Call to Order and Approval of Minutes
- Tom Davis called meeting to order and introduced guests.
- Motion to receive and approve minutes as distributed was approved.
Old Business and New Business
- Merri Beth Lavagnino gave update on domain revisions and gap prioritization up through Domain 7 and suggested edits up through Domain 10. We are making plans/thinking of how to publicize the program next year; possibly a domain each month for 2012. Hagen and McCourt remarked that we should consider starting at the very beginning with communication on the program (i.e. the basics) such as, “why has this been developed,” “what is a domain,” etc.
- Policy Web Site and Policy Advisory Council - Jenny Kincaid gave an update on and tour of the web test site that will house all university policies (under construction/development, see - http://webtest.iu.edu/~policies/index.shtml). Policies are organized by category. Each policy will have a 2-line summary. Users will be able to search by policy category, A-Z (i.e. title, number, or keyword), and see the most popular policy searches. It is expected that the 2-line summaries will be helpful. Kincaid estimated there are around 400+ current policies. McCourt asked how policies are sorted in sector view. Kincaid said organizations/sectors can determine how the policies are sorted. McCourt pointed out that are there maybe 20 or so policies that everyone needs to know about. How can we communicate what people need to know? Lambright asked if we are planning to link to Foundation Policies? Kincaid – yes, we can put that in whatever appropriate place we decide. Currently the Foundation policies are behind authentication. Lambright – maybe link from resources with a parenthetical that says, “authentication required”. McCourt praised the format and layout as easy to navigate. Kincaid also gave an update on the activities of the Policy Advisory Council (PAC). It is composed of reps from each vice president’s organization and each campus as well as faculty. They expect to meet quarterly (met 3 times in 2011). The PAC is also working with the Faculty Administrative Burden Task Force. It is expected to be a good forum for feedback on policies. Davis has noticed some overlap between groups that review policies of various sectors, but some unique groups for specific sectors, how will the PAC help with this process? Kincaid said that this is something the PAC could put on their list of topics to address. Thus far, the PAC has been running policies for review through their OnCourse group.
- Identity and Access Management – Jacob Farmer gave an overview of the Identity and Access Management Function as additional context for the program domain most related to this area, Domain 8. The areas of Domain 8 that Identity and Access Management is most involved with are Business Requirements for Access Control, User Access Management, Operating System Access Control, and Application and Information Access Control. His group (Identity Management Systems Team) is involved in the account creation process and providing self-service for passphrase changes/forgotten passphrase reset. Hagen said there have recently been instances where different areas express difficulty with the time it takes to get a new account. McCourt added that in the revenue world, you can’t process revenue until you’ve had certain training, but you can’t take training until you have an account. Hagen asked what about new employees including I-9s, signing up for direct deposit, etc. Farmer pointed out that there are 4 routes to getting accounts at IU – employees (faculty & staff), students, alumni, and affiliates. The processes for Affiliates and Alumni are fairly straightforward and lightweight. With respect to employees, a key event is making sure they’re in the HR system. Then, after accounts are created, they have to get access to the various systems to which they need access. McCourt – what about people who graduate and retire, is the account changed? Farmer said that retirees are treated largely as employees (fairly seamless process). Students who graduate transition to former student, and eventually a pure alumni status over a period of 5 yrs. Students get their full blown access as soon as they register for classes, although they can create lightweight accounts earlier than that. So, for RPS, if they’re student employees, and if they stay on top of their account creation process, it’s not expected that a delay in having their account should be a problem because there’s a need for them to have an account (for academic purposes) much sooner than RPS would need it. Employees are a different situation. The triggering event is a hire edoc. Based on when the edoc is entered and when the effective dates are set you can get some users who have their account comfortably a week or so before they start, and you can get other users who, because there’s a delay in paperwork processing, end up being here 3 wks before we, as an identity group, are aware of their employee status. So, it appears to be a front end issue. The majority of people are able to create their accounts on day one in most units. It’s usually found to be a business process breakdown. Where the majority of the delay currently occurs is after the account is created – i.e. the time it takes to grant the new employee access to the various systems they need. Rives pointed out that HRMS was setup to allow hiring people into the future. Therefore, future date of hire is allowed. Not everyone makes use of it, so we have a number of “retro-hires” – individuals processed retroactively. Farmer pointed out that the role-based access project should improve the process as well. Looking forward, we may/probably get to a point where we never delete an account. Therefore we should plan to get to a point where we’re more rapid and rigorous about changing access privileges when roles change.
