Why GLBA Applies to Your College or University and What to Do About It

The misconception

Ask a room of college administrators which federal laws shape their cybersecurity program, and you will hear FERPA, maybe HIPAA for the health center, and perhaps NIST SP 800-171 for research contracts. The Gramm-Leach-Bliley Act rarely comes up. That is a costly blind spot.

GLBA was written for banks, but its definition of a "financial institution" is broad. Colleges and universities lend money, process student loans, run payment plans, and administer financial aid. Under federal law, that makes them financial institutions. As one law firm summarizes it, all Title IV institutions, whether public, private nonprofit, or for-profit, must comply with GLBA cybersecurity requirements as a condition of Title IV participation.

You already agreed to it

The obligation is not abstract. It is in documents your institution has already signed:

• The Program Participation Agreement (PPA). Every institution that participates in Title IV programs agrees in its PPA to comply with the Safeguards Rule at 16 C.F.R. Part 314.
• The Student Aid Internet Gateway (SAIG) Enrollment Agreement. This agreement commits the institution to protect Federal Student Aid applicant information and to report breaches.

Federal Student Aid (FSA) has signaled for nearly a decade that it takes this seriously. In Dear Colleague Letters GEN-15-18 and GEN-16-12, it reminded institutions of their GLBA obligations and announced it would enforce them through annual compliance audits. In February 2023, FSA issued Electronic Announcement GENERAL-23-09, which explained the strengthened FTC Safeguards Rule that took effect for institutions on June 9, 2023.

What the Safeguards Rule actually requires

The 2021 amendments replaced general expectations with specific requirements. A compliant information security program includes:

1. A Qualified Individual who oversees, implements, and enforces the program. This person can be an employee, an affiliate, or a service provider, such as a fractional CISO. The institution remains responsible either way.
2. A written risk assessment that identifies internal and external risks to student financial information and is updated periodically.
3. Safeguards that control those risks, including access controls, a data and systems inventory, encryption of customer information in transit and at rest, secure development practices, multi-factor authentication, secure disposal of data, change management, and monitoring of user activity.
4. Regular testing: either continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months.
5. Security awareness training for staff, and qualified personnel to run the program.
6. Oversight of service providers who handle student financial information, including your student information system, payment processors, and financial aid software vendors.
7. Ongoing evaluation and adjustment of the program as operations and threats change.
8. A written incident response plan.
9. An annual written report from the Qualified Individual to the board of trustees or equivalent governing body.

The 24-hour clock

The requirement that surprises institutions most is the breach-reporting timeline. In Electronic Announcement GENERAL-24-46, FSA clarified that institutions must notify it of a breach within 24 hours of the incident becoming known or identified. Reports are made through the FSA Cybersecurity Intake Page.

Twenty-four hours is not enough time to start writing a plan. Your incident response plan should name who decides an event is reportable, who submits the notice, and how the notice is coordinated with legal counsel, cyber insurance, and any state breach-notification obligations.

Where FERPA fits

The Family Educational Rights and Privacy Act (FERPA) and GLBA overlap, but they are not interchangeable:

• FERPA is a privacy law. It governs who may access and disclose personally identifiable information in education records, and it requires institutions to use reasonable methods to ensure school officials only see the records they have a legitimate educational interest in.
• GLBA's privacy requirements are treated as satisfied when an institution complies with FERPA.
• GLBA's security requirements are separate. The Safeguards Rule's technical and administrative controls still apply to financial-aid information, regardless of your FERPA posture.

In practice, the strongest programs manage both through one control framework. The same access reviews, data inventory, and logging that protect financial-aid data also show that your institution is enforcing FERPA's "legitimate educational interest" standard.

What about the changes at the Department of Education?

In March 2026, the Department of Education and the Treasury Department signed an interagency agreement to shift parts of federal student-aid operations to Treasury in phases. Leaders should not read this as a pause in enforcement. The agreement states that the Department of Education and FSA keep their statutory responsibilities. Your obligations under the PPA, the SAIG agreement, and the Safeguards Rule have not changed. Institutions should watch FSA Electronic Announcements for any change in where breach reports are submitted.

A practical 90-day path to compliance

How Serenport helps

Serenport helps colleges and universities turn GLBA and FERPA obligations into a governance program that runs year-round. Our GLBA & FERPA readiness review maps your current controls against the Safeguards Rule and NIST frameworks, identifies gaps, and produces a prioritized roadmap and a board-ready report. Serenport can also serve as your Qualified Individual through our fractional CISO service.

Our leadership pairs graduate training in public administration with CRISC, CISM, CISA, and PMP credentials. We understand how campus budgets, governance committees, and procurement actually work, so our recommendations are ones your institution can fund and sustain.