Skip to main content

Gramm‑Leach‑Bliley Act (GLBA) Information Security Program and Safeguards Policy

Policy Number:
ISO-1700
Effective Date:
October 13, 2026
Last Revised Date:
October 13, 2026
Applies To:
Classified Staff, Appointed Personnel, University Staff, Students
Responsible Unit(s):
Information Security Office
Responsible Unit Email(s):
security@arizona.edu
Status:
Active

Purpose and Summary

This Policy establishes the University of Arizona’s (University) program to safeguard “customer information” under the Gramm-Leach-Bliley-Act (GLBA) and the Federal Trade Commission’s Safeguards Rule (16 C.F.R. Part 314). The Policy defines governance, roles, and minimum requirements for administrative, technical, and physical safeguards appropriate to the University’s size and complexity, the nature and scope of its activities, and the sensitivity of the customer information maintained in connection with Title IV Federal Student Aid Programs and other covered financial services.

Scope

This Policy applies to all University Information Resources and all University-Related Persons who access, process, transmit, store, or otherwise handle GLBA “customer information,” including units involved in admissions, financial aid, bursar/student accounts, finance, auxiliary services, and any other offices that provide or support financial products or services. This Policy supplements, and must be read together with, the University’s Information Security Program Policy and other ISO policies.

Definitions

Customer Information means any record, whether in paper, electronic, or other form, that contains “nonpublic personal information” as defined in 16 C.F.R. § 314.2(l)—that is, information about an individual obtained in connection with providing a financial product or service that is not publicly available.

Information Owner means the individual(s) or Unit with operational authority for specified University Information and responsibility for establishing the controls for its generation, collection, processing, dissemination, and disposal. Such individual(s) or Unit is responsible for making risk tolerance decisions related to University Information on behalf of the University and is responsible for any loss associated with a realized information security risk scenario.

Information Resource Owner means a collective term used to refer to Information Owners and Information System Owners.​

Information Resources means University Information and related resources, such as equipment, devices, software, and other information technology.

Information System means a major application or general support system for storing, processing, or transmitting University Information. An Information System may contain multiple subsystems. Subsystems typically fall under the same management authority as the parent Information System. Additionally, an Information System and its constituent subsystems generally have the same function or mission objective, essentially the same operating characteristics, the same security needs, and reside in the same general operating environment.

Information System Owner means the individual(s) or Unit responsible for the overall procurement, development, integration, modification, and operation and maintenance of an Information System. This individual or Unit is responsible for making risk tolerance decisions related to such Information Systems on behalf of the University and is organizationally responsible for the loss, limited by the bounds of the Information System, associated with a realized information security risk scenario.

Qualified Individual means the University employee designated to oversee, implement, and enforce the information security program as required by the Gramm‑Leach‑Bliley Act and the Federal Trade Commission’s Safeguards Rule, specifically 16 C.F.R. § 314.4(a).

Unit means any University college, school, department, program, or other operating unit. 

University Information means any communication or representation of knowledge, such as facts, data, or opinions, recorded in any medium or form, including textual, numerical, graphic, cartographic, narrative, or audiovisual, owned or controlled by or on behalf of the University.

University-Related Persons means any University students and applicants for admission, University employees and applicants for employment, Designated Campus Colleagues (DCCs), alumni, retirees, temporary employees of agencies who are assigned to work for the University, and third-party contractors engaged by the University and their agents and employees.

