Below are the answers to the outstanding comments/questions from the last webinar. 1. Does this new counseling meet the regulatory requirements?

Transcription

1 August 29, 2012 Software Developers Webinar #4 - CANCELED This year, the Federal Student Aid (FSA) Technology Office will be hosting the Software Developers Conferences (SDC) in a quarterly, webinar format. We completed our first webinar on March 9, 2012, the second on July 11th, 2012, and the third on August 29th. There is no new information to present, so there will not be a 4th Software Developers Webinar this year. Please stay tuned for updates. The webinars are designed for software developers, their customers, and institutions that develop software for the purpose of Title IV financial aid processing. The objective is to provide information on recent legislative changes and enhancements to FSA systems such as COD, NSLDS and CPS. Below are the answers to the outstanding comments/questions from the last webinar. Exit Counseling: 1. Does this new counseling meet the regulatory requirements? Yes 2. What award years will the new counseling be used for 13/14 forward or will it also be used for 12/13? The counseling will not necessarily be award year specific. The sys gen will be sent in the highest schema with the most recent AY, but the counseling will be inclusive of loans from all award years. XML Validation: 1. Several of the vendors asked if we could provide them specific examples of where their files are failing XML. The presentation contains all of the known errors that were found during the sample week that was used. The vendors should use the schema which is currently published and the examples provided should give them a good starting point to see where they may have errors as the starting point to find out where each of them may have issues. 2. They also want to know if these changes include COD "outgoing" files adhering to the schema rules. Yes. Outgoing files will be adhere to the schema validation rules. From 11 February 2013

2 3. With the full validation changes, they would like the test window to be opened to them to do a full test with COD PRIOR to release implementation. Since we have time, can we move this schedule up for release 13.0? We'll need to look into this further in order to assess code stability, environment availability, etc. Experimental Sites 1. They wanted to know if FSA had a list of approved schools that we could share. FSA will provide the list once it has been finalized. For questions concerning the Shopping Sheet, please ShoppingSheet@ed.gov. Topic Agenda & Welcome Policy Update Financial Aid Shopping Sheet FSA Systems Update-COD Development FSA Systems Update-CPS Update Two Factor Authentication PII Updates Identity Management Presenter(s) Bridget-Anne Hampden Jeff Baker Jessica Shedd Wendy Jerreld Cheryl Tisdale Steven Burke Cheng Tang Warren Gordon From 11 February 2013

3 Introduction and Agenda Bridget-Anne Hampden U.S. Department of Education 2012 Software Developers Webinar #3

4 Agenda Introduction Legislative and Policy Update Office of Postsecondary Education Update FSA System Updates / Enhancements Two Factor Authentication ti ti Personally Identifiable Information Enterprise Identity Management 2

5 Policy Update Jeff Baker U.S. Department of Education 2012 Software Developers Webinar #3

6 Topics! College Choice Tools! Studentaid.gov! Regulatory Activity! Consolidated Appropriations Act! Subsidized Loan Limitation! President s FY 13 Budget! Verification 2

7 College Navigator Tool

8 College Choice: ScoreCard 4

9 Student Specific Information: Elements of cost of attendance appropriate for the specific student - -->> Grant aid (does not have to be repaid or earned) -- >> Financial Aid Shopping Sheet Institutional Performance Metrics: <<-- Student Right-to- Know graduation rate at 150% of normal time Net price after grants -- >> <<-- Most recent cohort default rate 5 Aid awarded but earned thru work - -- >> School recommended loan amounts under Federal loan programs - - >> General listing of other types of funding that can be used to meet net costs (including family contribution) - >> Space for institution to send custom message -- >> <<-- Median debt for completers Contact information: << --Where to go for more information

10 6 studentaid.gov

11 Federal Student Aid Websites

12 Solution: StudentAid.gov

13 FSA Social Media Twitter YouTube Facebook

14 10 Regulatory Activity

15 Pay As You Earn! Amend Income Contingent Repayment regs to!reduce from 15% of discretionary income to 10%!Reduce forgiveness time from 25 years to 20 years!negotiated rulemaking required! Concluded in March! NPRM Published July 17! Comments by August 16! Expected effective date:! July 1, 2013! Possible Early Implementation Fall

16 Consolidated Appropriations Act 2012 See DCL GEN

17 Grace Period Interest Subsidy! Temporarily eliminates the interest subsidy on Direct Subsidized Loans during the six month grace period.! Applies to new Direct Stafford Loans for which the first disbursement is made on or after July 1, 2012, and before July 1,

18 Ability-to-Benefit (ATB)! Eliminates Title IV eligibility for students without a high school diploma (or equivalent).! Exception for! Home schooled students! Students who are or were, enrolled in a Title IV eligible program anytime prior to July 1, 2012, may continue to qualify under one of the ATB alternatives 14

19 Pell Duration of Eligibility! Establishes the duration of a student s eligibility to receive Pell Grant to 12 semesters (or its equivalent).! Applies to all students effective with the award year.! Calculation includes all earlier years of the student s receipt of Pell. 15

20 Pell Duration of Eligibility! Scheduled Award! Based on the statutory maximum award amount for the year and the student s EFC (and COA)! Amount student would be eligible for if enrolled fulltime for a full academic year! Maximum Award is $5,550! If EFC = 0, scheduled award is $5,550! If EFC = 1,000, scheduled award is $4,550! Annual Award! Amount of scheduled award received by the student! Less than fulltime! Less than a full academic year 16

21 Pell Grant Duration of Eligibility! Example! Student s Scheduled Award was $5,550, but only received $2,775 because only enrolled for one semester, will have used 50% of that award year s scheduled award.! Student who was enrolled three quarter time for the entire award year would have used 75% of his scheduled award.

