Policy Development at Georgetown: Directory Enabled Applications (and not) Charles F. Leonhardt CSG Winter Meeting Sanibel Harbour, Florida January 11, 2002

Brief History  Seven Years Ago: No Formal IT Policies –University IT Functions too decentralized –Nine Internal Service Providers –Five, count ‘em, five “CIOs”  Burning Need for Acceptable Use Policy  One Year to Develop  One Year for Faculty Senate to debate and approve

The last 5 Years: many needs for new and revised policies  Computer Systems Acceptable Use Policy  More “global” policies, such as privacy and security  More “functional” policies such as domain naming (e.g. Upenn.georgetown.edu was requested!)  The major focus for today: Conducting Business over the Internet

Policy Overview  Computer Systems Acceptable Use Policy Approved: 1996 Application: Campus-wide Audience: all students, faculty, staff, affiliates, alumni Ancillary Policy: Policy For System and Network Administrators Action: needs review and revision in view of “Internet explosion” and new technologies

Policy Overview Related Policies (Global)  Privacy Policy Need to provide a University philosophy and umbrella policy to guide existing departmental privacy policies (Med School, Registrar, Registrar, Library, etc.) (out of date and needs revision)  Security Policy External auditor and Board of Directors mandated (being revised – a VERY long process)

Policy Overview Related Policies (Global)  Intellectual Property and Technology Transfer Revision under review  Electronic Resources Access Policy Who can use Georgetown’s online resources? In Development  Copyright Needs review and updating

Policy Overview Related Policies (Functional)  retention policy Face the realities of purging  Software Licensing and Acquisition Policy More formally prohibit software copying and support licensing  Naming policy Philosophy for naming subdomains, servers, etc.  Off-campus Equipment and Data Access companion to HR “work at home” policy

A New Policy Process  Articulate a clear, concise rationale for the establishment of the policy  Name a process owner  Establish the working group  Establish a timeline  Determine whether interim policy is needed  Establish the approval process  List all other (potentially) affected policies

Policies Done in 2001  Internet (Web) Business Policy –Philosophy –Guidelines for Departments Selling Goods and Services  Web Advertising Policy  distribution policy –Voluntary and Involuntary mailing lists –An “interim” policy

Policy Development: 2002  Account Management  Directory and Attribute Use Policy –(e.g. Calculation of Primary Affiliation)  Identification & Authentication Policy –Very complex and urgently needed  Policies being contemplated: B2B Vendor Compliance Policy

A Common Solution?  We are not unique  Policy situations are not unique  A more formalized common repository of policy drafts for: –Directory driven applications –Cross-institution authentication and authorization –“Global” issues

More Information  University Policy Information:  Technology Policy Information:  University Policy Search Engine:  Copies of Policy Drafts Not Yet Published: