1. Policy Development at Georgetown: Directory Enabled Applications (and not) Charles F. Leonhardt leonhardt@georgetown.edu CSG Winter Meeting Sanibel Harbour, Florida January 11, 2002

2. Brief History  Seven Years Ago: No Formal IT Policies –University IT Functions too decentralized –Nine Internal Service Providers –Five, count ‘em, five “CIOs”  Burning Need for Acceptable Use Policy  One Year to Develop  One Year for Faculty Senate to debate and approve

3. The last 5 Years: many needs for new and revised policies  Computer Systems Acceptable Use Policy  More “global” policies, such as privacy and security  More “functional” policies such as domain naming (e.g. Upenn.georgetown.edu was requested!)  The major focus for today: Conducting Business over the Internet

4. Policy Overview  Computer Systems Acceptable Use Policy Approved: 1996 Application: Campus-wide Audience: all students, faculty, staff, affiliates, alumni Ancillary Policy: Policy For System and Network Administrators Action: needs review and revision in view of “Internet explosion” and new technologies

5. Policy Overview Related Policies (Global)  Privacy Policy Need to provide a University philosophy and umbrella policy to guide existing departmental privacy policies (Med School, Registrar, Registrar, Library, etc.) http://www.georgetown.edu/policy/privacy/ (out of date and needs revision)  Security Policy External auditor and Board of Directors mandated (being revised – a VERY long process)

6. Policy Overview Related Policies (Global)  Intellectual Property and Technology Transfer Revision under review  Electronic Resources Access Policy Who can use Georgetown’s online resources? In Development  Copyright Needs review and updating

7. Policy Overview Related Policies (Functional)  E-Mail retention policy Face the realities of purging email  Software Licensing and Acquisition Policy More formally prohibit software copying and support licensing  Naming policy Philosophy for naming subdomains, servers, etc.  Off-campus Equipment and Data Access companion to HR “work at home” policy

8. A New Policy Process  Articulate a clear, concise rationale for the establishment of the policy  Name a process owner  Establish the working group  Establish a timeline  Determine whether interim policy is needed  Establish the approval process  List all other (potentially) affected policies

9. Policies Done in 2001  Internet (Web) Business Policy –Philosophy –Guidelines for Departments Selling Goods and Services  Web Advertising Policy  E-Mail distribution policy –Voluntary and Involuntary mailing lists –An “interim” policy

10. Policy Development: 2002  Account Management  Directory and Attribute Use Policy –(e.g. Calculation of Primary Affiliation)  Identification & Authentication Policy –Very complex and urgently needed  Policies being contemplated: B2B Vendor Compliance Policy

11. A Common Solution?  We are not unique  Policy situations are not unique  A more formalized common repository of policy drafts for: –Directory driven applications –Cross-institution authentication and authorization –“Global” issues

12. More Information  University Policy Information: http://www.georgetown.edu/policy  Technology Policy Information: http://www.georgetown.edu/uis/policy  University Policy Search Engine: http://data.georgetown.edu/policy  Copies of Policy Drafts Not Yet Published: leonhardt@georgetown.edu