22 Pell Duration of Eligibility! Calculate the equivalency by adding together each of the annual percentages of a student s scheduled award that was actually disbursed to the student.! LEU Lifetime Eligibility Used! The example student s LEU is 125% of the total 600%.! Once LEU reaches 600%, student no longer eligible.! If LEU more than 500% but less than 600%, partial eligibility for next award year. 18

23 19 Subsidized Loan Limitations

24 Subsidized Loan Limitation! When a student has received subsidized loans for 150% of the published time of the academic program! The student may not receive any additional subsidized loans, and! The subsidized loans received from July 1, 2013 on lose their subsidy! Applies to new borrowers on or after July 1, 2013.! Special calculation of 150% for transfer students

25 Subsidized Loan Limitation! First instance could be as early as December 2013 because of short-term programs.! FSA will track, calculate, and inform.! Likely to be codes and comments on ISIRs! COD enforcement! Need to determine how to best collect program length information from schools for each subsidized loan recipients

26 22 President s FY 13 Budget

27 FY 13 Budget! $5,635 maximum Pell Grant award for " Maintain the subsidized loan interest rate for undergraduate students at 3.4 percent for undergraduates until July 1, 2013 " Limit the duration of the Stafford Loan inschool interest subsidy to 150 percent of the normal time required to complete the borrowers educational program. 23

28 FY 13 Budget! Expand and improve the Perkins Loan program to provide $8.5 billion in loans annually.! Provide $150 million in new funds for the Work-Study Program.! Reform and expand Federal allocations in the campus-based programs 24

29 25 Verification

30 Verification Items! Annual Federal Register notice! Items to verify! Acceptable documentation! Federal Register Notice: July 12, 2012! DCL GEN-12-11, July 17,

31 Verification Items! Same core FAFSA items as in ! AGI! Taxes Paid! Four Untaxed Income Items! Education Credits! Number in Household! Number in College! SNAP! Child Support paid 27

32 Verification Items! Two new verification items to combat fraud! High School Completion Status! Identify/Statement of Educational Purpose 28

33 Verification! Five Verification Tracking Groups! V1 - Standard Verification Group!Same core FAFSA items as in ! V2 - SNAP Verification Group!SNAP Only! V3 - Child Support Paid Verification Group!Child Support Paid Only 29

34 Verification! Five Verification Tracking Groups! V4 - Custom Verification Group!High School Completion!Identity/Statement of Educational Purpose! V5 - Aggregate Verification Group!All items from Groups V1 and V4 30

35 Financial Aid Shopping Sheet U.S. Department of Education 2012 Software Developers Webinar #3

36 Student Info *Student name/identifier *Student s cost of attendance (on-campus example shown; different category names may be used for commuter or offcampus students) *Sum of the grant subcategories (campus-based FSEOG would appear under Grants from your school ) NET COST AFTER GRANTS 2

37 Student Info continued *Aid awarded by institution but earned through work *School recommended Federal loan amounts *Other funds that can be used to meet net costs (includes family contribution either FAFSA calculated or institutional methodology) *Space for institution to provide a custom message 3

38 Institutional Info DATA IS PROVIDED BY ED *Student-Right-to-Know graduation rate (at 150% of normal time) *Cohort default rate *Link to loan repayment calculator *Contact information for institution *Median debt for borrowers 4

39 Contact Information We appreciate your feedback and comments. Please contact me at: U.S. Department of Education

40 Common Origination and Disbursement (COD) System Update Wendy Jerreld U.S. Department of Education 2012 Software Developers Webinar #3

41 Agenda COD Release 11.2 Update COD Release 12.0 Update Future Enhancements COD Technical Reference Updates 2

42 COD Release 11.2 Update The COD System will implement the following functionality with Release 11.2 on November 9, Final modifications for ending eligibility for upfront Direct Loan interest rebates New Direct Loan and Grants Experimental Sites for COD! Edit 51 will allow approved schools to submit Direct Loan disbursements that are dated up to 30 days before start of classes/award begin date! Ability to submit and accept Pell Grant records for students with a bachelor's degree that are enrolled in vocational or career programs Retire Warning Edit 111 3

43 COD Release 11.2 Update Pell Experimental Sites With Release 11.2, the COD System will implement new COD Experimental Sites functionality for the ability to submit and accept Pell Grant records for students with a bachelor's degree that are enrolled in vocational or career programs. Only schools that have been approved for this experiment will have this capability Ability to process Pell Grants with the CPS Applicant Pell Eligible flag = No (N) when the award is submitted by a school that has an appropriate PEPS experimental site flag set Processing can be performed via batch or Web for the award year and forward 4

44 COD Release 12.0 Update With Release 12.0, the COD System will implement the following functionality in late March 2013: New Award Year Set-Up for Ability to Benefit (ATB) modifications Direct Loan and TEACH SAS disbursement detail available On Demand Exit Counseling available on StudentLoans.gov! New value(s) in the <CounselingType> for Exit Counseling! <CounselingType> values to be published in early Fall! Exit Counseling data will be added to the existing COD Counseling Report 5

