Presentation is loading. Please wait.

Presentation is loading. Please wait.

1 Tuesday, August 16, 2005 W E B C A S T August 16, 2005 Policy Development Theory & Practice: An Emphasis on IT Pat Spellacy Director of Policy & Process.

Published byGeraldine Lyons Modified over 8 years ago

Similar presentations

Presentation on theme: "1 Tuesday, August 16, 2005 W E B C A S T August 16, 2005 Policy Development Theory & Practice: An Emphasis on IT Pat Spellacy Director of Policy & Process."— Presentation transcript:

1 1 Tuesday, August 16, 2005 W E B C A S T August 16, 2005 Policy Development Theory & Practice: An Emphasis on IT Pat Spellacy Director of Policy & Process Development University of Minnesota p-spel@umn.edu

2 Tuesday, August 16, 2005 2 University of Minnesota Policy office established September 1993 Have a policy & a process on developing policy Two policy templates (Regents & Administrative) Quarterly policy planning meetings U-wide Libraries cited as a past success Official web site: www.fpd.finop.umn.edu/groups/ppd/documents/main/policyhome.cfm www.fpd.finop.umn.edu/groups/ppd/documents/main/policyhome.cfm

3 Tuesday, August 16, 2005 3 The Association of College & University Policy Administrators Mission The mission of the group is explore both the "policy process" on college and university campuses as well as to discuss specific policy issues. The mission will be fulfilled through periodic meetings, special events, outreach activities and electronic communications among the membership. Members See the Members Directory on the ACUPA web site. http://process.umn.edu/acupa/ http://process.umn.edu/acupa/

4 Tuesday, August 16, 2005 4 ACUPA Web Site

5 Tuesday, August 16, 2005 5 Policy: Is this it? Cartoon # 1– Just Guidelines?

6 Tuesday, August 16, 2005 6 Policy: Is this it? Cartoon #2: Guidelines too wishy-washy?

7 Tuesday, August 16, 2005 7 Policy: Is this it? Cartoon #3: Wally & Mordac

8 Tuesday, August 16, 2005 8 For Real - This is Policy What is a Policy? - They state an institutional position. - They describe mandates, community beliefs and boundaries. - They should include why and who. What is a Procedure? - They tell us how. - They often include who, what, when and where. - They are the customary or standard practice way of handling situations.

9 Tuesday, August 16, 2005 9 For Real - This is Policy Why Are Policies and Procedures Important? - They establish responsibilities and accountability. - They help ensure compliance and reduce institutional risk. - They may be needed to establish and/or defend a legal basis for action. - They provide clarification and guidance to the community.

10 Tuesday, August 16, 2005 10 Policy Definition References “A Framework for IT Policy Development” http://www.educause.edu/pub/er/erm04/erm0428.asp http://www.educause.edu/pub/er/erm04/erm0428.asp Hierarchy of Legal/Regulatory and Policy Authority http://www.fpd.finop.umn.edu/groups/ppd/documents/appendix/policyhierarchy.cfm http://www.fpd.finop.umn.edu/groups/ppd/documents/appendix/policyhierarchy.cfm (These Links are on the ACUPA web site)

11 Tuesday, August 16, 2005 11 Policy Development Process “Best Practices”

12 Tuesday, August 16, 2005 12 An Overview

13 Tuesday, August 16, 2005 13 Best Practices

14 Tuesday, August 16, 2005 14 Best Practices

15 Tuesday, August 16, 2005 15 Best Practices

16 Tuesday, August 16, 2005 16 U of M Policy Hierarchy  Federal Level (Constitution, Statutes, Regulations)  State Level (Charter for U of M (1851), Constitution (1857), Statute, Regulations)  Internal U Governance  Regents Bylaws  Regents Policies  U-wide or Faculty Senate Policy  Procedures - Action steps that tell how things are done  Standard - A level of quality that is required to be followed (supports policy/procedure)  Guideline - Provides optional guidance for action (supports policy/procedure)  Campus-wide  College Constitutions  College/Administrative Unit Policy  Department Policy URL - http://www.fpd.finop.umn.edu/groups/ppd/documents/appendix/policyhierarchy.cfm

