1. CSG Meeting, January 12, 2016

2. 2016 Top 10 Strategic Technologies

3. Enhance ability to detect sensitive data stored on servers not designed to protect sensitive data.

4. Deploy of full commercial Security Information and Event Management System

5. 2016 Top 10 Strategic Technologies Citation: Grajek, Susan. Higher Education’s Top 10 Strategic Technologies for 2016. Research report. Louisville, CO: ECAR, January 2016. Available from http://www.educause.edu/ecar.

6. Deploy (more) multi-factor authentication for all users

7. Deploy (more) multi-factor authentication for users who access other people’s sensitive data

8. Security Metrics Citation: Grama, Joanna L., and Leah Lang. CDS Spotlight: Information Security. Research bulletin. Louisville, CO: ECAR, July 3, 2015. Available from http://www.educause.edu/ecar.

9. Enhance web application vulnerability scanning

10. Routine vulnerability scanning of network devices

11. Training and Awareness Citation: Grama, Joanna L., and Leah Lang. CDS Spotlight: Information Security. Research bulletin. Louisville, CO: ECAR, July 3, 2015. Available from http://www.educause.edu/ecar.

12. Enhance or make mandatory annual security awareness training

13. CISO Role Citation: Grama, Joanna L., and Leah Lang. CDS Spotlight: Information Security. Research bulletin. Louisville, CO: ECAR, July 3, 2015. Available from http://www.educause.edu/ecar.

14. Where Does the Person with Primary Infosec Responsibility Report? Citation EDUCAUSE Center for Analysis and Research, 2015 Strategic Information Security Issues Infographic. Louisville, CO: ECAR, April 24, 2015. Available from http://www.educause.edu/library/resources/2015-strategic- information-security-issues-infographic

15. Where does the CISO report?

16. 2016 ECAR CISO Research A sneak peak at demographics from our forthcoming research:  The average age of CISOs is 47.  Three quarters of CISOs are men.  CISOs are employed in nearly equal numbers at private institutions and public institutions.  A majority of CISO positions (87.50%) are located in Central IT units.  Two thirds of CISOs came to their current position from within higher education. Of those that came from higher education, 81% were hired within their current institution.  About one third were hired into a newly created role. Citation: EDUCAUSE Center for Analysis and Research, unpublished data from forthcoming 2016 research on the IT Workforce.

17. 2016 ECAR CISO Research A sneak peak at CISO KSAs from our forthcoming research:  CISO education levels are:  Bachelor’s degree (53%)  Master’s degree (34%)  Doctorate or other terminal degree (8%)  The top three contributors (or potential contributors) to CISO professional growth are 1.attending conferences focused on higher education IT 2.engaging in informal peer networking 3.engaging in formal peer networking.  The top three most important skills for CISO success are 1.the ability to communicate effectively, 2.strategic thinking and planning 3.the ability to manage complex projects and the ability to manage other relationships within one’s own institution (TIE). Citation: EDUCAUSE Center for Analysis and Research, unpublished data from forthcoming 2016 research on the IT Workforce.

18. Where does the IT Risk Management program report?

19. Who Leads the IT Risk Management Program? Citation: Bichsel, Jacqueline, and Patrick Feehan. Getting Your Ducks in a Row: IT Governance, Risk, and Compliance in Higher Education. Research report. Louisville, CO: ECAR, June 2014. Available from http://www.educause.edu/ecar.

20. Where Does the IT Risk Management Lead Report? Citation: Grajek, Susan. Higher Education’s Top 10 Strategic Technologies for 2016. Research report. Louisville, CO: ECAR, January 2016. Available from http://www.educause.edu/ecar.