In order to ensure compliance with requirements, the institution must identify a comprehensive list of information security- and information privacy-related compliance obligations pertaining to the institution. Offices with appropriate expertise are assigned management responsibility for compliance for each obligation. Assigned compliance personnel are made aware of and accountable for ensuring compliance with these obligations. Throughout this process, advice on legal requirements should be sought from content experts, such as the organization's legal advisors.

Compliance responsibility at IU follows a tiered model. When a regulation, law, or contractual obligation requires IU's compliance for information or technology security or privacy, an individual or office is assigned responsibility for oversight of that compliance sector university-wide or for a specific campus. This tiered model, as it applies to policies, is detailed in The Policy Hierarchy Explained.

However, it is important to understand that every employee at IU is also individually responsible for ensuring that he or she is complying with university policies, regulations, laws, and contractual obligations.

The individuals or offices assigned information security and privacy compliance oversight responsibility track requirements, issue policies and implementation guidance, provide awareness and training materials, and spot-check or otherwise undertake activities to reasonably affirm that the university is complying with the requirements.

Report an Incident at IU assists in directing complaints and reports to the correct party for prompt attention.

Information systems should be regularly reviewed for compliance with information security and privacy policies and standards. Managers should ensure that all security procedures within their area of responsibility are carried out correctly to achieve compliance.

Campus and unit management is responsible for periodically assessing and reviewing compliance. Offices responsible for compliance obligations also periodically spot-check or otherwise undertake activities to reasonably affirm that the university is complying with the requirements.

The university-wide Internal Audit unit acts as an independent appraisal function to examine and evaluate university activities, including information security and privacy activities, as a service to management and the Board of Trustees.

In order to minimize interference during the information systems audit process, and to maximize the effectiveness of such audits, protections are needed to safeguard operational systems and audit tools.

Audit responsibilities at IU are independently organized. Internal Audit does not participate directly in the scope of university activities which enables objectivity and promotes an unbiased, impartial environment that avoids conflict of interest.

Individuals assigned audit duties do not report to those responsible for systems activities and processes. In addition, systems are not audited in a “live” environment. If an audit must occur in a “live” environment, all attempts would be made to conduct the audit during off-peak hours.