Information Security Program & Compliance Reference

4.1
Assessing Security Risks

Identify, quantify, and prioritize risks against criteria for risk acceptance relevant to the organization
• Performed Periodically
• Systematic Approach estimating risks
• Clearly defined scope

PCI is an audit standard and risks are quantified and
prioritized within it

Maintain an Information Security Policy

12.2 - Implement a risk-assessment process that:
• Is performed at least annually and upon
significant changes to the environment
(for example, acquisition, merger,
relocation, etc.),
• Identifies critical assets, threats, and
vulnerabilities, and
• Results in a formal, documented analysis
of risk

Internal Audit/Risk Assessment
(incl NIST Framework for Improving Critical Infrastructure Cybersecurity)
LETU evaluates internal CyberSecurity measures
against NIST Framework v1.1 as part of Information Security Internal Audit and Risk Assement (Secure Document: available internally)

Trustwave PCI Rapid Comply/Clover Security
PCI compliance scanner: cloversecurity.com

Server Vulnerability Scans
All servers scanned continuously using Tenable.io vulnerability scanning tool.

External facing IPs and servers scanned weekly by National Cybersecurity Assessment and Technical Services (NCATS)

Penetration Testing
Twice-annual penetration testing consists of both internal and external penetration tests and comprehensive reports by a qualified third party provider.

EDR
Microsoft Defender and Azure Security center continuously scan for vulnerability on University Servers and Workstations.

DLP Compliance

DLP Compliance polices (currently active on all LETU O365-enabled accounts) alert on shared content for users which could compromise compliance with PCI,
GLBA or other Privacy or Financial regulations.
This includes email for users converted to LETU's O365 email platform.

Network Compliance
LETU Network Mgmt System is configured to trigger alerts and guidance on detected issues or vulnerabilities affecting compliance with best practices or regulatory issues within LETU's network architecture. These alerts trigger configuration team reviews and modifications as needed.
 

Title IV: Department of Education Requirements

4.2
Treating Security Risks

Before treating, organization must ascertain
ability and level of risk acceptable to an
organization
• Knowing and objectively accepting risk
in accordance with organization risk
tolerance
• Avoiding risk by not engaging in
activities that introduce risk
• Transferring risks to other parties

Protect Cardholder Data

3.4 - Render PAN (Primary Account Number),
at a minimum, unreadable anywhere
it is stored (including on portable digital media,
backup media, in logs)
6 - Develop and maintain secure systems and
applications

Security Safeguards Program: Title IV Data

EDR
Microsoft Defender and Azure Security center continuously remediate identified risks and vulnerabilities on University Servers, Workstations.​​​​​​, and authenticaiton systems​

All data at rest stored using one-way strong
encryption hashes

Cardholder Data

PAN information is not stored on LETU systems. All external vendors required to comply with PCI DSS standards.

LETU Maintains PCI Compliant status.

MFA
Mandatory multi-factor authentication for all LETU employees eliminates threat of single-factor password compromises.

5.1
Information Security Policy

Information security policies should be
sponsored/approved by management,
published to all employees and relevant
external parties
Include within:
• Definition of information security,
objectives, scope, and importance
• Statement of management intent,
supporting goals and principles
• Framework for setting control
objectives and controls

Maintain an Information Security Policy

12.4 - Ensure that the security policy and procedures
clearly define information security responsibilities for
all employees and contractors

12.5.1 - Establish, document, and distribute security
policies and procedures

II.A. Information
Security Program
II.B. Objectives
III.A. Invoice Board
of Directors

FSA GENERAL-23-09 (e)

Security

f. Information Security policy

LETU Policies 6.1-12
LETU Policies 6.1-12 cover Information Security, Acceptable use and other critical procedures for the security of institution and customer data.

LETU Information Security Compliance Reference

LETU Information Security Compliance Reference reviewed by Information Security office annually and employees reminded annually of LETU security policies and procedures through annual required cybersecurity training (LETU Policy 6.12).

Title IV: Department of Education Requirements

6.1
Internal Organization 

A management framework should be
established to initiate and control the
implementation of information security
within the organization

Maintain an Information Security Policy

12.4 - Ensure that the security policy and procedures
clearly define information security responsibilities for
all employees and contractors.

12.5.1 - Establish, document, and distribute security
policies and procedures

II. A. Information
Security Program
II.B. Objectives
III. A. Involve the
Board of Directors
III.C. Manage and
Control Risk
III.F. Report to the
Board

3.1.4 Separate the duties of individuals
to reduce the risk of malevolent activity
without collusion

3.6 Incident Response

3.14 System and Information Integrity

LETU Information Security Compliance Reference

LETU Information Security Compliance Reference reviewed by Information Security office annually and employees reminded annually of LETU security policies and procedures through annual required cybersecurity training (LETU Policy 6.12).