17 Tuesday, August 16, 2005 17 U of M Policies Related to IT Acceptable Use of Information Technology Resources Accessibility of Information Technology Administration & Oversight for Protection of Individual Health Information (HIPAA) Creating and Revising U-Wide Forms Financial Data and Systems Security Including a Privacy Statement on U Web Pages Internal Access to University Information Participating in Discussions on the Portal Protection of Individual Health Information Protection of Individual Health Information by University Health Care Components (HIPAA) Public Access to University Information Publishing Information on the World Wide Web Use & Disclosure of Individual Health Information for Research Purposes (HIPAA) User Authentication for Access to University Computer Resources Using Communications Technology to Improve University Processes Using Email as Official Student Communication

18 Tuesday, August 16, 2005 18 U of M IT Standards & Guidelines Standards (A standard is a level of quality that requires conformity) Using Information Technology Resources Standards Wireless Access Point Technical Standards 3-02Wireless Access Point Technical Standards Anti-Virus Standards 4-02Anti-Virus Standards Secure Data Deletion Standard 6-03Secure Data Deletion Standard Security Patch Application Standard 1-04Security Patch Application Standard University Network Standards for Network Security & Operational Continuity 4-04University Network Standards for Network Security & Operational Continuity Information Technology Support Staffing Standard 4-04Information Technology Support Staffing Standard Securing Private Data Standard 10-04Securing Private Data Standard Guidelines (A guideline is recommended but optional behavior.) Critical Server Identification Guideline Windows 2000/XP Basic Desktop Security Guidelines University Network Management Guidelines 3-01University Network Management Guidelines Server Security Guidelines 12-03Server Security Guidelines Information Technology Support Guidelines 4-04Information Technology Support Guidelines Securing Microsoft Domain Controller Guideline 10-04Securing Microsoft Domain Controller Guideline

19 Tuesday, August 16, 2005 19 OIT Comments About Standards & Guidelines Permits OIT to react quickly Can use guidelines as a starting point that can change As time passes and comments are received, it may become a standard Avoids the longer policy development process IT people like this approach Faculty Senate Committee on IT very supportive of this method For questions contact: Ken Hanna Office of OIT Security U of Minnesota k-hann1@umn.edu 612-625-1505

20 Tuesday, August 16, 2005 20 End User Needs Web Browser Acrobat Reader Structure of U-Wide Policy Library

21 Tuesday, August 16, 2005 21 IT Role in Policy Development Own & maintain IT policies Be a resource for policies impacted by IT Help the institution develop/purchase/use software to manage policies See ACUPA article on Status of policy development “Exploring the Campus Policy Process” http://process.umn.edu/acupa/ http://process.umn.edu/acupa/

22 Tuesday, August 16, 2005 22 Entering the Reality Zone

23 Tuesday, August 16, 2005 23 New ACUPA Web Site

24 Tuesday, August 16, 2005 24 ACUPA Web Page Features Case studies Tools for policy development (Templates, web sites & contacts) Article on policy development List of those willing to advise Other resource links

25 Tuesday, August 16, 2005 25 Case Studies

26 Tuesday, August 16, 2005 26 Those Willing to Help

27 Tuesday, August 16, 2005 27 Other Resources

28 Tuesday, August 16, 2005 28 Best Practice Examples Linked to the Policy Development Theory

29 Tuesday, August 16, 2005 29 1. Be proactive in issue identification - Join ACUPA 2. Identify an owner for each policy - UCLA http://www.adminvc.ucla.edu/appm/_Responsible_Dept.asp - University of California, System http://www.ucop.edu/ucophome/coordrev/da/ http://www.adminvc.ucla.edu/appm/_Responsible_Dept.asp http://www.ucop.edu/ucophome/coordrev/da/ Examples of Best Practices: Predevelopment

30 Tuesday, August 16, 2005 30 3. Determine the best “Policy Path” - Georgia Tech: Policy Process http://www.oit.gatech.edu/inside_oit/directorates/PS/policy_dev_process.cfm - Cornell University: Policy Process http://www.policy.cornell.edu/CM_Images/Uploads/POL/pol_processmap.pdf? CFID=447932&CFTOKEN=25227860 http://www.oit.gatech.edu/inside_oit/directorates/PS/policy_dev_process.cfm http://www.policy.cornell.edu/CM_Images/Uploads/POL/pol_processmap.pdf? CFID=447932&CFTOKEN=25227860 4. Assemble a team to develop policy Examples of Best Practices: Predevelopment

