GENERAL-24-46 clarified that ED and FSA are not service providers under 314.4(f), so you need not request security certifications from them.
How do GLBA, FERPA and NIST SP 800-171 overlap?
GLBA covers how you secure financial aid data. FERPA governs who may access education records and how they are disclosed (34 CFR Part 99). NIST SP 800-171 is the control set research universities already use for protected research data, including the attestation NIH requires for controlled-access data (NOT-OD-24-157). The three share most of their core controls, so the crosswalk below maps each control area to the GLBA paragraph, the FERPA angle and the matching 800-171 requirement family (Rev. 2 numbering).
| Control area | GLBA Safeguards Rule | FERPA angle | NIST SP 800-171 (Rev. 2) |
|---|---|---|---|
| Program ownership | Qualified Individual, 314.4(a); written program | Institution-wide records policy and annual notification of rights | System security plan, 3.12.4 |
| Risk assessment | Written risk assessment with criteria, 314.4(b) | Disclosure risk drives access decisions | Periodic risk assessment, 3.11.1 |
| Access control and reviews | Least-privilege access, periodically reviewed, 314.4(c)(1) | “Reasonable methods” limiting school officials to records with a legitimate educational interest, 99.31(a)(1)(ii) | Access control family, 3.1 (least privilege, 3.1.5) |
| Multi-factor authentication | MFA for anyone accessing an information system, 314.4(c)(5) | A “technological access control” FERPA recognizes | Multifactor authentication, 3.5.3 |
| Data inventory | Identify and manage data, devices and systems, 314.4(c)(2) | Know where education records live | Baseline configurations and inventories, 3.4.1 |
| Encryption | In transit over external networks and at rest, 314.4(c)(3) | A reasonable method against unauthorized disclosure | Cryptographic protection in transit and at rest, 3.13.8 and 3.13.16 |
| Secure development and change | Secure development, 314.4(c)(4); change management, 314.4(c)(7) | Changes must not widen record access | Configuration change control, 3.4.3 |
| Logging and monitoring | Log authorized-user activity, 314.4(c)(8) | Record of each request for and disclosure of records, 99.32 | Audit and accountability family, 3.3 (3.3.1) |
| Testing and vulnerabilities | Annual pen test and six-month scans absent continuous monitoring, 314.4(d) | None explicit | Vulnerability scanning, 3.11.2; control assessments, 3.12.1 |
| Training | Security awareness and staff training, 314.4(e) | Staff must understand disclosure rules | Awareness and training family, 3.2 |
| Vendor oversight | Select, contract and reassess, 314.4(f) | Outsourced “school official” under direct control and bound by redisclosure limits, 99.31(a)(1)(i)(B) | None explicit in Rev. 2; Rev. 3 adds supply chain risk management, 3.17 |
| Incident response and notice | Written IR plan, 314.4(h); FTC notice for 500+ consumers in 30 days, 314.4(j) | No breach-notice rule, but unauthorized disclosure is a FERPA issue | Incident response family, 3.6 |
| Retention and disposal | Dispose within two years of last use unless justified, 314.4(c)(6) | Destroy records when no longer needed or when a vendor contract ends | Media sanitization, 3.8.3 |
| Board reporting | Annual written report, 314.4(i) | None explicit | None explicit |
To use the crosswalk, write each control once in institution language, tag it to the GLBA paragraph, FERPA section and 800-171 requirement, and attach evidence to the control rather than the framework. One quarterly SIS access review then satisfies 314.4(c)(1), demonstrates FERPA “reasonable methods” and supports 3.1 for any research system in scope. The same pattern extends to HIPAA for the health center and PCI DSS for tuition payments, and to research security programs (see our research security deadlines guide).
We got a GLBA audit finding. What now?
- Read the finding precisely. Most say either that no Qualified Individual was designated or that the written program misses specific elements. Name them.
- Write a dated management response. Commit to specific deliverables in the corrective action plan, not “will review.”
- Expect FSA follow-up. Assign one owner to work with FSA’s Cybersecurity Team on the CAP and timeframes.
- Fix the documentation gap first, then the control gap. Auditors test the written program; FSA can ask for proof that controls operate.
- Brief the board. Use the 314.4(i) report to explain the finding and the plan.
- Prevent a repeat. Repeat findings raise the odds of administrative action, so run an internal pre-audit review three months before fieldwork.
