The Policy, Compliance, and Assessment Program provides the guidance for the creation and maintenance of Institute-wide information security policies, issue-specific policies, standards, and procedures. These documents are used for IT governance, risk management, and legal & regulatory compliance (e.g. FERPA, GLBA, HIPAA, PCI DSS, DFARS 7012/NIST 800-171).
Standards and safeguards are used to achieve policy objectives through the definition of mandatory controls and requirements.
Procedures are used to ensure consistent application of security policies and standards.
Guidelines provide guidance on security policies and standards.
Tools and forms related to these are also maintained here.
COVID-19 Remote Procedures:
Procedures:
- Business Continuity Requests
- Data Privacy Procedures
- Patch Management Procedure
- Third Party Security Procedures
- Export Control (ITAR, EAR, etc.)
- Incident Response Procedure
- Vulnerability Management Procedure
- Policy Exception Procedure
- PCI DSS Assessment Procedure
- DFARS 7012 System Security Plan (SSP) and Assessment Procedure
Standards:
- Approved Endpoint Software
- Data Protection Safeguards
- Data Protection Safeguards – Cloud Computing
- Data Protection Safeguards – Endpoints
- Data Protection Safeguards – Mobile Devices
- Data Protection Safeguards – Servers
- Data Categorization
- Encryption Standard
- Network Firewall Standards
- Terms of Use (login banner)
- SSH Server Standard
- Email Standard
- Web Server Standard
Guidelines:
Forms:
- Approved Change Request Form – OIT Software
- Approved Change Request Form – OS upgrades
- Change Request Form
- Key Log Form
- Third Party Security Questionnaire
- Visitor Log