31 Tuesday, August 16, 2005 31 5. Agree on common definitions and terms - University of California, Berkeley http://campuspol.chance.berkeley.edu/GlossaryofTerms.doc - University of Minnesota - Levels and Definitions http://www.fpd.finop.umn.edu/groups/ppd/documents/appendix/policyhierarchy.cfm http://campuspol.chance.berkeley.edu/GlossaryofTerms.doc http://www.fpd.finop.umn.edu/groups/ppd/documents/appendix/policyhierarchy.cfm 6. Use a common format - Arizona State University http://www.asu.edu/aad/manuals/cam/cam402-01.html - University of Vermont http://www.uvm.edu/%7Euvmppg/ppg/format.rtf http://www.asu.edu/aad/manuals/cam/cam402-01.html http://www.uvm.edu/%7Euvmppg/ppg/format.rtf Examples of Best Practices: Development

32 Tuesday, August 16, 2005 32 7. Obtain approval at owner and senior levels - Boston College http://www.bc.edu/offices/policies/meta-elements/doc/policies/I/1-125-001.shtml - University of California, Berkeley http://campuspol.chance.berkeley.edu/CampusReview.htm http://www.bc.edu/offices/policies/meta-elements/doc/policies/I/1-125-001.shtml http://campuspol.chance.berkeley.edu/CampusReview.htm 8. Plan communication, publicity, and education - University of California, Davis http://manuals.ucdavis.edu/ - University of Minnesota http://process.umn.edu/groups/ppd/documents/main/new.cfm http://manuals.ucdavis.edu/ http://process.umn.edu/groups/ppd/documents/main/new.cfm Examples of Best Practices: Development

33 Tuesday, August 16, 2005 33 9. Put information online and accessible from one location - George Washington University http://my.gwu.edu/mod/upolicy/ - Indiana University http://my.gwu.edu/mod/upolicy/ http://www.indiana.edu/~policies/ 10. Provide search capability - University of California, Davis http://manuals.ucdavis.edu/policysearch_vsearchform.cfm - University of Tennessee https://san4.dii.utk.edu/servlet/page?_pageid=2648&_dad=portal30&_schema=POR TAL30 http://manuals.ucdavis.edu/policysearch_vsearchform.cfm https://san4.dii.utk.edu/servlet/page?_pageid=2648&_dad=portal30&_schema=POR TAL30 Examples of Best Practices: Development

34 Tuesday, August 16, 2005 34 11. Develop a plan for active maintenance and review - University of Minnesota http://process.umn.edu/groups/controller/documents/main/libmaint_home.cfm http://process.umn.edu/groups/controller/documents/main/libmaint_home.cfm 12. Encourage users to provide feedback - Arizona State University http://www.asu.edu/aad/manuals/feedback.html - UCLA http://www.adminvc.ucla.edu/appm/appm_feedback.html http://www.asu.edu/aad/manuals/feedback.html http://www.adminvc.ucla.edu/appm/appm_feedback.html Examples of Best Practices: Maintenance

35 Tuesday, August 16, 2005 35 13. Archive changes and date new releases with an “Effective Date” - James Madison University http://www.jmu.edu/JMUpolicy/datelist.shtml - University of Georgia http://www.busfin.uga.edu/manual/ http://www.jmu.edu/JMUpolicy/datelist.shtml http://www.busfin.uga.edu/manual/ 14. Measure outcomes by monitoring or testing Examples of Best Practices: Maintenance

36 Tuesday, August 16, 2005 36 Successes and Benefits of Policy Process

37 Tuesday, August 16, 2005 37 University of Minnesota: Successes and Benefits 80% of Non-Regents policies formatted We can count our policies, forms & contracts (238, 476, 123) All policies have an owner People use the Policy Library (10,000 “hits” a month)

38 Tuesday, August 16, 2005 38 University of Minnesota: Successes and Benefits People see a managed policy development process Policy organization sets the stage for other improvements Financial One Stop website A “How To” for Financial tasks with links to policy, forms, contracts, tools, training, risks, audit results & more. http://process.umn.edu/groups/controller/documents/main/osf_home.cfm http://process.umn.edu/groups/controller/documents/main/osf_home.cfm

Download ppt "1 Tuesday, August 16, 2005 W E B C A S T August 16, 2005 Policy Development Theory & Practice: An Emphasis on IT Pat Spellacy Director of Policy & Process."

