The Information Security Office (InfoSec) is responsible for coordinating the development and dissemination of information security policies, standards, procedures and guidelines for the University. InfoSec is also responsible for coordinating various regulatory compliance efforts. 

Policies:  High level statements, equivalent to organizational law, that drive decision making within the University. University policies are subject to a rigorous review process.

Standards:  Minimum requirements designed to address certain risks and specific requirements that ensure compliance with a policy or standard. These provide a basis for verifying compliance through audits and assessments. All units must meet the standards supporting the Information Security Policy and are encouraged to adopt local standards that exceed the minimum requirements.

Procedures:  Step-by-step instructions for accomplishing a task. Procedures published by Info Sec are designed to reinforce University policies. Procedures may also play an important role in maintaining compliance with regulations.

Guidelines:  General recommendations or instructions that provide a framework for achieving compliance with policies. They are more technical in nature than policies and standards and are updated on a more frequent basis to account for changes in technology and/or University practices.

• Information Security Policy
• Organization of Information Security
• Asset Management
• Human Resource Security
• Physical and Environmental Security
• Communications and Operations Management
• Access Control
• Information Systems Acquisition, Development and Maintenance
• Business Continuity Management
• Compliance
• Information Security Incident Management
• Risk Assessment

• Federal Policy/Statutes
• State and Local Statutes

Policy Framework