Security Awareness Program: Cardholder Data

Title IV: Department of Education Requirements

6.2
External Parties 

To maintain the security of information and
information processing facilities that are
accessed, processed, communicated to, or
managed by external parties

Maintain an Information Security Policy

12.8.2 - Maintain a written agreement that includes an
acknowledgement that the service providers are
responsible for the security of cardholder data the
service providers posess

III.C. Manage and
Control Risk
III.D. Oversee
Service Provider
Arrangements

FSA GENERAL-23-09 (f)

3.1.1 Limit information system access
to authorized users, processes acting
on behalf of authorized users, or
devices (including other information
systems)

3.1.2 Limit information system access to
the types of transactions and functions
that authorized users are permitted to
execute

7.1
Responsibility for Assets

All assets should be accounted for and have
a nominated owner 

Maintain an Information Security Policy

12.3.4 Labeling of devices with owner, contact
information, and purpose

3.1.21 Limit use of organizational portable
storage devices on external information
systems

3.4.1 Establish and maintain baseline
configurations and inventories of
organizational information systems
throughout their life cycle

3.4.2 Establish and enforce security
configuration settings for information
technology products employed in
organizational information systems

3.9 Personnel Security

Card Devices
Physical labeling and annual inspection of card devices for payment card industry cards.

Network Equip

All LETU network equipment physically tagged and inventoried for tracking purposes.

System Center Configuration Manager
Used to tattoo funding agent responsible for asset
and to inventory asset information to central database

7.2
Information Classification

Information should be classified to indicate
the need, priorities and expected degree of
protection
• Define an information classification
scheme

Implement Strong Access Control Measures

7.1 - Limit access to system components and cardholder
data to only those individuals whose job requires
such access.
7.2 - Establish an access control system for system
components with multiple users that restricts access
based on a user’s need to know and is set to "deny
all" unless specifically allowed.

3.8 Media Protection

3.13.1 Monitor, control, and protect
organizational communications at the
external boundaries and key internal
boundaries of the information systems

Data Classification Standard
  LETU Policy 6.2: Data Classification

Datacenter Security Measures
All LETU Datacenters containing protected information are secured by
proximity-based card access control systems with highly restrictive
access configurations as well as video security coverage with archival
review capabilities. Access to all LETU Datacenters is extremely limited.
More information is available in the
LETU Datacenter Security Guidelines document.

Network ACLs
Network Access Control lists (ACLs) are used to restrict access to systems based
on IP, port or other network characteristic and is used to restrict access to
locations from which access is expected to originate.

Security Groups
Security Groups are used to restrict access to specific content on a per-user
basis as authorized by the primary owner of the data or content.

8.1
Prior to Employment 

To ensure that employees, contractors and
third party users understand responsibilities,
and are suitable for their roles; reduce the
risk of theft, fraud, and or misuse of facilities/
resources

Maintain an Information Security Policy

12.7 - Screen potential employees prior to hire to
minimize the risk of attacks from internal sources.

III.C. Manage and
Control Risk

FSA GENERAL-23-09 (e)

3.9.1 Screen individuals prior to authorizing
access to information systems containing CUI

Human Resources

Background checks are performed on all new-hires

LETU Information Security Training

Initial required cybersecurity training for new employees and recurring training for existing employees required per LETU Policy 6.12: Cybersecurity Training.

8.2
During Employment

To ensure that employees, contractors and
third party users are aware of information
security threats and concerns, their
responsibilities and liabilities, and are
equipped to support security policy in the
course of their normal work

Maintain an Information Security Policy

12.6 - Implement a formal security awareness program
to make all employees aware of the importance of
cardholder data security.

III.C. Manage and
Control Risk

3.2 Awareness and Training

3.6 Incident Response

Systems Development and Change Management

c. Policies regarding system development, program change

Security

i. Procedures for issuing and suspending user access

New-Hire training
IT orientation with all new employees to brief them on cybersecurity best practices

LETU Information Security Training

Initial required cybersecurity training for new employees and recurring training for existing employees required per LETU Policy 6.12: Cybersecurity Training.

DLP Compliance

DLP Compliance polices (currently active on all LETU O365-enabled accounts)
alert on shared content for users which could compromise compliance with PCI,
GLBA or other Privacy or Financial regulations.
This includes email for users converted to LETU's O365 email platform.

