Software & Security Considerations

This chapter gives an overview of the software and security issues that must be considered when planning how your school will process FSA data and reports. The security of personal and organizational data is important, and federal law requires schools to have an information security plan. This chapter may help you develop it.

While your school is required to have at least one SAIG mailbox and to enroll in FSA systems such as the CPS, COD, and NSLDS, the Department doesn’t specify what software must be used at your school to open, create, or correct FSA records and reports.

As a service to participating schools, FSA provides free PC-based software to transmit and receive data over the Internet (EDconnect) and to assist with student application, packaging, origination and disbursement records, cash management, and reconciliation functionality (EDESuite; EDExpress and Direct Loan Tools).

However, schools may choose to use software developed by third-party vendors, or develop their own PC or mainframe-based software programs to work with FSA records and reports. Some of the more sophisticated software products have the advantage of being able to share information with other offices at your school—for instance, enrollment data with your bursar’s office and payment information with your business office.

If you choose a third-party software product, you are responsible for ensuring that it can perform the necessary functions to open, edit, and create FSA student records and reports. (In particular, your software must be able to send and receive COD records in XML format.) Ultimately, the responsibility for ensuring the timeliness and accuracy of electronic data rests with your school.

Because student aid records contain personally-identifiable information that is quite sensitive, your school must take special care to ensure that only appropriate members of the administrative staff are able to view and edit those records. The person who configures the security settings in EDExpress is usually referred to as the “systems administrator.” The systems administrator can be one of the destination point administrators identified in the SAIG enrollment process, as discussed in Chapter 2, or it may be someone at your school who has general responsibility for the installation of new software and network security. In either case, the person configuring the software should carefully consider how it will be used and the types of access required for each user.

Managing permissions for school staff requires a little planning. Access to FSA data is controlled at three different levels:

Because access is configured separately for Web users and software users, it is possible for a Web user to have access to some data that he or she cannot open in local software (or vice versa). In general, we recommend that you configure the access rights in EDconnect and EDExpress so that they are consistent with the permissions that you have established through the SAIG Enrollment Form, the SAIG website, and with COD School Relations. (See Chapter 2.) For instance, if you have given a user access to CPS data in EDconnect and EDExpress, then you would probably want to give that user the capability to view and edit ISIR data on FAA Access to CPS Online.

One way to organize the exchange of FSA data is to create separate SAIG mailboxes for different kinds of data. For instance, you could establish one mailbox solely for ISIR data, and another mailbox solely for COD data.

The SAIG enrollment process gives you the choice of the following types of data for a mailbox:

In theory, you could have a different mailbox for each of these types of data, but at most schools it would make more sense to combine some of these categories into one mailbox. For instance, staff members working with default prevention could be served by a single mailbox that collected NSLDS batches, eCDR information, and Direct Loan borrower delinquency reports. Or a school might have one SAIG mailbox for Direct Loan data coming from the COD system but a different one for getting grant data from COD.

Also note that you will need to establish separate SAIG mailboxes for additional locations of your school if the locations have different federal school codes for purposes of FAFSA/ISIR data. Similarly, a school can obtain separate Direct Loan codes for approved additional locations, if it wants to set up a mailbox to receive DL data for just that location.

If you are acting as the systems administrator and are setting up EDconnect or EDExpress software on a PC, you can set the access rights for each security group that you create. All of the users in a security group have the same access rights.

Your EDExpress security groups do not have to mirror your EDconnect security groups because the access rights that are being assigned are quite different. EDconnect controls the ability to send and receive files to and from FSA, and we recommend that you only establish one security group for each of your school’s mailboxes. EDExpress controls the functions for working with the individual records (viewing, updating, printing, etc.).

You can organize your security groups to control workflow. For instance, you might give your COD workgroup the ability to create and update common records but not give them the permission to transmit files in EDconnect. A member of the EDconnect security group for the SAIG mailbox would be responsible for sending and receiving files on a predetermined or ad hoc schedule. This would be one way to stage your work in larger batches.

EDconnect automatically downloads NSLDS files into the default folder C:\NSLDS\Files. All other files (COD, CPS, PMESSAGES, etc.) are automatically downloaded to the default folder C:\IAM\DATA. If you change EDconnect to download or send non-NSLDS files to a location other than C:\IAM\DATA, use File Management in EDExpress to tell EDExpress where to look for the files.

You may find it convenient to have different types of data sent to different folders on a single-user PC or a network. This can be done by setting file paths in EDconnect. There are two ways to do this:

Your systems administrator can provide an additional layer of security by controlling which users have access to the data kept in folders on a shared drive.

For each SAIG mailbox that it establishes, a school must designate at least one destination point administrator or DPA who is responsible for the security of the data sent and received through that mailbox.

The EDExpress security groups are not necessarily associated with a particular mailbox and can have different users than the EDconnect security groups.