45 COD Release 12.0 Update Ability to Benefit With Release 12.0, the COD System will implement modifications to Ability to Benefit (ATB). New valid values for <AbilityToBenefitCode> tag include:! 06 = High School Diploma! 07 = GED <AbilityToBenefitCode> tag required field Reject Edit 994 will be triggered if the <AbilityToBenefitCode> tag is not submitted on origination for any program New warning Edit 199 when <AbilityToBenefitCode> tag value submitted does not match the High School Diploma or equivalent value from the CPS Transaction Number For and forward 6

46 COD Release 12.0 Update Ability to Benefit Also the Ability to Benefit modifications will include: Reject Edit 198 if the <AbilityToBenefitCode> tag is submitted on origination with values equal to 05 Other and 03 State for all COD programs (Pell, Direct Loans and TEACH) for origination and maintenance For award years and forward 7

47 COD Release 12.0 Update SAS Disbursement On Demand Starting with the Award Year, COD will provide schools the option to request TEACH and Direct Loan SAS Disbursement Detail on an On Demand basis. Grant Data Requests, DL Rebuild and SAS Disbursement Detail will be combined on one COD Web page New message classes will be created for the data requested DL and TEACH SAS files 8

48 COD Release 12.0 Update SAS Disbursement On Demand Users will have the following options for SAS Disbursement Detail On Demand: Direct Loan or TEACH Program Award Year Start Date/End Date, Month-to-Dateto or Year-to-Date Format Display Names of Borrowers DL SAS Detail 9

49 COD Release 12.0 Update SAS Disbursement On Demand 10

50 COD Release 12.0 Update SAS Disbursement On Demand 11

51 COD Release 12.0 Update SAS Disbursement On Demand Activity Type Direct Loan SAS Message Classes Format Type New Message Class Header Month-to-Dateto Fixed-Length DSMFyyOP Month-to-Date Month-to-Date Comma-Delimited with Headers Comma-Delimited without Headers DSMHyyOP DSMCyyOP Month-to-Date Pipe-Delimited DSMPyyOP 12

52 COD Release 12.0 Update SAS Disbursement On Demand Direct Loan SAS Message Classes Activity Type Format Type New Message Class Header Date Range Fixed-Length DSRFyyOP Date Range Date Range Comma-Delimited with Headers Comma-Delimited without Headers DSRHyyOP DSRCyyOP Date Range Pipe-Delimited DSRPyyOP 13

53 COD Release 12.0 Update SAS Disbursement On Demand Direct Loan SAS Message Classes Activity Type Format Type New Message Class Header Year-to-Date Fixed-Length DSYFyyOP Year-to-Date Year-to-Date Comma-Delimited with Headers Comma-Delimited without Headers DSYHyyOP DSYCyyOP Year-to-Date Pipe-Delimited DSYPyyOP 14

54 COD Release 12.0 Update SAS Disbursement On Demand TEACH SAS Message Classes Activity Type Format Type New Message Class Header Month-to-Date Comma-Delimited TSOMyyOP Year-to-Date Comma-Delimited TSOYyyOP Date Range Comma-Delimited TSORyyOP 15

55 COD Future Enhancements For the award year, COD will begin performing full XML validation. New validation will be based on the most frequent COD XML errors Example of common errors include general file formatting such as:! Invalid character or invalid byte! Content before the <?xml tag! Opening tag exists but end tag is missing Please see the following slide for further examples 16

56 COD Future Enhancements XML Error Type cvc-maxlength-valid cvc-datatype-valid cvc-attribute.3 cvc-minlength-valid cvc-enumeration-valid cvc-type313 cvc-type cvc-complex-type cvc-elt.3.1 cvc-complex-type.2.3 cvc-length-valid cvc-mininclusive-valid cvc-pattern-valid cvc-complex-type.2.2 cvc-maxinclusive-valid Error Description String is too long Value is not valid for data type Required attribute missing String is too short Value not in set of valid options Element not valid Attribute 'xsi:schemalocation' is not allowed to appear in element Required value missing Element contains children, but is defined as element-only String length is wrong (length has to be exact) Number is too small String format wrong Element contains no sub-element whereas one is expected Number is too large 17

57 COD Technical Reference Updates Date June 2012 November 2012 Technical Reference Updates Revised Technical Reference was posted based on Summer and Fall 2012 system modifications Technical Reference to be posted without a new schema 18

58 Contact Information We appreciate your feedback and comments. We can be reached at: Direct Loans: Wendy Jerreld Phone: (202) Grants: Dan Sullivan Phone: (202)

59 Contact Information COD School Relations Center URL: Phone - Grants: (800) Phone - Direct Loans: (800) Effective December 2012 New Customer Service Address CODSupport@ed.gov 20

60 Software Developers Webinar Conference U.S. Department of Education August 22, 2012

61 CENTRAL PROCESSING SYSTEM (CPS) The CPS Update will provide information for programmers and data processing staff about the changes to the FAFSA, the Institutional Student Information Record (ISIR) layout, and the CPS edits and verification selection approach Presenter: Cheryl Tisdale 2

62 Update Agenda FAFSA and FAFSA on the Web Changes Central Processing System (CPS) Changes Verification Approach Institutional Student Information Record (ISIR) Changes CPS Test System Important Dates 3 3

63 FAFSA Changes

64 Paper FAFSA No data element changes Minor wording changes to some instructions Federal Register with the draft FAFSA posted to IFAP on August 15, Day public comment period projected to close on October 15, 2012 Watch for Electronic Announcement for the Final Draft 5

