Security Requirements for FTI Data

With the Consolidated Appropriations Act and 24/25 New Aid Year updates, Financial Aid applicants and their contributors can now consent to the use of Federal Tax Information, or FTI, to be transferred to schools via the Institutional Student Information Record (ISIR). Oracle Student Financial Aid ensures compliance with IRS Publication 1075 and strict FTI data requirements for storing, displaying, reporting, and how it is used in the calculation of Financial Aid. This includes incorporating required Controlled Unclassified Information (CUI) labeling for FTI whenever it appears in the user interface, logs, or reports. Additionally, the ISIR is stored in its original raw format within the system, complete with the necessary CUI labeling as transmitted by the Education Department (ED).

User Interface Updates

  • Any FTI Field displayed in the UI will be designated with a CUI label prior to the field value.  Example for Adjusted Gross Income - 'CUI//SP-TAX 50000'

New Security Permission

  • A new Security Permission named 'FTI Viewer' has been created to allow certain users and roles the ability to view highly restricted FTI data
    • If permission is given, user will be able to view all FTI fields labeled 'CUI//SP-TAX' within the ISIR and anywhere these values appear in the system
    • If permission is removed, any 'CUI//SP-TAX' values will only display the CUI label (CUI//SP-TAX) followed by Xs and will not display the actual FTI values

Configuration Updates

  • With the significant changes to the ISIR, SFA has created optimizations to configuration.  Instead of requiring a string, a type safe enum and data type will be defined for each field ensuring that the data being retrieved is provided in the expected format.  These formats will also include methods for retrieving FTI data.  Values are returned as a string in logs and will include the CUI labeling for all FTI Data.  For more information see the Optimized ISIR Configuration Feature.

Reporting Updates

  • New reporting views will be created to include ISIR data for 24/25 ISIRs and forward
    • Column names where the column contains FTI data will end with _FTI to denote the values in the column are FTI values and should be treated as restricted data
      • FTI Values within the column will not contain the CUI labeling, this was done in order to preserve the data types
    • Report writers should use a format function FASRPT.fasrpt_mv_util_pkg.format_fti in order to label FTI data outputs with CUI//SP-TAX prior to the value in any output.
      • Generic Example 
        • select   FASRPT.fasrpt_mv_util_pkg.format_fti('FIELD1_FTI', FIELD1_FTI) as FIELD1,     FASRPT.fasrpt_mv_util_pkg.format_fti('FIELD2_FTI', FIELD2_FTI) as FIELD2,     FASRPT.fasrpt_mv_util_pkg.format_fti('FIELD3_FTI', FIELD3_FTI) as FIELD3,  FASRPT.fasrpt_mv_util_pkg.format_fti('FIELD100_FTI', FIELD100_FTI) as FIELD100 from FASRPT.<view_name>;
      • Example using Reporting Views
        • select FASRPT.fasrpt_mv_util_pkg.format_fti('STUDENTFTIM_ADJUSTEDGROSSINCOME_FTI', a.STUDENTFTIM_ADJUSTEDGROSSINCOME_FTI) as AGI, from FASRPT.isir_fields_all_v2_vw a;
        • Value output on Report would = CUI//SP-TAX 9500
  • Product reports containing FTI data in the output will include an optional run parameter that will allow you to display or mask FTI data in the output 
    • If the report is run using the masked option, all FTI fields will display the CUI//SP-TAX label but will not contain the actual FTI field value
    • If the report is run without masking, the CUI//SP-TAX label will be present prior to the actual FTI value
    • Our product report data models for masking can be utilized if you would like the masking option present on any custom reports.

Letter Updates

  • If you want to display any FTI data on a custom letter, you will need to utilize the same FASRPT.fasrpt_mv_util_pkg.format_fti described in the reporting update to display the CUI//SP-TAX label in the field value.  If this function is not used in the letter query the CUI label will not be rendered on the letter.  

Integration Updates

  • The FasValidIsirProcessStatusInformationEvent and FasIsirInformationRequest Webservice Integration messages will now display they CUI//SP-TAX label in the field value for each FTI field being returned in the message.  
    • Example from the FasValidIsirProcessStatusInformationEvent
      • <IsirField>
      • <Number>863</Number>
      • <Name>Returned Tax Year</Name>
      • <Value>CUI//SP-TAX 2022</Value>
      • </IsirField>

Steps to Enable

Use the Opt In UI to enable this feature. For instructions, refer to the Optional Uptake of New Features section of this document.

Offering: Student Financial Aid

  • In order to view FTI data within the User Interface, an admin must assign the permission of FTI Viewer to any role where a user should be able to view this restricted data.
  • Report writers must use the FORMATFTI() in report and letter queries in order to correctly label FTI data in any outputs

Tips And Considerations

  • Our product reports containing FTI will have the ability run the report with either FTI data masked or unmasked.  If only certain members of your school should see the data unmasked, please copy our product reports to a separate folder and update the Data Model.  You can control access to individual reports and folders via permissions to control which users have the ability to see unmasked data.   For example, our Individual ISIR Report will contain the ability to run the report with a filter to mask the data.  This data model can be updated to only display masked fields and can be utilized to restrict users from access to FTI data. 

Key Resources