Policy

  1. Governance and Qualified Individual
    1. Designation. The University designates the Chief Information Security Officer as the Qualified Individual responsible for overseeing, implementing, and enforcing the GLBA information security program.
    2. Authority. The Qualified Individual is authorized to establish procedures, assign responsibilities, coordinate with Units, and take actions necessary to manage GLBA risks and ensure compliance with this Policy and the Federal Trade Commission’s Safeguards Rule.
    3. Board/Senior Oversight. The Qualified Individual must provide a written report at least annually on the overall status of the GLBA information security program to the University’s governing body; for the University, this report is delivered as the University-wide Security Plan to the Arizona Board of Regents (ABOR). The report must address:
      1. program status and compliance; and
      2. material matters related to risk assessment, risk management decisions, service provider oversight, results of testing, significant security events or violations and management response, and recommendations for program changes.
  2. Risk Assessment
    1. Primary Mechanism for GLBA Compliance. The University satisfies GLBA risk‑assessment requirements by complying with the Information Security Risk Management and Security Planning Policy (ISO‑200), which establishes the University‑wide framework for identifying, assessing, and managing information security risks.
      1. All GLBA‑applicable Information Resource Owners must follow ISO‑200 in full, including its requirements for risk assessments, security planning, and risk mitigation processes.
    2. Coordination with the Qualified Individual. The Information Security Office, under the direction of the Qualified Individual, is authorized to coordinate additional GLBA‑specific risk assessments which extend ISO‑200 processes.
      1. Units must provide all requested documentation, evidence, and remediation updates necessary for the Qualified Individual to evaluate GLBA risk posture and report program status to leadership.
  3. Training and Personnel Qualifications 
    1. Security Awareness Training. University-Related Persons with access to Customer Information must complete security awareness training under the University’s Information Security Awareness Training Policy (ISO-500).
    2. Role-based Training. The Information Security Office is authorized to assign additional GLBA-specific training to University-Related Persons with access to Customer Information.
    3. Qualified Security Personnel. All Information Security Office personnel must maintain a current security certification or complete at least 20 hours of continuing professional education annually in the security domain.
  4. Incident Response and Reporting
    1. Primary Mechanism for GLBA Compliance. The University satisfies GLBA incident‑response and security‑event reporting requirements by complying with the Information Security Incident Reporting and Response Policy (ISO‑600), which establishes the University‑wide framework for identifying, reporting, responding to, containing, and remediating information security incidents. 
      1. All GLBA‑applicable Information Resource Owners must follow ISO‑600 in full, including all requirements for timely reporting, evidence preservation, collaboration with the ISO, and participation in post‑incident review processes.
    2. FTC Breach Reporting. Where required by the Federal Trade Commission (FTC), the Qualified Individual will notify the FTC of any GLBA “notification event” involving unencrypted Customer Information of 500 or more consumers within the timelines and in the manner required by regulation.
  5. Program Evaluation and Adjustment
    1. Primary Mechanism for GLBA Compliance. The University fulfills GLBA requirements for periodic evaluation and adjustment of the information security program by complying with the ongoing review processes established under the University’s Information Security Program Policy (ISO-100) and related ISO policies.
      1. Annual evaluation and adjustment activities are incorporated directly into the University-wide security plan report, which serves as the formal mechanism for assessing the effectiveness of safeguards, identifying material changes, and recommending updates to maintain compliance with the GLBA the Federal Trade Commission’s Safeguards Rule.
    2. Continuous Improvement. Beyond the annual cycle, the Qualified Individual may direct additional adjustments at any time when significant technological, organizational, operational, or threat-related changes arise.
      1. All GLBA‑applicable Information Resource Owners must implement recommended changes promptly to ensure the University’s GLBA safeguards remain appropriate to its size, complexity, and the sensitivity of Customer Information.
  6. Tracking, Measuring, and Reporting
    1. The Information Security Office must develop, test, review, maintain, and communicate the University’s- information security practices to University leadership. 
    2. The Information Security Office is authorized to track compliance of this Policy and to produce reports of compliance measures to support University decision making.
  7. Recourse for Noncompliance 
    1. The Information Security Office is authorized to limit network access for individuals or Units not in compliance with all information security policies and related procedures. 
    2. In cases where University resources are actively threatened, the Chief Information Security Officer must act in the best interest of the University by securing the resources in a manner consistent with the Information Security Incident Response Plan. 
      1. In an urgent situation requiring immediate action, the Chief Information Security Officer is authorized to disconnect affected individuals or Units from the network. 
    3. In cases where University-Related Persons violate this Policy, the University may apply appropriate employee sanctions or administrative actions, in accordance with relevant administrative, academic, and employment policies. 
  8. Exceptions
    1. Any requests for exceptions to any information security policies must be submitted to the Chief Information Security Officer for review and approval pursuant to the Information Security Office Policy Exception Request Procedure. 
  9. Frequency of Policy Review 
    1. The Chief Information Security Officer must review information security policies and procedures at least annually. This Policy may be revised based on these reviews.

 

Policy Feedback

For questions or comments regarding a particular policy or to notify us of broken links or typographical errors, please provide this information below.

To report violations of a policy, please notify the Responsible Unit.

Please Note: Policy feedback is available to the Policy Office, Policy Sponsor, and elected shared governance representatives, upon request, for policies impacting the populations they represent.

This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.