65 FAFSA Program Name Change Food Stamps Program references changed Supplemental Nutrition Assistance Program (SNAP) Student s Question #96 (Field #126) and Parent s Question #75 Parent s (Field #92) 6

66 FOTW Changes Increased Emphasis on PIN and Electronic Signatures PIN PAPER Mailers Discontinued Requiring High School Code on FAFSA on the Web (FOTW) 7

67 Increased Emphasis on PIN and Electronic Signatures We have seen an increase in signature rejects; to address this - Sign with my PIN will be the default signature option for most applicants Users can choose another option for signing, and when selected, the system will display options to print a signature page or submit without signatures, along with text explaining the benefits of electronic signatures 8

68 PIN PAPER Mailers Discontinued PIN PAPER mailers will no longer be generated All other PIN options will remain ( , view online, self-select, etc ) Users will continue to receive messaging about their PIN status on FAFSA on the Web that will instruct them to resolve issues with their PIN 9

69 Requiring High School Fields on FOTW Data Entry edits related to the High School Name, High School City, and High School State will be updated to require an answer if the applicant answers High School Diploma to the High School completion status question, regardless of Grade Level The logic for setting the High School Flag will be updated to remove the check for Grade Level equal to 0 or 1 10

70 CPS Changes

71 CPS Enhancements Pell Lifetime Eligibility Used (LEU) NSLDS Unusual Enrollment History Flag Use of IRS Data Flags in edits Income Threshold for Automatic Zero EFC 12

72 Pell Lifetime Eligibility Used (LEU) Implementation for includes: Adding the Pell Lifetime Limit Flag from NSLDS to the ISIR Adding the Pell LEU percentage to the NSLDS pre-screening data and to the ISIR The Pell LEU % will be a 7-character field with an implied decimal (example: xxxx.xxx%) % 13

73 Pell Lifetime Eligibility Used (LEU) Implementation for If a Pell LEU percentage has been provided in the NSLDS data from pre-screening, a SAR comment will be generated for Pell eligible transactions that includes the amount of eligibility used converted to the academic year equivalent If Pell LEU percentage is zero or blank, a SAR comment will be generated for Pell eligible transactions with general information about the Pell Grant limit 14

74 Pell Lifetime Eligibility Used (LEU) Pell LEU Comments Comment No. Condition SAR Comment 349 0% and Pell Grant Flag is set to Y 350 Greater than 0% and less than or equal to 50% and Pell Grant Flag is set to Y 351 Greater than 50% and less than or equal to 100% and Pell Grant Flag is set to Y. 352 Greater than 100% and less than or equal to 150% and Pell Grant Flag is set to Y. There is a limit to the total amount of Federal Pell Grants that a student may receive, which is the equivalent of 6 school years. Once a total amount of Pell Grant eligibility has been received, a student can no longer receive Pell Grant aid. There is a limit to the total amount of Federal Pell Grants that a student may receive, which is the equivalent of 6 school years. Based on information reported to the National Student Loan Data System (NSLDS) by the schools you have attended, you have received Pell Grants for the equivalent of up to one half of a school year. There is a limit to the total amount of Federal Pell Grants that a student may receive, which is the equivalent of 6 school years. Based on information reported to the National Student Loan Data System (NSLDS) by the schools you have attended, you have received Pell Grants for the equivalent of between one half one school year. There is a limit to the total amount of Federal Pell Grants that a student may receive, which is the equivalent of 6 school years. Based on information reported to the National Student Loan Data System (NSLDS) by the schools you have attended, you have received Pell Grants for the equivalent of between one and one and one half school years. 15

75 Pell Lifetime Eligibility Used (LEU) Pell LEU Comments Comment No. Condition SAR Comment 353 Greater than 150% and less than or equal to 200% and Pell Grant Flag is set to Y. 354 Greater than 200% and less than or equal to 250% and Pell Grant Flag is set to Y. 355 Greater than 250% and less than or equal to 300% and Pell Grant Flag is set to Y. There is a limit to the total amount of Federal Pell Grants that a student may receive, which is the equivalent of 6 school years. Based on information reported to the National Student Loan Data System (NSLDS) by the schools you have attended, you have received Pell Grants for the equivalent of between one and one half and two school years. There is a limit to the total amount of Federal Pell Grants that a student may receive, which is the equivalent of 6 school years. Based on information reported to the National Student Loan Data System (NSLDS) by the schools you have attended, you have received Pell Grants for the equivalent of between two and two and one half school years. There is a limit to the total amount of Federal Pell Grants that a student may receive, which is the equivalent of 6 school years. Based on information reported to the National Student Loan Data System (NSLDS) by the schools you have attended, you have received Pell Grants for the equivalent of between two and one half and three school years. 16

76 Pell Lifetime Eligibility Used (LEU) Pell LEU Comments Comment No. Condition SAR Comment 356 Greater than 300% and less than or equal to 350% and Pell Grant Flag is set to Y. 357 Greater than 350% and less than 400% and Pell Grant Flag is set to Y. There is a limit to the total amount of Federal Pell Grants that a student may receive, which is the equivalent of 6 school years. Based on information reported to the National Student Loan Data System (NSLDS) by the schools you have attended, you have received Pell Grants for the equivalent of between three and three and one half school years. There is a limit to the total amount of Federal Pell Grants that a student may receive, which is the equivalent of 6 school years. Based on information reported to the National Student Loan Data System (NSLDS) by the schools you have attended, you have received Pell Grants for the equivalent of between three and one half and four school years 17

