Protection of Personally Identifiable Information in Indiana’s Statewide Longitudinal Data System

We reported that the Indiana Department of Education did not provide adequate oversight to ensure that its system met minimum security requirements that included a creating System Security Plan, completing a compliance audit and risk assessment, and classifying its security level. We also reported that the Indiana Department of Education lacked assurance that it could prevent and detect unauthorized system access and disclosure of information.