Domains 8, 9, and 10 - Review and Prioritization of Gaps
Davis called for other comments on these domains. None. McCourt remarked that it’s difficult to prioritize gaps when it’s not your area. Lavagnino assured the council that we want the perspectives of everyone given their respective areas of interest, so don’t sweat it! You’re doing great! It has already been a huge help. Domain Gap prioritization exercise – council members paired up for 5-10 min. to discuss the domain gaps they came up with and to identify the top 3 gaps. The results were turned in and will be compiled. The gaps list will be ongoing, and exercises like this will help us prioritize our work to address the gaps.
Domain 11 Overview - Business Continuity Management
- Kim Milford gave overview of the domain including a discussion of the domain’s objectives.
- Mary Lou East-Emmons provided additional detail/comments about her area/team. The IU Ready continuity planning tool is a questionnaire type tool. East-Emmons’ team is asking departments/units/divisions to identify a contact in their unit for training. In last 6 months they have trained about 275 people on basic business continuity concepts and the continuity tool. McCourt asked if there are any plans for an unannounced “emergency” day. East-Emmons said that by July 2012, we’d like to see everyone have a plan in place. Testing is expected to be part of the process. Rives asked about the different “tiers” used by the system. East-Emmons explained that Tier 1 functions must come back immediately. Tier 2 functions are needed within 48 hrs to a week. Tier 3 functions are needed within 30 days. Tier 4 functions are nonessential during an incident. These tiers, or priorities, may also vary based on the academic/operational calendar. Bruhn pointed out that different tiers can be assigned to different people/functions within a unit. Rives pointed out that there are also a lot of interrelationships. As an example, interconnectivity between university HR and IUPUI HR. East-Emmons said that they’ve received a lot of comments/requests related to university-wide services. Davis pointed out the tie-in with UITS institutional systems as well. UITS is going through a prioritization process currently. Bruhn pointed out that it’s sometimes difficult to do actual, physical exercises, so sometimes these will be table-top type exercises. Milford suggested “testing” as a potential gap for this domain. Lavagnino asked who constitutes a ‘department’ relative to our interest in communicating about the IS&P Program. East-Emmons team has an extensive tracking sheet of business continuity coordinators (and alternates) that could serve as contacts for program communications.
Domain 12 Overview - Compliance
Lavagnino gave quick overview of Domain 12 including its objectives and expectations. The domain has been reformatted into chart format.
Recap of Council Accomplishments
- Davis and Lavagnino recapped. The goal has been to get through all 12 domains and we’re almost there. Gap prioritization has already been a significant help. This is providing the kind of governance/oversight the university needs in this area. After finishing domains 11 and 12 in January, we’ll start communicating and addressing gaps.
- Please submit any feedback you may have.
Meeting Information
Date
December 11, 2011
Time
9-11am
Location
Poplars 017
Attendees
In Person
Tom Davis (Chair)
Merri Beth Lavagnino (Co-Chair)
Joan Hagen
Dan Rives
Mary Frances McCourt
Kim Milford
Chris Viers
Mark Bruhn (guest)
Jacob Farmer (guest)
Jenny Kincaid (guest)
Mary Lou East-Emmons (guest)
Eric Cosens (staff)
Scott Wilson (staff)
Via video
Marsha Gonzales
Philip Cochran
Via Audio/phone
Jeff Lambright
Absent
Joe Scodro
Jim Kennedy
Mike Gardner
Doug Wasitis