77 NSLDS Unusual Enrollment History Flag NSLDS will add edits to identify records with unusual enrollment patterns and set a new NSLDS Unusual Enrollment History Flag Pre-Screening: SAR comments and the SAR C Flag will be generated; resolution guidance will be provided to schools The flag will also be included on the ISIR record Important Note: The previously released values and definitions for the flags set by NSLDS are under reconsideration. Final determination should be released within 2 weeks 18

78 NSLDS Unusual Enrollment History Flag Post-Screening: CPS will system-generate a new transaction with Reason Code 24 for records that have a change in the NSLDS Unusual Enrollment History Flag value after the initial pre-screening The new transaction will include the new value for the NSLDS Unusual Enrollment History Flag and a SAR Comment or C Flag as appropriate 19

79 Use of IRS Data Flags in Edits Edits applied to data fields that can be transferred from the IRS revised to use the IRS Data Field Flags as additional criteria to determine whether edit is met When the IRS Data Field flags shows that the applicant transferred the data from the IRS and did not change it, the CPS will not apply the following reject edits: Parents: 12 & C Student: 3, C, and G 20

80 Use of IRS Data Flags in Edits Edit No. Condition Procedure 4020 Dependent, Parent s Taxes Paid is greater than zero and equal to or greater than Parent's AGI, and Parent s IRS Data Field flag for AGI or taxes paid is not equal to Student s Taxes Paid is greater than zero and equal to or greater than Student s AGI, and Student s IRS Data Field flag for AGI or taxes paid is not equal to Dependent, Parents Taxes Paid is greater than zero, not equal to or greater than Parents AGI, greater than or equal to 40% of Parents AGI, Parents IRS Data Field flag for AGI or taxes paid is not equal to 1, and Professional Judgment Flag is not set to Independent, Student s Taxes Paid is greater than zero, not equal to or greater than Student s AGI, greater than or equal to 40% of Student s AGI, Student s IRS Data Field flag for AGI or taxes paid is not equal to 1, and Professional Judgment Flag is not set to Dependent, Student s Taxes Paid is greater than zero, not equal to or greater than Student s AGI, greater than or equal to 40% of Student s AGI, Student s IRS Data Field flag for AGI or taxes paid is not equal to 1, and Professional Judgment Flag is not set to 1. Set reject reason 12. Set reject reason 3. Set reject reason C. Set reject reason C. Set reject reason G. 21

81 Auto Zero EFC Threshold Updated Income Threshold for Automatic Zero EFC increased from $23,000 to $24,000 Edits for Parents Edits for Independent Students 22

82 Verification Approach and Process

83 Verification Process For FAFSA information to be verified and acceptable documentation, refer to: Federal Register Notice published on July 12, 2012 DCL GEN posted on July 17, 2012 FAFSA information to be verified by the applicant Include the same verification items that were in place for for tax filers and non-tax filers, including SNAP and Child Support Paid if reported Two additional verification selection items: High School Completion Status Identity/Statement of Educational Purpose 24

84 Verification Process The CPS will continue to set a Verification Flag on the applicant s ISIR to indicate that the applicant was selected for verification New for : Verification Tracking Groups Each applicant selected for verification will be placed into one of five Verification Tracking Groups The applicant s ISIR will use the Verification Tracking Flag field to indicate the applicant s Verification Tracking Group: V1, V2, V3, V4, or V5 The individual verification items that an applicant must verify are based upon the Verification Tracking Group to which the applicant is assigned 25

85 Verification Process Verification Tracking Flag Groups: Verification Tracking Flag Verification Tracking Group Verification Description V1 Standard Verification Record selected because conditions based on statistical analysis error prone risk model were met V2 SNAP Verification Record selected for receipt of SNAP criteria only V3 Child Support Paid Verification Record selected for Child Support Paid criteria only V4 Custom Verification Group Record selected for Identity criteria only V5 Aggregate Verification Group Record selected for Identity criteria and Standard Verification criteria 26

86 Verification Process Verification Flag and Verification Tracking Flag on the ISIR Y V1 27

87 Institutional Student Information Record (ISIR) Changes

88 ISIR Record Layout Global Changes ISIR Record Layout posted in the EDE Technical Reference in July 2012 Update(Sections 3-4) and the final projected for October 2012 ISIR follows order of questions on the paper FAFSA ISIR record layout record length increased from 4250 to 4500 Date fields incremented 29

89 ISIR Record Layout 30 Added Field #179 IRS Student Adjusted Gross Income (AGI) Data Field Flag Field #180 IRS Student Federal Income Tax (FIT) Data Field Flag Field #181 IRS Parent Federal AGI Data Field Flag Field #182 IRS Parent FIT Data Field Flag Values: 0 = IRS data not transferred (default value) 1 = IRS data was transferred and not changed by user 2 = IRS data was transferred and changed by user to a different value 3 = IRS Request flag is equal to 02, 03, or 04, and field has been corrected on this transaction 4 = IRS Request flag is equal to 02, 03, or 04, and field has been corrected on a previous transaction Blank

90 ISIR Record Layout Added Field #438 NSLDS Pell Lifetime Limit Flag Values: E = Met or Exceeded Pell limit C = Close to Pell limit H = High Pell percent N = No problem 31

