1 Tuesday, August 16, 2005 W E B C A S T August 16, 2005 Policy Development Theory & Practice: An Emphasis on IT Pat Spellacy Director of Policy & Process Development University of Minnesota

Tuesday, August 16, University of Minnesota Policy office established September 1993 Have a policy & a process on developing policy Two policy templates (Regents & Administrative) Quarterly policy planning meetings U-wide Libraries cited as a past success Official web site:

Tuesday, August 16, The Association of College & University Policy Administrators Mission The mission of the group is explore both the "policy process" on college and university campuses as well as to discuss specific policy issues. The mission will be fulfilled through periodic meetings, special events, outreach activities and electronic communications among the membership. Members See the Members Directory on the ACUPA web site.

Tuesday, August 16, ACUPA Web Site

Tuesday, August 16, Policy: Is this it? Cartoon # 1– Just Guidelines?

Tuesday, August 16, Policy: Is this it? Cartoon #2: Guidelines too wishy-washy?

Tuesday, August 16, Policy: Is this it? Cartoon #3: Wally & Mordac

Tuesday, August 16, For Real - This is Policy What is a Policy? - They state an institutional position. - They describe mandates, community beliefs and boundaries. - They should include why and who. What is a Procedure? - They tell us how. - They often include who, what, when and where. - They are the customary or standard practice way of handling situations.

Tuesday, August 16, For Real - This is Policy Why Are Policies and Procedures Important? - They establish responsibilities and accountability. - They help ensure compliance and reduce institutional risk. - They may be needed to establish and/or defend a legal basis for action. - They provide clarification and guidance to the community.

Tuesday, August 16, Policy Definition References “A Framework for IT Policy Development” Hierarchy of Legal/Regulatory and Policy Authority (These Links are on the ACUPA web site)

Tuesday, August 16, Policy Development Process “Best Practices”

Tuesday, August 16, An Overview

Tuesday, August 16, Best Practices

Tuesday, August 16, Best Practices

Tuesday, August 16, Best Practices

Tuesday, August 16, U of M Policy Hierarchy  Federal Level (Constitution, Statutes, Regulations)  State Level (Charter for U of M (1851), Constitution (1857), Statute, Regulations)  Internal U Governance  Regents Bylaws  Regents Policies  U-wide or Faculty Senate Policy  Procedures - Action steps that tell how things are done  Standard - A level of quality that is required to be followed (supports policy/procedure)  Guideline - Provides optional guidance for action (supports policy/procedure)  Campus-wide  College Constitutions  College/Administrative Unit Policy  Department Policy URL -

Tuesday, August 16, U of M Policies Related to IT Acceptable Use of Information Technology Resources Accessibility of Information Technology Administration & Oversight for Protection of Individual Health Information (HIPAA) Creating and Revising U-Wide Forms Financial Data and Systems Security Including a Privacy Statement on U Web Pages Internal Access to University Information Participating in Discussions on the Portal Protection of Individual Health Information Protection of Individual Health Information by University Health Care Components (HIPAA) Public Access to University Information Publishing Information on the World Wide Web Use & Disclosure of Individual Health Information for Research Purposes (HIPAA) User Authentication for Access to University Computer Resources Using Communications Technology to Improve University Processes Using as Official Student Communication

Tuesday, August 16, U of M IT Standards & Guidelines Standards (A standard is a level of quality that requires conformity) Using Information Technology Resources Standards Wireless Access Point Technical Standards 3-02Wireless Access Point Technical Standards Anti-Virus Standards 4-02Anti-Virus Standards Secure Data Deletion Standard 6-03Secure Data Deletion Standard Security Patch Application Standard 1-04Security Patch Application Standard University Network Standards for Network Security & Operational Continuity 4-04University Network Standards for Network Security & Operational Continuity Information Technology Support Staffing Standard 4-04Information Technology Support Staffing Standard Securing Private Data Standard 10-04Securing Private Data Standard Guidelines (A guideline is recommended but optional behavior.) Critical Server Identification Guideline Windows 2000/XP Basic Desktop Security Guidelines University Network Management Guidelines 3-01University Network Management Guidelines Server Security Guidelines 12-03Server Security Guidelines Information Technology Support Guidelines 4-04Information Technology Support Guidelines Securing Microsoft Domain Controller Guideline 10-04Securing Microsoft Domain Controller Guideline

Tuesday, August 16, OIT Comments About Standards & Guidelines Permits OIT to react quickly Can use guidelines as a starting point that can change As time passes and comments are received, it may become a standard Avoids the longer policy development process IT people like this approach Faculty Senate Committee on IT very supportive of this method For questions contact: Ken Hanna Office of OIT Security U of Minnesota

Tuesday, August 16, End User Needs Web Browser Acrobat Reader Structure of U-Wide Policy Library

Tuesday, August 16, IT Role in Policy Development Own & maintain IT policies Be a resource for policies impacted by IT Help the institution develop/purchase/use software to manage policies See ACUPA article on Status of policy development “Exploring the Campus Policy Process”

Tuesday, August 16, Entering the Reality Zone

Tuesday, August 16, New ACUPA Web Site

Tuesday, August 16, ACUPA Web Page Features Case studies Tools for policy development (Templates, web sites & contacts) Article on policy development List of those willing to advise Other resource links

Tuesday, August 16, Case Studies

Tuesday, August 16, Those Willing to Help

Tuesday, August 16, Other Resources

Tuesday, August 16, Best Practice Examples Linked to the Policy Development Theory

Tuesday, August 16, Be proactive in issue identification - Join ACUPA 2. Identify an owner for each policy - UCLA - University of California, System Examples of Best Practices: Predevelopment

Tuesday, August 16, Determine the best “Policy Path” - Georgia Tech: Policy Process - Cornell University: Policy Process CFID=447932&CFTOKEN= CFID=447932&CFTOKEN= Assemble a team to develop policy Examples of Best Practices: Predevelopment

Tuesday, August 16, Agree on common definitions and terms - University of California, Berkeley - University of Minnesota - Levels and Definitions Use a common format - Arizona State University - University of Vermont Examples of Best Practices: Development

Tuesday, August 16, Obtain approval at owner and senior levels - Boston College - University of California, Berkeley Plan communication, publicity, and education - University of California, Davis - University of Minnesota Examples of Best Practices: Development

Tuesday, August 16, Put information online and accessible from one location - George Washington University - Indiana University Provide search capability - University of California, Davis - University of Tennessee TAL TAL30 Examples of Best Practices: Development

Tuesday, August 16, Develop a plan for active maintenance and review - University of Minnesota Encourage users to provide feedback - Arizona State University - UCLA Examples of Best Practices: Maintenance

Tuesday, August 16, Archive changes and date new releases with an “Effective Date” - James Madison University - University of Georgia Measure outcomes by monitoring or testing Examples of Best Practices: Maintenance

Tuesday, August 16, Successes and Benefits of Policy Process

Tuesday, August 16, University of Minnesota: Successes and Benefits 80% of Non-Regents policies formatted We can count our policies, forms & contracts (238, 476, 123) All policies have an owner People use the Policy Library (10,000 “hits” a month)

Tuesday, August 16, University of Minnesota: Successes and Benefits People see a managed policy development process Policy organization sets the stage for other improvements Financial One Stop website A “How To” for Financial tasks with links to policy, forms, contracts, tools, training, risks, audit results & more.