IT Development Initiative: Status & Next Steps Tom Jackson Vice Chancellor of Information Technology and Chief Information Officer Campus IT Forum November 28, 2018

Agenda IT Development Initiative Information Resources Inventory Data Governance and Resource Risk Classification Security Education Technology Update IT Audit Preparation Next Steps ncat.edu

IT Development Initiative

IT Development Initiative ISO Standard Policies, Operating Standards and Baseline Procedures Information Security Management Projects to address IT security Compliance Information Security Assessments Staffing and Organization Filling IT leadership positions Technology and staff consolidation ncat.edu

ISO Standard Governance Policies Operating Standards Enterprise Applications Governance formed Information Security Advisory Committee formed Information Security Incident Response Committee Academic/Client Advisory Committee to be formed Winter 2019 Policies Information Security Policy Updated November 16, 2018 Appropriate Use Policy adopted November 16, 2018 Operating Standards Incident Respond Standard developed and in use Access Control Standard developed Endpoint Security, Server Security and other standards under development ncat.edu

Information Security Management Projects Eleven (11) completed, thirty-two (32) in progress or pending Vulnerability Scanning Third scan in progress Scan results have identified remediation projects Remediation Projects Two (2) completed, five (5) in progress or pending Projects added as issues identified Penetration Testing Began in November ncat.edu

Completed Project Accomplishments Information Security Management Completed Project Accomplishments Security Projects Perimeter firewall upgrade Virtual Private Network (VPN) upgrade Core fiber loop Second NC-REN connection Craig Hall core switch migration Vulnerability Scanning Third scan in progress Remediation Projects CHHS server Employee Domain ncat.edu

In Progress Remediation Projects Security Education Information Security Management In Progress Remediation Projects Banner database security Wendover endpoints Campus A/V systems ITS servers Network Security Network switch upgrade Network Access Control (NAC) Network device configuration management software Security Education KnowBe4 Training Data Stewards Training Office 365 Multifactor Authentication ncat.edu

Compliance Resource Inventory Information Security Assessments Initial collection began with information security assessments Information Security Assessments Performed annually on each unit that manages technology First round Twelve (12) divisions and colleges assessed in 2018 Seven (7) divisions will be completed in January 2019 Assessments will flow into Information Security Program Reports and Roadmaps will provide guidance for compliance Information Technology Risk Assessment Spring 2019 ncat.edu

Information Security Assessments Conducted Compliance Information Security Assessments Conducted Athletics Bluford Library Business & Finance Enrollment Management Human Resources Information Technology Services Strategic Planning and Institutional Effectiveness Student Affairs College of Agriculture & Environmental Science College of Engineering College of Science & Technology Joint School of Nanoscience and Nanoengineering ncat.edu

Staffing and Organization Leadership Positions Filled Director, Client Technology Services Director, IT Project Management and Business Operations Director, Network and System Administration Hiring in Progress Associate Vice Chancellor for Data Governance and Business Intelligence Director, Enterprise Applications Associate Vice Chancellor for Information Technology and Deputy CIO ncat.edu

Staffing and Organization: Consolidation College of Health and Human Sciences Consolidation in progress File services migration Domain migration Workstations Consolidation pending Staff ncat.edu

Information Resources Inventory

Information Resources Inventory Data Hardware Software Must be maintained by division, college or department Provide regular updates to ITS Some inventory collected for information security assessments Remaining inventories to be collected Winter 2019 ncat.edu

Data Governance and Resource Risk Classification

Data Stewardship and Classification Data Governance and Resource Risk Data Stewardship and Classification Data Classifications Added to Information Security Policy Determine the risk level of resources Resource security based on risk Basic level for all resources Additional security for resources with confidential or sensitive data Standards Data Governance Risk Management Planned for Spring 2019 ncat.edu

Security Education

Training Mandatory for all employees Security Education Training Mandatory for all employees General training for all employees Specialized training System Administration Application Administration Data Stewardship KnowBe4 training software Begins in Winter 2019 ncat.edu

Technology Update

Technology Update Banner 9 Admin Pages in production Banner 9 Self Service starting Winter 2019 Banner Document Management in production in seven (7) departments Web Site redesign underway Planned go-live summer 2019 Network access layer upgrades Network Access Control (NAC) and configuration management Classroom and computer lab updates ncat.edu

IT Audit Preparation

Audit Preparation Identify risks Prioritized plan to address risks IT Audit Preparation Audit Preparation Identify risks Prioritized plan to address risks Show progress towards addressing risks ncat.edu

Identify Risks – Information Security Assessments IT Audit Preparation Identify Risks – Information Security Assessments Based on ISO 27002 international standard Resource Inventory Completed 12 Assessments, 4 pending Several Processes In Place Immature Need documentation Need addition staff training in processes ncat.edu

Next Steps

Next Steps Continue development of governance Continue creation of policies, standards and processes Complete first round of information security assessments Complete current projects Develop multi-year roadmap Finalize after division and department assessments Align with strategic plan and strategic priorities Align with enterprise risk management plan ncat.edu

IT Development Initiative Status and Next Steps Questions? ncat.edu