{"id":10603,"date":"2018-10-30T08:00:11","date_gmt":"2018-10-30T12:00:11","guid":{"rendered":"https:\/\/michigan.it.umich.edu\/news\/?p=10603"},"modified":"2024-07-08T06:05:42","modified_gmt":"2024-07-08T10:05:42","slug":"u-m-information-security-policy-revised-and-approved","status":"publish","type":"post","link":"https:\/\/michigan.it.umich.edu\/news\/2018\/10\/30\/u-m-information-security-policy-revised-and-approved\/","title":{"rendered":"U-M Information Security policy: Revised and approved"},"content":{"rendered":"

\"SPGThe revised University of Michigan <\/span>Information Security policy (SPG 601.27)<\/span><\/a> recently was approved, along with a number of new information technology standards<\/a>.\u00a0<\/span>The policy and <\/span>accompanying <\/span>standards represent the most comprehensive revision of the institution\u2019s information security program since its inception over a decade ago. <\/span><\/p>\n

SPG 601.27 and the standards are based on a cybersecurity risk management framework that incorporates best practices for protecting U-M\u2019s critical IT infrastructure and data assets, <\/span>and reinforces everyone’s shared responsibility for information security.<\/span><\/p>\n

\u201cInformation security, particularly for a highly distributed and collaborative environment like our institution, is an evolving paradigm. The revised Information Security policy strives to balance appropriately securing the institution while supporting open collaboration and innovation in research, teaching, learning, and clinical care,\u201d said Ravi Pendse, vice president for information technology and chief information officer. \u201cIt also acknowledges that everyone\u2014faculty, staff, and students\u2014shares the responsibility for information security. We are all in this together.\u201d<\/p>\n

Implementation begins now<\/h1>\n

Information Assurance (IA) recognizes that implementation of the policy and standards<\/a> will take some time given the the more detailed nature of the new requirements. <\/span>Implementation will be phased in over the next two years, with an anticipated compliance date of December 31, 2020.<\/span><\/p>\n

IA staff members are meeting with university stakeholders, IT governance groups, and others to outline the implementation planning process.<\/span><\/p>\n

SULs to facilitate<\/h1>\n

IA is asking each unit’s <\/span>S<\/span>ecurity Unit Liaison (SUL)<\/span><\/a> to facilitate and coordinate their unit\u2019s implementation planning. Specific objectives of this work include:<\/span><\/p>\n