91 ISIR Record Layout Added Field #439 NSLDS Pell Lifetime Eligibility Used Values: Numeric Format is 99v99999 v is an implied decimal and is not included on the output Example: is % Added Field #440 NSLDS Unusual Enrollment History Flag New descriptions: Flag values and descriptions are being determined 32

92 ISIR Record Layout Modified Field #12-Student s Date of Birth Year 2000 added as valid value Modified d Field #350 NSLDS Post screening Reason Code- Added reason = NSLDS Unusual Enrollment History status change 33

93 CPS Test System

94 CPS Test System Draft Application Processing Software Developers Specifications was posted on August 16, 2012 Updates will be provided, as needed 35

95 CPS Test System Mechanism for you to confirm that your system Meets specifications for interfacing with CPS Is calculating correct results Allows you to Test applications and corrections Receive ISIR data 36

96 CPS Test System Available December 30 th and remains available through the end of the processing cycle User Guide will be posted to Federal Student Aid Download Web site (FSAdownload.ed.gov) around mid October 2012 An Electronic Announcement will be posted when the test system goes live 37

97 CPS Test System Test files will be available at FSAdownload.ed.gov Separate input and output files will be posted for testing specifications Remember - CPS is still in test until FSA accepts the system and production starts on January 2,

98 Important Dates

99 Important Dates Mid-August Electronic Data Exchange (EDE) Technical Reference draft (including the ISIR Record Layout and ISIR Cross-Reference) Mid-August Application Processing System Specifications for Software Developers draft End of October EFC Formula Guide on the IFAP Web site, pending final 2011 IRS tax legislation 40

100 Important Dates October 15, CPS Test System User Guide October 22, Electronic Data Exchange (EDE) Technical Reference- Final October 29, ISIR Guide on the IFAP 41

101 Important Dates November 5, SAR Comment Codes and Text December 2012 The CPS Test System is made available 42

102 Important Dates January 1, FAFSA on the Web site is available to students and FAA Access to CPS Online Web site January 2, 2013 The CPS begins processing 43

103 Contact Information We appreciate your feedback and comments Cheryl Tisdale Phone:

104 Two Factor Authentication Steven Burke U.S. Department of Education 2012 Software Developers Webinar #3

105 Agenda Project Overview Postsecondary School Federal Financial Aid Eco-System Project Scope Project Phases and Deployment Status TFA Attestation t ti Lifecycle TFA Attestation/Confirmation Process Registration Scenarios Frequently Asked Questions Additional Resources 2

106 Project Overview In 2010 an estimated 90,000 accounts were identified accessing FSA systems without a second factor authentication. FSA hosts at least 80 million records - all currently unprotected in accordance with industry best practices and Office of Management and Budget (OMB) mandate M The U.S. Department of Education is implementing a security protocol through which all authorized users will be required to enter two forms of authentication to access Federal Student Aid systems via the Internet. This process is referred to as Two Factor Authentication (TFA). 3

107 Postsecondary School Federal Financial Aid Eco-System 6,400 unique institutions of higher education Over 3,000 financial partners Over 90K privileged accounts Over 70M unique identities Over 320M loans Over 96M grants Supporting students in 35 countries $1T loan book Over 13M students Over 30M aid awards FSA Staff: ~1,300 Contractors: ~ 10,000 Services Aid Apps Grants Loan Origination Loan Servicing Debt Collection Compliance Over $120B injected into the eco-system each year 4

108 Two Factor Authentication Scope Provide safe and secure access to FSA network services Primary systems impacted across the enterprise NSLDS, CPS, COD, AIMS, PM, FMS, and SAIG This project encompasses approximately 90K users FSA employees, Dept. of ED employees Partners Postsecondary School Destination Point Administrators (DPA) Guaranty Agencies Servicers, PCAs, NFPs Call Centers, Developers, Contractors, and Sub-Contractors TFA project is focused on privileged users A privileged user is anyone who can see more than just their own personal data 5

109 What is Two Factor Authentication? Something that you know is the First Factor: User ID and Password Something that you have is the Second Factor: Token with a One Time Password The One Time Password (OTP) will be generated by a small electronic device, known as the TFA Token, that is in the physical possession of the user To generate the OTP, a user will press the power button on the front of the token A different OTP will be generated each time the button is pressed Alternative Methods of obtaining OTP without TFA Token: A) Answer three Challenge Questions online B) Have the OTP sent to your Smart Phone 6

110 TFA Project Phases Phase 1 To ensure the successful deployment of two factor tokens for FSA Citrix users; 1,300 completed 5/1/2011 Phase 2 To ensure the successful deployment of two factor tokens for Department of Education Staff and FSA Contractors; approximately 5,200 users and FSA Contractors completed 10/28/2011 Phase 3 International users, Foreign Schools (FS) and Domestic Schools, when logging into FSA systems across 35 countries; completed12/31/2011 Domestic users, to ensure the successful deployment of two factor tokens for users when logging into FSA systems; 88,600 users by 12/31/2012 Phase 4 Guaranty Agencies, TIVAS, Third Party Servicers, Not for Profits, Payment Collection Agencies (PCA), and VPN users connecting through Virtual Data Center (VDC) 7

111 TFA Deployment Status Total TFA Tokens Deployed: 48,280 in the USA and 35 Countries Tokens Deployed to Phase III & IV for Partners: 41,698 Partner tokens registered: 23,357 Percent Registered: 56% System Update: 90% Complete NSLDS moved behind AIMS, completed on 12/18/2011 COD TFA enabled on 1/28/2012 SAIG Enrollment TFA enabled 2/12/2012 EDconnect TFA enabled 3/4/2012 8

