Executive Summary

An information security program (ISP) is designed to protect information resources from a wide range of threats, ensure business continuity, and minimize business risk to ²Ø¾«¸ó University and members of the ²Ø¾«¸ó community. Information resource security is achieved by implementing applicable policies, processes, procedures, controls, standards, guidelines, organizational structures, and supporting technology. The information security program (ISP) governs the confidentiality, integrity, and availability of ²Ø¾«¸ó data, especially highly sensitive or critical data, and defines the responsibilities of departments and individuals for such data.

Scope

This information security program applies to any person granted access to ²Ø¾«¸ó University information resources, including but not limited to students, faculty, staff, alumni, temporary employees, contractors, volunteers, friends of ²Ø¾«¸ó, and guests who have access to ²Ø¾«¸ó information resources. Such technology resources include but are not limited to data, images, text, recordings, and software which are stored on hardware or other digital storage media both on-campus and at outsourced locations.

Policy and Procedures

The following foundational elements are designed to create a framework for the information security program (ISP), help ²Ø¾«¸ó adopt a control catalog, and comply with best practices in Information Security.

Inventory and Accountability of Information Assets: ²Ø¾«¸ó collects, stores, and uses various data as part of normal operations. This information is stored in various systems that are inventoried and managed by the ²Ø¾«¸ó IT Enterprise team.
Sensitive Data Classification: Data classification is required to determine the relative sensitivity of information resources, which is the basis for protection and access control.
Data Risk Management: ²Ø¾«¸ó's risk management cycle includes assessment, review, mitigation, and reporting based upon the university’s risk tolerance.
Identity and Access Management: Ensures accurate identification of authorized users and provides access controls to the use of information resources.
Control Activity: Defined controls provide a system of checks and balances intended to identify irregularities, prevent abuse from occurring, and assist in resolving discrepancies that are introduced into the operation of the business.
IT Security Awareness: The goal of the information security awareness program is to strengthen the information security culture of ²Ø¾«¸ó through education, active learning, communication, and collaboration.
Physical Security: Physical security controls and secure areas are used to minimize unauthorized access, damage, and interference to information resources. This includes providing environmental safeguards and controlling physical access to equipment and ²Ø¾«¸ó data.
IT Contingency Planning: The ²Ø¾«¸ó IT contingency Plan is designed to minimize the impact of a disaster or disruptive incident on an organization's IT systems and operations, and to ensure that mission-critical functions can be quickly restored in the event of an outage or other disruption.
Security Incident Response: Effectively and efficiently handle and manage any security incidents that may occur within ²Ø¾«¸ó’s IT infrastructure.

Responsibilities and Enforcement

Vice President/Chief Information Officer (CIO): ²Ø¾«¸ó’s Chief Information Security Officer is responsible for overseeing the organization’s technology infrastructure and ensuring that it aligns with the business goals and objectives. The CIO will periodically present an update on the status of the ISP to the executive officers and the Board of Trustees.

Assistant Vice President for Information Technology (AVPIT): The AVPIT of ²Ø¾«¸ó is responsible for managing the day-to-day operations of the university’s IT systems. This includes ensuring that the ISP is properly implemented and maintained.

IT Governance Committee: Works in conjunction with the CIO and AVPIT to review and recommend university policies regarding information security.

Definitions

Access Controls: The process of controlling access to systems, networks and information based on business and security requirements of the user’s role within ²Ø¾«¸ó.

Risk Tolerance: ²Ø¾«¸ó’s willingness to accept risk by either accepting, transferring, or mitigating risk exposures.

Information Security Incident: An event that impacts or has the potential to impact the confidentiality, availability, or integrity of ²Ø¾«¸ó's information resources.

Additional Documents and Policies

Last revised: May 2023