Self-Phishing Campaigns

Quarterly self-phishing conducted with email training
sent to all employees

Annual PCI training
Yearly PCI training emailed to employees directly involved
in credit card processing 

Program Change
IT Directors review training needs during annual performance reviews. Employees offered training as new software is made available

Annual Re-Authorization
Each year access rights are periodically reviewed by every supervisor and must be reauthorized to maintain those rights for the upcoming year

8.3
Termination or Change of Employment

To ensure that employees, contractors and
third party users exit an organization or
change employment in an orderly manner

Implement Strong Access Control Measures

9.3 - Immediately revoke access for any terminated
users

Maintain an Information Security Policy

12. Maintain a policy that addresses information
security for employees and contractors

3.9.2 Ensure that CUI and information systems
containing CUI are protected during and after
personnel actions such as terminations
and transfers

Security

i. Procedures for suspending and closing user accounts

Account Automation
In-house programmatic account access control used to
disable accounts keyed off an employee's separation date
in an HR database 

Separation Process
Human Resource notifications to IT trigger a specific review
of each separation, tracked using our WIT request system
for additional specific review of the security and other IT
needs related to each separation.

9.1
Secure Areas

To prevent unauthorized physical
access, damage, and interference to the
organization’s premises and information
• Critical or sensitive information
processing facilities should be housed
in secure areas
• Protection provided should be
commensurate with the identified risks

Implement Strong Access Control Measures

9. Restrict physical access to cardholder data

III.C. Manage and
Control Risk

3.10 Physical Protection

Security

j. Physically restrict access to key components

9.2
Equipment Security

To prevent loss, damage, theft or
compromise of assets and interruption to
the organization’s activities 

Implement Strong Access Control Measures

9.1.3 - Restrict physical access to wireless access points,
gateways, and handheld devices

III.C. Manage and
Control Risk

3.7 Maintenance

3.8 Media Protection

3.10.6 Enforce safeguarding measures for
CUI at alternate work sites (e.g., telework sites)

Locked AP cabinets
Wireless Access Points located in locked enclosures

Unauthorized WAP detection
Detection and Identification of
Unauthorized Wireless Access Points (WAPs) 

Datacloset Security Measures

All LETU Dataclosets are secured with a non-general-
master keyset and most are additionally secured by
proximity-based electronic locking systems.

Datacenter Security Measures

All LETU Datacenters containing protected information are secured by
proximity-based card access control systems with highly restrictive
access configurations as well as video security coverage with archival
review capabilities. Access to all LETU Datacenters is extremely limited.
More information is available in the
LETU Datacenter Security Guidelines document.

10.1
Operational Procedures & Responsibilities

Responsibilities and procedures for
the management and operation of all
information processing facilities should be
established
• Segregation of duties should be
implemented

6.4.1 - Separate development/test and production
environments

III.C. Manage and
Control Risk

3.4.3 Track, review, approve/disapprove,
and audit changes to information systems

3.4.5 Define, document, approve, and enforce
physical and logical access restrictions associated
with changes to the information system

LETU Production/Test Architecture
LETU maintains specific testing environments separate from the production environment
as necessary for the secure evaluation of development or updated code/configs on both
LETU virtual server hosting systems and network architecture.

Access lists and secured credentials limit access to both production and testing environment resources to authorized users.

Title IV: Department of Education Requirements

10.2
Third-Party Service Delivery Management

Validate the implementation of agreements,
monitor compliance, and manage changes
to ensure that all services delivered meet
requirements set out in agreements

Maintain an Information Security Policy

12.8.2 Maintain a written agreement that includes
acknowledgement that the service providers are
responsible for the security of cardholder data the
service providers posses.

Service Provider
Arrangements

10.3
System Planning and Acceptance

To minimize the risk of systems failures
• Advanced planning and preparation
are required to ensure availability and
adequate capacity of resources
• Operational requirements of new
systems should be established,
documented, and tested

Maintain a Vulnerability Management Program

6. Develop and maintain secure systems and
applications

Regularly Monitor and Test Networks

11. Regularly test security systems and processes

III.C. Manage and
Control Risk

Server Vulnerability Scans
All servers scanned continuously using Tenable.io vulnerability scanning tool.

External facing IPs and servers scanned weekly by National Cybersecurity Assessment and Technical Services (NCATS)

Penetration Testing
Twice-annual penetration testing consists of both internal and external penetration tests and comprehensive reports by a qualified third party provider.

Trustwave PCI Rapid Comply

PCI compliance scanner: pcirapidcomply2.com
used monthly.

DLP Compliance

DLP Compliance polices (currently active on all LETU O365-enabled accounts)
alert on shared content for users which could compromise compliance with PCI,
GLBA or other Privacy or Financial regulations.
This includes email for users converted to LETU's O365 email platform.

Network Compliance
LETU Network Mgmt System is configured to trigger alerts and guidance
on detected issues or vulnerabilities affecting compliance with best practices
or regulatory issues within LETU's network architecture.
These alerts trigger configuration team reviews and modifications as needed.

Data Loss Prevention Guidelines

10.4
Protection Against Malicious & Mobile Code

Precautions are required to prevent and

Maintain a Vulnerability Management Program

5. Use and regularly update anti-virus software
6. Develop and maintain secure systems and
applications

III.C. Manage and
Control Risk

3.2 Awareness and Training

3.14.2 Provide protection from malicious code at appropriate
locations within organizational information systems

3.14.3 Monitor information system security alerts and
advisories and take appropriate actions in response

3.14.4 Update malicious code protection mechanisms
when new releases are available

3.14.5 Perform periodic scans of the information system
and real-time scans of files from external sources as files
are downloaded, opened, or executed

Windows Defender / Azure Security Center EDR

Protects in realtime against malicious code for managed endpoints

10.5
Back-up

To maintain the integrity and availability
of information and information processing
facilities 

Implement Strong Access Control Measures

9. Restrict physical access to cardholder data

Regularly Monitor and Test Networks

10. Track and monitor all access to network resources
and cardholder data

Maintain an Information Security Policy

12. Maintain a policy that addresses information
security for employees and contractors

III.C. Manage and
Control Risk

3.8.9 Protect the confidentiality of
backup CUI at storage locations

Operations

h. Recorded data remains complete and accurate

Veeam

Disaster recovery for all managed virtual servers 

Backup Exec
Disaster recovery for additional agent-managed servers 

\\letnet.net\fs\backup Backups

Disaster recovery for non-agent, *nix-based and other systems

Off-site

Regularly rotated Off-site vault storage of backup media

10.6
Network Security Management

To ensure the protection of information
in networks and the protection of the
supporting infrastructure 

Build and Maintain a Secure Network

1. Install and maintain a firewall
2. Do not use vendor-supplied defaults for system
passwords and other security parameters

Maintain a Vulnerability Management Program

5. Use and regularly update anti-virus software
6. Develop and maintain secure systems and
applications

III.C. Manage and
Control Risk

3.1.2 Monitor and control remote
access sessions

3.1.13 Employ cryptographic mechanisms
to protect the confidentiality of remote
access sessions

3.1.14 Route remote access via
managed access control points

3.1.16 Authorize wireless access prior
to allowing such connections

3.1.17 Protect wireless access using
authentication and encryption

3.7.5 Require multifactor authentication to
establish nonlocal maintenance sessions via
external network connections and terminate
such connections when nonlocal maintenance
is complete

3.13 System and Communications Protection

Security

h. Network security restricts access to financial systems

Gateway Security
LETU networks are secured with access control lists (ACLs) ACLs that greatly restrict access to all LETU

MFA
Mandatory multi-factor authentication for all LETU employees eliminates threat of single-factor password compromises.

System Center Configuration Manager
Inventory and manage technology assets throughout lifecycle to ensure security

Windows Intune
Inventory and technology asset management

Windows Defender / Azure Security Center (EDR)
Protects against malicious code for managed endpoints

10.7
Media Handling

To prevent unauthorized disclosure,
modification, removal or destruction of
assets, and interruption to business activities
• Media should be controlled and
physically protected
• Appropriate operating procedures
should be established to protect,
documents, and computer media 

Protect Cardholder Data

3. Protect stored data
4. Encrypt transmissions of cardholder data and
sensitive information across public networks

Implement Strong Access Control Measures

7. Restrict access to data by business need-to-know
9. Restrict physical access to cardholder data

Regularly Monitor and Test Networks

11. Regularly test security systems and processes

Maintain an Information Security Policy

12. Maintain a policy that addresses information
security for employees and contractors

III.C. Manage and
Control Risk

Protect Stored Cardholder Data

Encrypt transmission of cardholder data
across open, public networks

Mobile Device Encryption
All mobile devices have encrypted hard drives per
LETU policy "Mobile Device Encryption." 

10.8
Exchange of Information

To maintain the security of information and
software exchanged within an organization
and with any external entity

Build and Maintain a Secure Network

1. Install and maintain a firewall
Protect Cardholder Data:
4. Encrypt transmissions of cardholder data and
sensitive information across public networks

Implement Strong Access Control Measures

7. Restrict access to data by business need-to-know

Implement Strong Access Control Measures

8. Assign a unique ID to each person with computer
access

Maintain an Information Security Policy

12. Maintain a policy that addresses information
security for employees and contractors

III.C. Manage and
Control Risk

3.1.15 Authorize remote execution of
privileged commands and remote access
to security-relevant information

3.1.16 Authorize wireless access prior
to allowing such connections

3.1.17 Protect wireless access using
authentication and encryption

3.13 System and Communications Protection

Unique IDs
Each user has a unique SIS ID and username

Role-Based Access
Each employee given access and appropriate permissions
only to systems to which they need those specific rights

Customer request system allows supervisors to request permissions their employees need.

Data Loss Prevention (DLP)

10.9
Electronic Commerce Services

To ensure the security of electronic
commerce services, and their secure use

Build and Maintain a Secure Network

1. Install and maintain a firewall configuration to
protect data
2. Do not use vendor-supplied defaults for system
passwords and other security parameters

Protect Cardholder Data

4. Encrypt transmissions of cardholder data and
sensitive information across public networks

Maintain a Vulnerability Management Program

6. Develop and maintain secure systems and
applications

Control Risk

Operations

l. Ensure third-party services are secure

Trustwave PCI Rapid Comply
PCI compliance scanner: pcirapidcomply2.com
used monthly.

Qualys SSL Labs
Server security scanner: https://www.ssllabs.com/ssltest
used annually

Encrypt transmission of cardholder data across open, public networks

Vendor Guidelines
Established guidelines in place when selecting on-premise or cloud-hosted vendor applications. Contracts for these vendors are reviewed by CIO and CFO with questions specific to risks, security controls, and other guideline-based information. This policy is contained in the Acceptable Use for Technology Systems.

Acceptable Use for Technology Systems (LETU Policy 6.1)

Data Loss Prevention (DLP)

10.10
Monitoring

To detect unauthorized information
processing activities including review of
operator logs and fault logging
• Systems should be monitored and
information security events should be
recorded
• Organization should comply with all
relevant legal requirements applicable
to monitoring and logging
• System monitoring should be used
to check the effectiveness of controls
adopted and to verify conformity to
access policies

Implement Strong Access Control Measures

8.1.1 Assign a unique ID to each person with computer
access

Regularly Monitor and Test Networks

10. Track and monitor all access to network resources
and cardholder data

Control Risk

Operations

n. Procedures for job scheduling, processing, error monitoring, system availability

Unique IDs
Each user has a unique SIS ID and username

Role-Based Access
Each employee given access and appropriate permissions
only to systems to which they need those specific rights

Customer request system allows supervisors to request permissions their employees need.

Technical Monitoring
Many systems in place including central log aggregation, monitoring solutions, and custom scripts. Email/text alerts generated upon threshold for any monitor

11.1
Business Requirement for Access Control

Access to information, information
processing facilities, and business processes
should be controlled based upon business
and security requirements.
• Access controls should take account
policies for information dissemination
and authorization 

Implement Strong Access Control Measures

8.1.1 Assign a unique ID to each person with computer
access

Maintain an Information Security Policy

12. Maintain a policy that addresses information
security for employees and contractors

III.C. Manage and
Control Risk

Unique IDs
Each user has a unique SIS ID and username

Data Classification Standard
  LETU Policy 6.2: Data Classification

11.2
User Access Management

Formal procedures to control the allocation
of access rights to information systems and
services 

Implement Strong Access Control Measures

7. Restrict access to data by business need-to-know
8.1.1 Assign a unique ID to each person with computer
access

III.C. Manage and
Control Risk

3.1 Access Control

3.4.5 Define, document, approve, and enforce
physical and logical access restrictions associated
with changes to the information system

3.5 Identification and Authentication

Entity-Level Controls

b. Segregation of responsibilities to prevent subversion of critical processes

Unique IDs
Each user has a unique SIS ID and username

Role-Based Access
Each employee given access and appropriate permissions
only to systems to which they need those specific rights

Customer request system allows supervisors to request permissions their employees need.

Segregation of Responsibilities
Personnel are prohibited from engaging in user activities, initiating transactions, or changing master files. IT personnel prevented from having access to liquid assets such as check signing approval or credit approval.

eBridge Access

11.3
User Responsibilities

To prevent unauthorized user access, and
compromise or theft of information and
information processing capabilities 

Build and Maintain a Secure Network

2. Do not use vendor-supplied defaults for system
passwords

Implement Strong Access Control Measures

8.1.1 Assign a unique ID to each person with computer
access

Maintain an Information Security Policy

12. Maintain a policy that addresses information
security for employees and contractors

III.C. Manage and
Control Risk

Non-Default Credentials
Passwords for built-in accounts never left at default

Data Classification Standard
  LETU Policy 6.2: Data Classification

LetNet Guest Wireless Account Creation

Guest account policies direct use of specific individual account information for each guest.

11.4
Network Access Control

Ensure that appropriate interfaces and
authentication mechanisms to networked
services are in place 

Build and Maintain a Secure Network

2. Do not use vendor-supplied defaults for system
passwords

Implement Strong Access Control Measures

8.1.1 Assign a unique ID to each person with computer
access

IlI.C. Manage and
Control Risk

3.1.9 Provide privacy and security notices
consistent with applicable CUI rules

3.1.16 Authorize wireless access prior
to allowing such connections

3.1.20 Verify and control/limit connections to
and use of external information systems

Non-Default Credentials
Passwords for built-in accounts never left at default

Data Classification Standard
  LETU Policy 6.2: Data Classification

LetNet Guest Wireless Account Creation

Guest account policies direct use of specific individual account information for each guest.

11.5
Operating System Access Control 

To prevent unauthorized access to operating
systems
Some methods include: ensure quality
passwords, user authentication, and
the recording of successful and failed
system accesses, providing appropriate
authentication control means

Build and Maintain a Secure Network

2. Do not use vendor-supplied defaults for system
passwords

Implement Strong Access Control Measures
8.1.1 Assign a unique ID to each person with computer
access

Monitor and Test Networks

10. Track and monitor all access to network resources
and cardholder data

III.C. Manage and
Control Risk

3.1.8 Limit unsuccessful logon attempts

3.4.5 Define, document, approve, and enforce
physical and logical access restrictions associated
with changes to the information system

Security

g. Financial operating systems appropriately secured

Non-Default Credentials
Passwords for built-in accounts never left at default

Data Classification Standard
  LETU Policy 6.2: Data Classification

LETNET Domain Password Requirements

Non-reversible password hash encryption
Account lockout procedures in place in addition to requirements above
Audits for all successful and failed logon events 

• To prevent unauthorized access
to information held in application
systems
• Security facilities should be used to
restrict access to an within application
systems
• Logical access to application software
and information system functions

Build and Maintain a Secure Network

1. Do not use vendor-supplied defaults for system
passwords

Maintain a Vulnerability Management System
6. Develop and maintain secure systems and
applications

Implement Strong Access Control Measures

8.1.1 Assign a unique ID to each person with computer
access

III.C. Manage and
Control Risk

3.1.21 Limit use of organizational portable
storage devices on external information
systems

3.4.5 Define, document, approve, and enforce
physical and logical access restrictions associated
with changes to the information system

3.5 Identification and Authentication

Unique IDs
Each user has a unique SIS ID and username

Role-Based Access
Each employee given access and appropriate permissions
only to systems to which they need those specific rights

11.7
Mobile Computing and Teleworking

To ensure information security when using
mobile computing and teleworking facilities 

Build and Maintain a Secure Network

1. Install and maintain a firewall configuration to
protect data

Build and Maintain a Secure Network

2. Do not use vendor-supplied defaults for system
passwords and other security parameters

Implement Strong Access Control Measures

8. Assign a unique ID to each person with computer
access

III.C. Manage and
Control Risk

3.1.12 Monitor and control remote
access sessions

3.1.13 Employ cryptographic mechanisms
to protect the confidentiality of remote
access sessions

3.1.14 Route remote access via
managed access control points

3.1.15 Authorize remote execution of
privileged commands and remote access
to security-relevant information

3.1.18 Control connection of mobile devices

3.1.19 Encrypt CUI on mobile devices

3.10.6 Enforce safeguarding measures for
CUI at alternate work sites (e.g., telework sites)

Unique IDs
Each user has a unique SIS ID and username

Role-Based Access
Each employee given access and appropriate permissions
only to systems to which they need those specific rights

Firewall
OS-level firewalls enabled on each client along with hardware firewalls
at edge of LETU network

Mobile Device Encryption
All mobile PCs required to have full-disk encryption:
LETU Policy "Mobile Device Encryption"

12.1
Ensure that security is an integral
part of information systems

Security should be built into operating
systems, infrastructure, business
applications, off the shelf products, and user-
developed applications 

Maintain a Vulnerability Management Program

6. Develop and maintain secure systems and
applications

3.1.20 Verify and control/limit connections to
and use of external information systems

3.13 System and Communications Protection

Server Vulnerability Scans
All servers scanned continuously using Tenable.io vulnerability scanning tool.

External facing IPs and servers scanned weekly by National Cybersecurity Assessment and Technical Services (NCATS)

Penetration Testing
Twice-annual penetration testing consists of both internal and external penetration tests and comprehensive reports by a qualified third party provider.

Trustwave PCI Rapid Comply

PCI compliance scanner: pcirapidcomply2.com
used monthly.

DLP Compliance

DLP Compliance polices (currently active on all LETU O365-enabled accounts)
alert on shared content for users which could compromise compliance with PCI,
GLBA or other Privacy or Financial regulations.
This includes email for users converted to LETU's O365 email platform.

Network Compliance
LETU Network Mgmt System is configured to trigger alerts and guidance
on detected issues or vulnerabilities affecting compliance with best practices
or regulatory issues within LETU's network architecture.
These alerts trigger configuration team reviews and modifications as needed.

