Robert Walker, Interim CIO, and Conal Larkin, Director of ITS will be jointly responsible for the corrective action plan.
1. Complete annual risk assessments including these areas of focus, with the status of each item reported collectively to the Executive Council immediately following the assess...
Robert Walker, Interim CIO, and Conal Larkin, Director of ITS will be jointly responsible for the corrective action plan.
1. Complete annual risk assessments including these areas of focus, with the status of each item reported collectively to the Executive Council immediately following the assessment:
a. Security policies and procedures
b. Incident-response procedures
c. Disaster recovery and business continuity plans
d. Network security controls
e. Identity and access controls
f. Media protection
g. Physical security of IT assets
h. Physical security of hard copy documentation
i. User education and awareness
j. Third-party security (vendors/suppliers/outsourcing)
2. Create draft Vendor Management policy and procedure
3. Continue to use Jamf to manage Apple mobile devices; continue to restrict Windows mobile devices to segmented network with internet access only; continue to not allow any mobile device to be joined to the domain
4. Create draft Disaster Recovery Plan and Business Continuity Plan
5. Forward following draft policies for approval: Outsourcing, Secure Authentication and Responsible Use, Security Awareness Training, Third party Connection, Remote Access, Information Security, Email, Wireless Access, Backup, Password, and Mobile Device
The Vice President of Academic Affairs, Controller and Vice President of Administrative & Financial Affairs shall review and approve the Corrective Action Plan and all revised or new policies shall be reviewed and approved by the Executive Council and the Board of Trustees no later than August 16, 2024.
Implementation deadline: 8/16/24