112 TFA Attestation Lifecycle Group 0) Foreign Schools and DeVry Group 1) DC, DE, MD, VA and WV Group 2) NC, NJ, NY and SC Group 3) KY, MI, NE, NH, OH, PA, RI, and VT Group 4) CA and FL Group 5) AK, ID, MN, ND, OK, OR, SD, TX Group 6) AR, CO, GA, KS and MO Group 7) AZ, CT, IA, IL, IN and LA Group 8) AL, HI, MA, ME, MS, TN, AS,FC,FM, GU, MH and MP Group 9) MT, NM, NV, UT, WA, WI, WY, PW and PR 9

113 TFA -Token Deployment Forecast As of 8/17/2012 Group State Initial Estimated Schools/Users Estimated Completion Lockout Date Revised Lockout Date Attestation Completed Group State Initial Estimated Schools/Users Estimated Completion Lockout Date Revised Lockout Date Attestation Completed FS DeVry DC DE MD VA WV NC NJ NY SC KY MI NE NH OH PA RI VT CA FL AK ID MN ND OR SD TX 3/ Schools 1,529 Users 3/ Schools 2,622 Users 3/ Schools 5,154 Users 3/ Schools 6,615 Users 3/ Schools 8,155 Users 3/ Schools 5,740 Users 10/30/ /30/2011 2/27/2012 6/8/2012 3/16/2012 6/8/2012 4/20/2012 7/20/2012 5/25/2012 8/3/2012 6/29/2012 8/17/ /30/ Schools ( 1,444 ) Users 6/8/ Schools ( 2,913 ) Users 6/8/ Schools ( 4,791 ) Users As of 8/17/2012 ( 788 ) Schools ( 6,360 ) Users As of 8/17/2012 ( 513 ) Schools ( 5,524) Users As of 8/17/2012 ( 469 ) Schools ( 3,852 ) Users AR CO GA KS MO AZ CT IA IL IN LA AL AS FC FM GU HI MA ME MH MP MS TN MT NM NV PR PW UT WA WI WY 3/ Schools 6,122 Users 3/ Schools 7,158 Users 3/ Schools 3,362 Users 3/ Schools 3,470 Users 8/3/2012 8/17/2012 9/7/ /23/ /12/ /23/ /16/ /23/2012 8/17/2012 ( ) Schools ( ) Users As of 8/17/2012 ( ) Schools ( ) Users 8/17/2012 ( ) Schools ( ) Users 8/17/2012 ( ) Schools ( ) Users 10

114 Attestation/Confirmation Process For each school, the Primary Destination Point Administrator (PDPA) and the COD Security Administrator need to work together to ensure all users have been identified and receive tokens Step 1: Confirmation/Attestation Confirm/Attest to the individuals (unique users) at your school who are authorized users of one or more of the identified Federal Student Aid systems. This confirmation will only be used to determine the TOTAL NUMBER of tokens you will receive Identify any Third Party Servicer(s) supporting your school Confirm the physical street address to which tokens should be shipped, and provide a telephone number where we can contact you NOTE: We cannot ship to PO Boxes 11

115 Attestation/Confirmation Process Step 2: Federal Student Aid Ships Tokens to School The tokens will be sent to the attention of the PDPA via UPS Step 3: Token Receipt, Distribution, and Registration After the tokens are shipped, FSA will send an e mail with more information about token distribution and registration The tokens are to be registered within 7 days of receipt 12

116 Attestation/Confirmation Process To expedite the attestation/confirmation process: Click reply to respond to the attestation message (Please do not change the subject line.) Example Subject Line: GR6 AR University Of Central Arkansas Attestation Required Complete the TFA Attestation form embedded in the attestation 13

117 Attestation/Confirmation Process Two Factor Authentication (TFA) Attestation Form Group State School Name OPEID(s) Total Tokens Required (unique users) PDPA Name (First, Last) PDPA PDPA Daytime Phone Physical Street Address Address Line 1 Address Line 2 City, State Zip Code Note: We cannot ship to Post Office Boxes Third Party Servicer (company name) Point of Contact Name Point of Contact Changes to Authorized Users Add / Delete Add / Delete Add / Delete Add / Delete (Insert additional rows if needed) Authorized User Name (First, Last) 14

118 How do I register my token? Once you receive your token you must register it once for the systems behind PM (NSLDS, CPS and SAIG/EDconnect) and once for each COD account. Each FSA System website will be slightly different when logging in and registering your token Next Steps: Click on the following link: Then click on the Register/Maintain token URL on the top right hand side of the screen. 15

119 TFA Registration Scenarios TFA Registration Scenario 1 John has access to NSLDS, CPS and SAIG. He will need to register his token only once. Participation Management (PM) NSLDS, CPS FFA, SAIG COD John Doe FSA user ID: John.Doe.FSA Token S/N: AVT N/A TFA Registration i Scenario 2 John has access to NSLDS, CPS and SAIG and has (1) COD user ID. He will need to register his token (2) times. Participation Management (PM) NSLDS, CPS FFA, SAIG COD John Doe FSA user ID: John.Doe.FSA Token S/N: AVT John Doe COD user ID: JDOE01 Token S/N: AVT

