The Policy Review Committee convened for its monthly meeting on September 15 at 10 am via Zoom.
Office Updates
Matthew Teal, interim Associate Director of the Office and Ethics and Policy introduced Craig Johnston to the PRC. Craig is a temporary employee who is doing great work supporting the Office of Ethics and Policy. We are thrilled to have him. Welcome, Craig!
Information Technology Services Policy Updates
Kim Stahl, Senior Policy and Process Lead in Information Technology Services, updated the PRC on the Onyen Policy, the Information Classification Standard, and the new Information Security Incident Management Standard. The Onyen Policy and the Information Classification Standards were changed to allow for the creation of Onyens in short-notice situations and to clarify data classification processes, respectively.
Kim also debuted the Security Incident Management Standard to streamline the incident reporting structure. When published, this Standard will replace the Incident Management Policy, Incident Management Procedure, and the Payment Card Industry Data Security Standards (PCI DSS) Response Plan. This Standard is not ready for publication yet but should be finalized in the coming months as Kim gathers more feedback.
“Incident Management” in University Policy
Finally, Kim raised the point that many University policies discuss “incidents” and how various campus units both define and respond to “incidents” in their respective policies. Kim clarified that using the same word differently in different policies is normally fine as long as each policy document clearly defines the term and so clarifies how the term is used in that document. However, having multiple meanings for “incident” can potentially create problems in ensuring the University properly addresses each situation and provides appropriate resources and support to those impacted by an event.
Matthew Teal asked that PRC members review their own campus unit’s policy documents and come to the October PRC meeting prepared to discuss potential solutions to resolve the issue.