This report presents an evaluation of the general controls over the Federal Family Education Loan Program (FFELP) information system maintained and operated by a contractor for the U.S. Department of Education (ED), which administers FFELP. The evaluation found that ED's general controls over the FFELP information system did not adequately protect sensitive data files, applications programs, and systems software from unauthorized access, change, or disclosure. ED, for example, did not: (1) adequately monitor the access activities of system users with special privileges that allow them to independently change the system; and (2) record and report and, thus, could not review, successful access to sensitive computer data and programs. Further, outside users could potentially bypass the system's access controls to gain access to the system. The report contains specific recommendations, many of which have already been implemented, to help improve the security of the FFELP information system. Two appendixes contain comments from ED and a list of contributors to the report. (MDM)