Similar presentations

Policy Development: In Theory and Practice

Policy Development: In Theory and Practice
How Will it Help Me Do My Job?

How Will it Help Me Do My Job?
Is your institution in control? Internal Control, Standard Operating Procedures and the Policy Process T. Michael Ford, Special Assistant to the VP&CFO.

Is your institution in control? Internal Control, Standard Operating Procedures and the Policy Process T. Michael Ford, Special Assistant to the VP&CFO.
Nancy Capell Univ. of California, Office of the President T. Michael Ford Indiana University Institutional Policy Development: Effective Practices and.

Nancy Capell Univ. of California, Office of the President T. Michael Ford Indiana University Institutional Policy Development: Effective Practices and.
Darton College Information Systems Use Policies. Introduction Dartons Information Systems are critical resources. The Information Systems Use Policies.

Darton College Information Systems Use Policies. Introduction Dartons Information Systems are critical resources. The Information Systems Use Policies.
Defining the Security Domain Marilu Goodyear John H. Louis University of Kansas.

Defining the Security Domain Marilu Goodyear John H. Louis University of Kansas.
USG INFORMATION SECURITY PROGRAM AUDIT: ACHIEVING SUCCESSFUL AUDIT OUTCOMES Cara King Senior IT Auditor, OIAC.

USG INFORMATION SECURITY PROGRAM AUDIT: ACHIEVING SUCCESSFUL AUDIT OUTCOMES Cara King Senior IT Auditor, OIAC.
Information Risk Management Key Component for HIPAA Security Compliance Ann Geyer Tunitas Group 209-754-9130

Information Risk Management Key Component for HIPAA Security Compliance Ann Geyer Tunitas Group
NAU HIPAA Awareness Training

NAU HIPAA Awareness Training
Salome Heyward & Associates Conference Services Program Accessibility And Emerging Technology April 21 - 22, 2014 Presented by Salome Heyward, JD Program.

Salome Heyward & Associates Conference Services Program Accessibility And Emerging Technology April , 2014 Presented by Salome Heyward, JD Program.
Strategies for Crafting Effective IT Security Policies CIO Forum March 12, 2003 Dennis Maloney & Marin Stanek The University of Colorado at Boulder.

Strategies for Crafting Effective IT Security Policies CIO Forum March 12, 2003 Dennis Maloney & Marin Stanek The University of Colorado at Boulder.
Guide to Massachusetts Data Privacy Laws & Steps you can take towards Compliance.

Guide to Massachusetts Data Privacy Laws & Steps you can take towards Compliance.
Network Redesign and Palette 2.0. The Mission of GCIS* Provide all of our users optimal access to GCC’s technology resources. *(GCC Information Services:

Network Redesign and Palette 2.0. The Mission of GCIS* Provide all of our users optimal access to GCC’s technology resources. *(GCC Information Services:
Security Controls – What Works

Security Controls – What Works
Information Security Policies and Standards

Information Security Policies and Standards
CST 481/598 x.2.  Broad overview of policy material  What is a “process”  Tiers (not tears) Many thanks to Jeni Li.

CST 481/598 x.2.  Broad overview of policy material  What is a “process”  Tiers (not tears) Many thanks to Jeni Li.
August 9, 2005 UCCSC -- 2005 IT Security at the University of California A New Initiative Jacqueline Craig. Director of Policy Information Resources and.

August 9, 2005 UCCSC IT Security at the University of California A New Initiative Jacqueline Craig. Director of Policy Information Resources and.
Data Management Awareness January 23, 2008 1 University of Michigan Administrative Information Services Data Management Awareness Unit Liaisons January.

Data Management Awareness January 23, University of Michigan Administrative Information Services Data Management Awareness Unit Liaisons January.
University of California, Davis1 Draft Wireless Network Policy Administrative Computing Coordinating Council September 10, 2001.

University of California, Davis1 Draft Wireless Network Policy Administrative Computing Coordinating Council September 10, 2001.
Information Resources and Communications University of California, Office of the President UCTrust Implementation Experiences David Walker, UCOP Albert.

Information Resources and Communications University of California, Office of the President UCTrust Implementation Experiences David Walker, UCOP Albert.

Similar presentations

Ads by Google