What does a 90-day GLBA remediation plan look like?
| Window | Actions | Evidence produced |
|---|---|---|
| Days 1 to 30: Own and scope | Designate the Qualified Individual (and a senior overseer if outsourced). Inventory every system, office and vendor touching aid data. Map the program to the nine elements and list gaps. | Designation memo, data and system inventory, gap analysis, dated CAP |
| Days 31 to 60: Assess and control | Complete the written risk assessment. Close MFA gaps or document approved equivalents. Confirm encryption. Review access to the SIS, ERP and FSA systems alongside active confirmation. Collect current security questionnaire responses or SOC 2 reports from high-risk vendors. | Risk assessment and register, MFA report, encryption evidence, access review records, vendor files |
| Days 61 to 90: Prove and report | Add the FSA 24-hour and FTC 30-day notices to the IR plan and run a tabletop. Schedule the pen test and six-month scans. Train aid and bursar staff. Assemble the indexed written program. Deliver the board report. | IR plan and after-action report, test schedule, training records, written program, board report and minutes |
Track each gap with an owner, due date and residual risk rating in a risk register, which doubles as evidence for element 2.
How does Compyl help universities stay GLBA audit-ready?
Compyl works with research universities and academic medical centers that run GLBA alongside FERPA, HIPAA, PCI DSS v4.0.1 and NIST SP 800-171. As our higher education page describes, Compyl maps one control library across all of them, so evidence collected once, such as an MFA enforcement report pulled from your identity provider, counts toward GLBA 314.4(c), NIST 800-171, HIPAA and PCI DSS at the same time.
- One program across a decentralized campus. The registrar, financial aid, the health center and research labs share one control library. Department owners see only their own controls and tasks, and drift becomes a tracked task with a deadline.
- An audit-ready written program. Controls, policies and evidence stay linked to each Safeguards Rule element, so the Qualified Individual can hand auditors the program the Compliance Supplement asks for.
- Vendor risk for 314.4(f). Vendor risk management inventories and tiers every provider touching student data and keeps completed security questionnaires, SOC 2 reports and contract terms with each vendor record. For the wider market, see the best vendor risk management software.
- Access reviews. User access reviews produce the records GLBA, FERPA and FSA active confirmation rely on.
- Board reporting in dollars. FAIR-based risk quantification turns the annual 314.4(i) report into loss exposure trustees can act on.
- Built for institutional IT. A dedicated single-tenant environment per customer, with 125+ integrations included to feed evidence automatically.
Comparing platforms? See the best GRC platforms for higher education, or request a Compyl demo to see GLBA, FERPA and research security mapped in one library.
Frequently asked questions
What is GLBA compliance for higher education?
It means maintaining a written information security program that meets the FTC Safeguards Rule (16 CFR Part 314) for student financial aid and other customer information. Title IV institutions agree to it in their Program Participation Agreement and SAIG Enrollment Agreement. FERPA compliance is deemed GLBA privacy compliance, so the work centers on security.
What are the GLBA Safeguards Rule requirements for colleges and universities?
Nine elements: a Qualified Individual; a written risk assessment; safeguards including access controls, data inventory, encryption, secure development, MFA, disposal, change management and logging; regular testing; staff training; service provider oversight; ongoing program adjustment; a written incident response plan; and an annual written board report. Institutions with fewer than 5,000 consumers address the first seven.
How does the Department of Education enforce GLBA?
Through the annual Single Audit or compliance audit of the student aid programs. The Department resolves findings in its administrative capability determination and can require a corrective action plan, take administrative action for repeated non-compliance, or disable access to FSA systems when student data is at substantial risk.
What do auditors test for GLBA in the Single Audit?
The 2025 OMB Compliance Supplement directs auditors to verify that the institution designated a Qualified Individual and that its written information security program addresses the required minimum elements. FSA can request further documentation after a finding.
What happens if we get a GLBA audit finding on financial aid?
The finding appears in your audit report with a corrective action plan. FSA resolves it during its administrative capability review and expects dated timeframes. Repeated findings can lead to administrative action affecting Title IV participation.
Do universities have to report data breaches to the FTC under GLBA?
Yes. Since May 13, 2024, you must notify the FTC within 30 days of discovering unauthorized acquisition of unencrypted customer information involving at least 500 consumers. FSA separately expects breaches reported within 24 hours, and state breach laws still apply.
How do GLBA, FERPA and NIST SP 800-171 overlap?
GLBA sets security controls for financial aid data, FERPA governs access to and disclosure of education records, and NIST SP 800-171 is the control set universities use for protected research data, including NIH controlled-access data. They share access control, MFA, encryption, logging, training, incident response and disposal, so one mapped control library avoids duplicate work.
Is NIST SP 800-171 required for GLBA compliance?
No. FSA has encouraged institutions to fold NIST SP 800-171 controls into their GLBA program, but GENERAL-23-09 states that GLBA compliance is not the same as 800-171 compliance. The binding requirement is the Safeguards Rule.
Who should be the Qualified Individual at a university?
Usually the CISO or senior information security leader, because the role needs authority across financial aid, the bursar and departmental IT. A service provider can fill it, but the institution keeps responsibility and must name a senior staff member to oversee that provider.