12.2
Correct Processing in Applications

To prevent errors, loss, unauthorized
modification or misuse of information in
applications 

Maintain a Vulnerability Management Program

6. Develop and maintain secure systems and
applications

III.C. Manage and
Control Risk

Server Vulnerability Scans
All servers scanned continuously using Tenable.io vulnerability scanning tool.

External facing IPs and servers scanned weekly by National Cybersecurity Assessment and Technical Services (NCATS)

Penetration Testing
Twice-annual penetration testing consists of both internal and external penetration tests and comprehensive reports by a qualified third party provider.

Trustwave PCI Rapid Comply

PCI compliance scanner: pcirapidcomply2.com
used monthly.

DLP Compliance

DLP Compliance polices (currently active on all LETU O365-enabled accounts)
alert on shared content for users which could compromise compliance with PCI,
GLBA or other Privacy or Financial regulations.
This includes email for users converted to LETU's O365 email platform.

Network Compliance
LETU Network Mgmt System is configured to trigger alerts and guidance
on detected issues or vulnerabilities affecting compliance with best practices
or regulatory issues within LETU's network architecture.
These alerts trigger configuration team reviews and modifications as needed.

• To protect the confidentiality,
authenticity or integrity of information
by cryptographic means
• Policy should be developed on the use
of cryptographic controls
• Key management should be in place to
support cryptographic techniques 

Protect Cardholder Data

3. Protect stored data
4. Encrypt transmission of cardholder data and
sensitive information across public networks

III.C. Manage and
Control Risk

3.1.13 Employ cryptographic mechanisms
to protect the confidentiality of remote
access sessions

3.1.17 Protect wireless access using
authentication and encryption

3.13.8 Implement cryptographic mechanisms
to prevent unauthorized disclosure of CUI
during transmission

3.13.10 Establish and manage cryptographic
keys for cryptography employed in the
information system

3.13.11 Employ FIPS-validated cryptography when
used to protect the confidentiality of CUI

Remote Services for Remote offices and Employees protected by mandatory Encryption

All data at rest on mobile or physically insecure devices stored using one-way strong encryption hashes

Kerberos Policy
Kerberos tickets are enforced for domain clients through Group Policy which ensures: 600 minute service ticket lifetime; 10 hour user ticket lifetime;  5 minute tolerance for computer clock synchronization

Certificate Authority
On-campus domain certification authority handles automatic certificate management on domain-joined clients 

12.4
Security of System Files

To ensure security of system files through
the control of access to system files and
program source code 

Build and Maintain a Secure Network

2. Do not use vendor-supplied defaults for system
passwords and other security parameters

III.C. Manage and
Control Risk

Project and support environments should be
strictly controlled 

Maintain a Vulnerability Management Program

6. Develop and maintain secure systems and
applications

3.1.14 Route remote access via
managed access control points

3.4.3 Track, review, approve/disapprove,
and audit changes to information systems

3.4.4 Analyze the security impact of changes
prior to implementation

3.12 Security Assessment

Systems Development and Change Management

d. Acquiring, implementing, integrating, and maintaining IS applications

e. Acquiring, implementing, integrating, and maintaining infrastructure

Role-Based Access
Each employee given access and appropriate permissions
only to systems to which they need those specific rights

Change Management
IT Business Systems team receives notifications of patches and hotfixes, and reviews related release notes. This team then requests approval from change management team for a time to perform updates. Full databases and system backups are done nightly. Tape rotation method is used to allow complete recovery. Complete backups are performed prior to any new or updated application being deployed.

12.6
Technical Vulnerability Management

To reduce risks resulting from exploitation
of published technical vulnerabilities
• Technical vulnerability management
should be effective, systematic, and
repeatable 

Maintain a Vulnerability Management
Program

5. Use and regularly update antivirus software
6. Develop and maintain secure systems and
applications

III.C. Manage and
Control Risk

Windows Defender / Azure Security Center (EDR)
Protects against malicious code for managed endpoints

Server Vulnerability Scans
All servers scanned continuously using Tenable.io vulnerability scanning tool.

External facing IPs and servers scanned weekly by National Cybersecurity Assessment and Technical Services (NCATS)

Penetration Testing
Twice-annual penetration testing consists of both internal and external penetration tests and comprehensive reports by a qualified third party provider.

