IT Development Initiative: Status and Next Steps Tom Jackson Vice Chancellor of Information Technology Services and Chief Information Officer May 1, 2018 Campus Presentation

Agenda Status Operating Standards Information Resources Inventory IT Development Initiative Status and Next Steps Agenda Status Operating Standards Information Resources Inventory Data Stewardship and Classification Information Security Program Training Timeline

IT Development Initiative Status

IT Development Initiative IT Development Initiative Status and Next Steps IT Development Initiative ISO Standard Policies, Operating Standards and Baseline Procedures Information Security Management Several projects related to IT security Compliance Information Security Assessments Organization Filling IT leadership positions and consolidation of technology and staff

ISO Standard Status Governance Policies Operating Standards IT Development Initiative Status and Next Steps ISO Standard Status Governance Information Security Advisory Committee formed Information Security Incident Response Team formed Policies Information Security Policy approved and effective April 30th, 2018 Acceptable Use, Data Stewardship and Email polices under development Operating Standards Seven (7) standards under development Includes Windows Server, Windows Desktop, Linux Server, Macintosh Desktop

Information Security Management Status IT Development Initiative Status and Next Steps Information Security Management Status Initial Projects Fourteen (14) projects underway Vulnerability Scanning Third scan underway Reviewing results to identify remediation projects Remediation Projects First remediation project underway Projects will be identified and executed throughout the summer

Compliance Information Security Assessments IT Development Initiative Status and Next Steps Compliance Information Security Assessments Performed annually on each unit that manages technology Information Technology Services assessment will occur first, in Summer 2018 Other divisions and colleges will be assessed Summer and Fall 2018 Assessments will flow into Information Security Program Information Technology Risk Assessment Will occur late Fall 2018

Organization Status Search Firm Interviews Filled Deputy CIO IT Development Initiative Status and Next Steps Organization Status Search Firm Deputy CIO Associate VC Data Governance Director, Enterprise Applications Interviews Director, Network and Systems Filled Director, Client Technology Director, IT Project Management and Business Operations Interim Director, Network and Systems

Operating Standards

Operating Standards Expansions of the Information Security Policy IT Development Initiative Status and Next Steps Operating Standards Expansions of the Information Security Policy More technical details Prescriptive Auditable Reduce risk Exemptions Must include justification Approved by division or college leadership Approved by ITS Require alternative controls

Operating Standards Partial List IT Development Initiative Status and Next Steps Operating Standards Partial List Windows Server Windows Desktop/Laptop Linux Server Macintosh Desktop/Laptop Authentication Access Control Application Administration Incident Response Mobile Device Management Network Device Configuration Perimeter Security Software Development

Operating Standards Rolled out during Summer 2018 IT Development Initiative Status and Next Steps Operating Standards Rolled out during Summer 2018 May lead to remediation projects Projects must be completed by Fall 2018

Information Resources Inventory

Information Resources Inventory IT Development Initiative Status and Next Steps Information Resources Inventory Resources Data Hardware Software Inventory Must be maintained by division, college or department ITS has collected some data on hardware More details forthcoming Must be completed during the summer

Data Stewardship and Classification

Data Stewardship and Classification IT Development Initiative Status and Next Steps Data Stewardship and Classification Additional policy To be completed during Summer 2018 Defines roles and responsibilities Data trustee Data steward Data custodian Data user Additional information forthcoming

Data Trustees Oversee data management and security Oversee policy IT Development Initiative Status and Next Steps Data Trustees Oversee data management and security Oversee policy Oversee compliance

IT Development Initiative Status and Next Steps Data Stewards Ensure compliance with regulations, policies and agreements Ensure data governance and management practices are followed Ensure proper access and security controls are implemented Ensure segregation of duties are implemented Ensure adequate data protection measures are implemented Ensure data is classified and inventoried

Data Custodians Grant access based on authority delegated from steward IT Development Initiative Status and Next Steps Data Custodians Grant access based on authority delegated from steward Manage operations and security Servers Applications

Information Security Program

Information Security Program IT Development Initiative Status and Next Steps Information Security Program Continuous Improvement Cycle Manage risk Manage and secure data Manage and secure technology Hardware Software Do Check Act Plan

Information Security Program IT Development Initiative Status and Next Steps Information Security Program Led by Information Security Advisory Committee Information Security Services Includes annual information security assessments Each office that manages information resources Compliance with policy, standards and procedures Identifies risks and vulnerabilities Outcomes are prioritized to be addressed

Training

Training Mandatory General training for all employees IT Development Initiative Status and Next Steps Training Mandatory General training for all employees Specialized training System Administration Application Administration Data Stewardship Begins in Fall 2018

Timeline

Timeline May – Initial operating standards review IT Development Initiative Status and Next Steps Timeline May – Initial operating standards review Vulnerability scanning review June – Initial operating standards rollout to campus Additional operating standards development begins Remediation project planning Address operating standard compliance Address vulnerabilities Remediation projects begin Inventory begins

Timeline July – Remediation projects continue IT Development Initiative Status and Next Steps Timeline July – Remediation projects continue ITS information security assessment Additional division or college information security assessments August – Remediation projects continue Additional policies approved September – Remediation projects continue

IT Development Initiative Status and Next Steps Questions ?