Meeting Minutes for April 22, 2013

Call to Order and Approval of Minutes (5 Minutes)

• Personnel changes: Stew Cobine is replacing Mary Frances McCourt on the council. Eric Swank is now representing research in place of Marcia Gonzales. Merri Beth will be assuming role of Chief Risk Officer. Dan McDevitt is representing Jim Kennedy who could not attend.
• Minutes from January meeting approved as received.

Old Business and New Business

• CDS update (Eric C.) –The CDS recently implemented a new procedure for evaluating systems and applications using an institutional data standards checklist that is completed by the system owner and reviewed by the data stewards to determine the appropriate classification level for data stored/used in the system or application. It's still in the early stages but seems to be working well. The CDS has also been reviewing the definition of "institutional information" (see the current definition in http://policies.iu.edu/policies/categories/information-it/data-management/DM-01.shtml). The Data Stewards are also working with the CRM team to update, develop and implement policies and practices that impact CRM.
• Incident update (Eric C.) – In the first quarter of 2013, there were 10,469 incidents created and 9,730 resolved, compared to 6394 and 5095 from 1Q 2012. Most of these were found via automated scanning and detection systems and involved hosts that had been compromised. An increasing number of hosts are compromised as a result of application vulnerabilities. Fortunately, more people are running the application vulnerability scanning software to help catch these. There were 377 compromised accounts reported and 31 stolen computers.
• Program Update (Merri Beth):
  • We finished the “12 domains in 12 months” awareness campaign for IT Professionals, with the final video on “compliance” being done by Jackie Simmons.
  • Data Privacy Day (Jan. 28th)/Month – We had a session on Jan. 28th with presentations by Chuck Taylor from the Indiana Attorney General’s office on Identity Theft, and Eric Cosens on Mobile Device Security. We also promoted privacy-related webinars produced by EDUCAUSE throughout the month. See here: https://protect.iu.edu/privacy/training/dataprivacyday
• University Policy Web Site and/or Policy Advisory Council (PAC) update (Eric C.):
  • No significant updates regarding the Policy Web Site or the PAC.
  • However, Policy IT-28 Cyber Risk Mitigation Responsibilities has been a significant effort over the last few months. The policy was developed to help IU address cyber risk by encouraging units to leverage core IT infrastructure and services where practicable. There were reviews of two drafts. Based on feedback, the title was changed, the rationale was expanded significantly, levels of aggregation were clarified, the unique needs of academic units were recognized, the sanctions section was abbreviated, and a compliance deadline of 1 year was added. The second generation draft was shared with the Board of Trustees the week of April 15th. A small group/team is meeting to flesh out the implementation details. Update – OVPIT approved the policy on May 17th. See - http://policies.iu.edu/policies/categories/information-it/it/IT-28.shtml .
  • The council also asked about the status of the Mobile Device Security Standard IT-12.1 (https://protect.iu.edu/cybersecurity/policies/IT12/12.1 ). The Standard is now effective. A round of “public service” communications on mobile security was done prior to the standard being made effective. These communications included KB docs, a Protect.iu.edu rotator, Protect.iu.edu blog posts, an IU Mobile Security section, a piece in the Monitor, a piece provided to IT Professionals to raise awareness within their units, a press release was issued and picked up by the Herald Times, an article in Inside IU, a short piece in the Informed Employee, a Data Privacy Day Presentation, and also the review process itself. A more targeted communications campaign focused on the requirements of IT-12.1 is planned, but has not yet begun. Our intention is to increment the compliance dates in the standard forward when this second round of communications begins.
• Enterprise Governance Risk and Compliance system (E GRC) and Enterprise Training system (E Train) update (Merri Beth)
  • Three privacy training modules have been purchased and loaded into the E Training System. We intend to develop a plan for using them in conjunction with our next awareness effort. The E Training System is also being used by several units for their training. Access to the system has also been moved in Onestart to facilitate its use by students as well as employees.
  • Policy ISPP-27 Privacy Complaints was approved in November 2012. Merri Beth worked with privacy officials around the university to determine and communicate process/procedures to compliment ISPP-27. There was some discussion on how best to house/communicate cross-departmental procedures for internal use only.
  • The integration of the E GRC system with our people data, department chart/org data, and CAMS asset data had been on hold due to resources being consumed by the KFS implementation (which was also delayed). Started E GRC integration in March. There are 5 applications in the E GRC System. The ones related to the risk council are: a third party security assessment module, a compliance obligation module, a HIPAA security risk assessment module, a risk management module, and a computer/storage device retirement module.
• Chief Compliance Officer Overview (Marcia) – Marcia is the university’s new Chief Compliance Officer. The vision/approach is for the office to be a high-level, resource-based, advocacy office toward maintaining regulatory obligations at IU. Marcia is working to identify existing safeguards and resources. The goal is not to reinvent the wheel, but rather to coordinate and collaborate. The office will also work to create a culture of compliance through training and other means. Marcia is looking at how compliance, from an enterprise perspective, is being implemented at peer institutions.
• Chief Risk Officer Overview (Merri Beth) – Merri Beth is the university’s new Chief Risk Officer. Historically, some aspects of privacy had been added to the responsibilities of the UIPO. Merri Beth was then asked to do compliance coordination for the university (which led to the selection and acquisition of the E Training and E GRC systems). Coordination of enterprise risk management was then added to Merri Beth’s responsibilities as well. Kim Milford took over the University Information Policy Office while Merri Beth focused on building compliance and risk infrastructure (and privacy). Then the Freeh Report came out leading to unique officers for compliance, privacy, and risk. As Chief Risk Officer, Merri Beth’s main charge is to facilitate the enterprise risk management project/process. The university has been divided into 18 risk areas. Each area has one or more risk owners who do a high level, strategic risk assessment and make a risk report to the enterprise risk management committee. Each owner has thought this has been a valuable exercise, and the discussion of the committee has expanded the perspective of its members. The goal of this is to inform strategic planning. Merri Beth shared some examples of institutional risk.

Final update on Top Five Gaps (Merri Beth)

• Information Handling Standards – Will be issued as “tip” documents.
• Major IT Facilities Review – Tom gave an update at the last meeting. The process is continuing, but no new status report.
• Network Management Review – Tom distributed a report at the last meeting. Continuing to address gaps identified.
• Roles and Responsibilities – Still being worked on by the Committee of Data Stewards.
• Risk Assessment Exercise – Planning for next meeting.
• Policy Communications – Still working on this. The communications for the Mobile Device Security Standard was well received. May follow a similar model.

Next Council Activities (Completion of first 2-year term)

• Ideas for our next meeting (Merri Beth):
  • Create a report of the council’s accomplishments for the first 2 years.
  • Revisit identified gaps. Looking for ideas on how to review the gaps.
  • Review membership for next 2 years.
  • (Gardner) What will the relationship be between ISP Risk Council and the new University Assurance Council? (And other groups.)
  • Send any other ideas you have to Tom and Merri Beth.

Wrap-up and Next Steps

Reference

Next meeting: July 24, 1-3 PM

Meeting Information

Date

April 22, 2013

Time

1-3pm

Location

Poplars 017, Video Bridge 223739

Attendees

In Person

Stewart Cobine
Eric Cosens
Jeff Lambright
Merri Beth Lavagnino (ch)
Chris Viers
Dan McDevitt (rep for Jim Kennedy)

Via Video

Eric Swank
Doug Wasitis

Via Audio/phone

Phil Cochran
Michael Gardner
Marcia Gonzales

Absent

Tom Davis (ch)
Joan Hagen
Jim Kennedy
Kim Milford
Dan Rives
Joe Scodro