120 TFA Registration Scenarios TFA Registration Scenario 3 John has access to NSLDS, CPS and SAIG and has (3) COD user IDs. He will need to register his token (4) times. Participation Management (PM) NSLDS, CPS FFA, SAIG John Doe FSA user ID: John.Doe.FSA Token S/N: AVT COD John Doe COD user ID: JDOE01 COD user ID: JDOE02 COD user ID: JDOE03 Token S/N: AVT TFA Registration Scenario 4 John has access to COD and has (1) COD user ID. He will need to register his token only once. Participation Management (PM) COD NSLDS, CPS FFA, SAIG N/A John Doe COD user ID: JDOE01 Token S/N: AVT

121 TFA Registration Scenarios TFA Registration Scenario 5 John has access to COD and has (3) COD user IDs. He will need to register his token (3) times. Participation Management (PM) COD NSLDS, CPS FFA, SAIG N/A John Doe COD user ID: JDOE01 COD user ID: JDOE02 COD user ID: JDOE03 Token S/N: AVT

122 TFA Frequently Asked Questions Will I be locked out of FSA systems if I don t have a token? Once your school has been TFA enabled (locked) a token will be required to access FSA systems I received more tokens than I have authorized users. What do I do with the extra tokens? Each token shipment will include at least one (1) extra TFA token, for use as a replacement for a lost or broken token, or for issue to a new authorized user I need more tokens. How do I get them? For additional tokens please send an e mail to [TFA_Communications@ed.gov] We can only send tokens to the Primary DPA Do I need to provide tokens to my Third Party Servicer? No, however please indicate the name and point of contact if you have engaged a Third Party Servicer 19

123 Support Contacts Two Factor Authentication Questions: For general questions about TFA E mail: TFA_Communications@ed.gov Central Processing System Financial Aid Administrators (CPS FAA) Student Aid Internet Gateway (SAIG) Phone: / TTY E mail: CPSSAIG@ed.gov Website: FAA Access CPS Online ( National Student Loan Data System (NSLDS) Phone: E mail: nslds@ed.gov Common Origination and Disbursement (COD) Phone: COD School Relations Center (for Grants) Phone: COD Direct Loans E mail: CODSupport@acs inc.com Employee Enterprise Business Collaboration (EEBC) Support Hours: Monday Friday, 8 AM 5 PM Phone: E mail: eebcservicerequest@ed.gov ecampus Based (ecb) Support Hours: Monday Friday, 8 AM 8 PM Phone: E mail: cbfob@ed.gov E mail: secarch@ed.gov Website: The ecampus Based System ( 20

124 Contact Information We appreciate your feedback and comments. Please contact: Leslie A. Willoughby Phone: (202)

125 PII Updates Cheng Tang U.S. Department of Education 2012 Software Developers Webinar #3

126 Agenda FSA Strategic Security Plans PII Update Software Security Programming Security Input Validation References 2

127 FSA Strategic Security Plans TFA Identity Management Logging and Alerting Cloud 3

128 PII Update Keylogger trending downward Breaches trending upward Privileged accounts being secured by TFA Student accounts still using SSN/PIN 4

129 Software Security Common Application Vulnerabilities Input Validation XSS, CSRF, SQL Injection Hidden Variables Cookie Forgery Response Splitting Parameter Manipulation 5

130 Programming Security Input Validation Basics Client-side versus Server-side Decode Input Blacklist/Whitelist Validation Input Database Parameterization Encode/Escaping Output 6

131 References Secure Application Coding ention_cheat_sheet Sans.org training Privacy Breaches 7

132 Contact Information We appreciate your feedback and comments. Please contact me at: Cheng Tang Phone: (202)

133 Identity Management Warren Gordon U.S. Department of Education 2012 Software Developers Webinar #3

134 Four Phase Approach FSA has begun working on a 48 month Identity Management initiative. Addressed in four phases Each phase focused on delivering benefits to our privileged or nonprivileged user communities FSA s four phase approach: Phase One (privileged community) Reduce the number of identities privileged users have on FSA systems Provide reduced sign-on to our privileged user base Two step integration process FSA s Common Origination & Disbursement (COD) system will be integrated with:» Participation Management (PM)» Access & Identity Management System (AIMS) 2

135 Four Phase Approach Phase Two (non-privileged community) Migrate non-privileged users away from social security number and PIN requirement for login to FSA systems Provide standardized access framework utilizing username and passwords Phase Three (non-privileged community) Migrate non-privileged users away from social security number and PIN requirement for login to FSA systems Provide standardized access framework utilizing username and passwords Phase Four (privileged community) Migrate privileged users away from hardware to software based tokens. 3

136 EIMS - Timeline!Phase 1 (COD/PM/AIMS)! Modify PM March 2013! Move COD behind PM May 2013! Move COD behind AIMS (web service) May 2013!Phase 2A (Technical Proof of Concepts) / 2B (PIN System)! Project initiation October 2012! Project completion December 2013!Phase 3 (PRMS)! Project discovery/initiation October 2013!Phase 4 (Soft Tokens)! Project discovery/initiation January

137 EIMS - Four Phase Approach Phase I Phase II Phase III Phase IV COD/PM/AIMS Single/Reduced sign on for privileged users PIN SS# elimination, self service, internal federation PRMS Person Record Management Service SOFT TOKENS 12 months 24 months 36 months 48 months 5

138 Contact Information We appreciate your feedback and comments. Please contact me at: Warren Gordon Phone: (202)