RSS/Web Lists
RSS, mailing lists, and forums are used to keep apprised of newly published
vulnerabilities. Manual patches are tracked through collaborative
spreadsheets until stakeholders have verified each affected endpoint has
been patched

Trustwave PCI Rapid Comply
PCI compliance scanner: pcirapidcomply2.com
used annually

Qualys SSL Labs
Server security scanner: https://www.ssllabs.com/ssltest

13.1
Information Security Incident Management

To ensure information security events and
weaknesses associated with information
systems are communicated in a manner
allowing timely corrective action to be taken
• Formal event reporting and escalation
procedures should be in place 

Maintain a Vulnerability Management Program

6. Develop and maintain secure systems and
applications

Regularly Monitor and Test Networks

11. Regularly test security systems and processes
Maintain an Information Security Policy:
12. Maintain a policy that addresses information
security for employees and contractors

III.C. Manage and
Control Risk

FSA GENERAL-23-09 (h)

3.1.1 Limit information system access
to authorized users, processes acting
on behalf of authorized users, or
devices (including other information
systems)

3.1.2 Limit information system access to
the types of transactions and functions
that authorized users are permitted to
execute

3.1.3 Control the flow of CUI in
accordance with approved authorizations

Operations

m. Process for identifying and resolving incidents

LETU Information Technology Continuity Plan (Secure Document: available internally)

Data Classification Standard
  LETU Policy 6.2: Data Classification

Communication Policy
Defines response expectations for various incidents:
Communication Policy

Incident Log
Security Incident Reports

Department of Ed Notification

13.2
Management of Information Security
Incidents and Improvements

• To ensure a consistent and
effective approach is applied to the
management of information security
incidents 

Maintain an Information Security Policy

12. Maintain a policy that addresses information
security for employees and contractors

III.C. Manage and
Control Risk

FSA GENERAL-23-09 (g)

3.1.1 Limit information system access
to authorized users, processes acting
on behalf of authorized users, or
devices (including other information
systems)

3.1.2 Limit information system access to
the types of transactions and functions
that authorized users are permitted to
execute

3.1.3 Control the flow of CUI in
accordance with approved authorizations

3.3 Audit and Accountability

3.6 Incident Response

Security

f. Information Security policy

LETU Information Technology Continuity Plan (Secure Document: available internally)

Communication Policy
Defines response expectations for various incidents:
Communication Policy  

Data Classification Standard
  LETU Policy 6.2: Data Classification

14.1
Information Security Aspects
of Business Continuity Management

To counteract interruptions to business
activities and to protect critical business
processes from the effects of major failures
or disasters and to ensure their timely
resumption

Maintain an Information Security Policy

12. Maintain a policy that addresses information
security for employees and contractors

III.C. Manage and
Control Risk

FSA GENERAL-23-09 (g,h)

3.1.1 Limit information system access
to authorized users, processes acting
on behalf of authorized users, or
devices (including other information
systems)

3.1.2 Limit information system access to
the types of transactions and functions
that authorized users are permitted to
execute

3.1.3 Control the flow of CUI in
accordance with approved authorizations

3.8.9 Protect the confidentiality of
backup CUI at storage locations

Entity-Level Controls

a. Plans that align business objectives with IT strategies

LETU Information Technology Continuity Plan (Secure Document: available internally)

Data Classification Standard
  LETU Policy 6.2: Data Classification

Business Objective Alignment
IT-related risks communicated through IT personnel and brought to the attention of CIO. Action plans with due dates are implemented for recovery. Users required to sign confidentiality agreements before any access to administrative software is granted.

15.1
Compliance with Legal Requirements

To avoid breaches of any law, statutory,
regulatory or contractual obligations, and
of any security requirements 

Maintain an Information Security Policy

12. Maintain a policy that addresses information
security for employees and contractors

III.C. Manage and
Control Risk
III.F. Report to the
Board

FSA GENERAL-23-09 (i)

3.3.8 Protect audit information and audit tools
from unauthorized access, modification, and
deletion

3.3.9 Limit management of audit functionality
to a subset of privileged users

3.8.9 Protect the confidentiality of
backup CUI at storage locations

Data Classification Standard
  LETU Policy 6.2: Data Classification

​​​​​​​Department of Ed Notification

15.2
Compliance with Security Policies and
Standards, and Technical Compliance

To ensure compliance of systems with
organizational security policies and
standards

Regularly Monitor and Test Networks

10. Track and monitor all access to network
resources and cardholder data
11. Regularly test security systems and processes

Maintain an Information Security Policy

12. Maintain a policy that addresses information
security for employees and contractors

III.C. Manage and
Control Risk
III.E. Adjust the
Program
III.F. Report to the
Board

Data Classification Standard
  LETU Policy 6.2: Data Classification

Trustwave PCI Rapid Comply
PCI compliance scanner: pcirapidcomply2.com
used monthly.

Qualys SSL Labs
Server security scanner: https://www.ssllabs.com/ssltest
used annually

Protect Stored Cardholder Data

Encrypt transmission of cardholder data
across open, public networks