Universities increasingly function as "financial institutions" under the Gramm-Leach-Bliley Act (GLBA), requiring demonstrable protection of nonpublic personal information and clear accountability for information security programs. The Federal Trade Commission's (FTC) amended Safeguards Rule now specifies key expectations, including designating a Qualified Individual, risk assessments tied to controls, continuous monitoring or routine testing, vendor oversight, multifactor authentication and encryption, board reporting, and incident reporting to the FTC for certain breaches. This all raises the bar on how higher education implements and evidences compliance.
This full-day, hands-on workshop will focus on all three pillars of GLBA?Safeguards, Privacy, and Pretexting?bringing together cybersecurity and privacy professionals to collaborate on practical solutions that strengthen compliance and protect institutional data. Attendees will use worksheets and templates to inventory what already exists, identify essential stakeholders, and map responsibilities. We will compare risk assessment methodologies and demonstrate how to leverage existing practices (e.g., FERPA processes, audit cycles, HECVAT/vendor reviews) without duplicating efforts. We will practice communication strategies to gain allies, secure leadership support, and prepare board-level updates. Participants will leave with a starter roadmap, prioritized action items, and artifacts they can immediately use on campus.
Interactive roundtables will surface what peers are doing, common pitfalls, and practical ways to demonstrate institutional value?protecting students, enabling operations, and meeting Title IV expectations.
By the end of this workshop, participants will be able to:
