Policy Development Theory & Practice: An Emphasis on IT

1. Policy Development Theory & Practice: An Emphasis on IT Pat Spellacy Director of Policy & Process Development University of Minnesota p-spel@umn.edu W E B C A S TAugust 16, 2005

2. University of Minnesota • Policy office established September 1993 • Have a policy & a process on developing policy • Two policy templates (Regents & Administrative) • Quarterly policy planning meetings • U-wide Libraries cited as a past success • Official web site:www.fpd.finop.umn.edu/groups/ppd/documents/main/policyhome.cfm

3. The Association of College &University Policy Administrators MissionThe mission of the group is explore both the "policy process" on college and university campuses as well as to discuss specific policy issues. The mission will be fulfilled through periodic meetings, special events, outreach activities and electronic communications among the membership. MembersSee the Members Directory on the ACUPA web site.http://process.umn.edu/acupa/

4. ACUPA Web Site

5. Policy: Is this it? Cartoon # 1– Just Guidelines?

6. Policy: Is this it? Cartoon #2: Guidelines too wishy-washy?

7. Policy: Is this it? Cartoon #3: Wally & Mordac

8. For Real - This is Policy • What is a Policy?- They state an institutional position. - They describe mandates, community beliefs and boundaries.- They should include why and who. • What is a Procedure?- They tell us how.- They often include who, what, when and where.- They are the customary or standard practice way of handling situations.

9. For Real - This is Policy • Why Are Policies and Procedures Important?- They establish responsibilities and accountability.- They help ensure compliance and reduce institutional risk.- They may be needed to establish and/or defend a legal basis for action.- They provide clarification and guidance to the community.

10. Policy Definition References • “A Framework for IT Policy Development”http://www.educause.edu/pub/er/erm04/erm0428.asp • Hierarchy of Legal/Regulatory and Policy Authorityhttp://www.fpd.finop.umn.edu/groups/ppd/documents/appendix/policyhierarchy.cfm (These Links are on the ACUPA web site)

11. Policy Development Process“Best Practices”

12. An Overview

13. Best Practices

14. Best Practices

15. Best Practices

16. U of M Policy Hierarchy ·Federal Level(Constitution, Statutes, Regulations) ·State Level (Charter for U of M (1851), Constitution (1857), Statute, Regulations) ·Internal U GovernanceRegents Bylaws Regents Policies U-wide or Faculty Senate Policy Procedures-Action steps that tell how things are done Standard - A level of quality that is required to be followed (supports policy/procedure) Guideline - Provides optional guidance for action (supports policy/procedure) Campus-wide College Constitutions College/Administrative Unit PolicyDepartment Policy URL - http://www.fpd.finop.umn.edu/groups/ppd/documents/appendix/policyhierarchy.cfm

17. U of M Policies Related to IT • Acceptable Use of Information Technology Resources • Accessibility of Information Technology • Administration & Oversight for Protection of Individual Health Information (HIPAA) • Creating and Revising U-Wide Forms • Financial Data and Systems Security • Including a Privacy Statement on U Web Pages • Internal Access to University Information • Participating in Discussions on the Portal • Protection of Individual Health Information • Protection of Individual Health Information by University Health Care Components (HIPAA) • Public Access to University Information • Publishing Information on the World Wide Web • Use & Disclosure of Individual Health Information for Research Purposes (HIPAA) • User Authentication for Access to University Computer Resources • Using Communications Technology to Improve University Processes • Using Email as Official Student Communication

18. U of M IT Standards & Guidelines • Standards (A standard is a level of quality that requires conformity) • Using Information Technology Resources Standards • Wireless Access Point Technical Standards3-02 • Anti-Virus Standards4-02 • Secure Data Deletion Standard6-03 • Security Patch Application Standard1-04 • University Network Standards for Network Security & Operational Continuity4-04 • Information Technology Support Staffing Standard 4-04 • Securing Private Data Standard10-04 • Guidelines (A guideline is recommended but optional behavior.) • Critical Server Identification Guideline • Windows 2000/XP Basic Desktop Security Guidelines • University Network Management Guidelines3-01 • Server Security Guidelines12-03 • Information Technology Support Guidelines4-04 • Securing Microsoft Domain Controller Guideline10-04

19. OIT Comments About Standards & Guidelines • Permits OIT to react quickly • Can use guidelines as a starting point that can change • As time passes and comments are received, it may become a standard • Avoids the longer policy development process • IT people like this approach • Faculty Senate Committee on IT very supportive of this method • For questions contact:Ken Hanna • Office of OIT Security • U of Minnesota • k-hann1@umn.edu • 612-625-1505

20. Structure of U-Wide Policy Library • End User Needs • Web Browser • Acrobat Reader

21. IT Role in Policy Development • Own & maintain IT policies • Be a resource for policies impacted by IT • Help the institution develop/purchase/use software to manage policies • See ACUPA article on Status of policy development “Exploring the Campus Policy Process”http://process.umn.edu/acupa/

22. Entering the Reality Zone

23. New ACUPA Web Site

24. ACUPA Web Page Features • Case studies • Tools for policy development (Templates, web sites & contacts) • Article on policy development • List of those willing to advise • Other resource links

25. Case Studies

26. Those Willing to Help

27. Other Resources

28. Best Practice Examples Linked to the Policy Development Theory

29. Examples of Best Practices: Predevelopment 1. Be proactive in issue identification - Join ACUPA 2. Identify an owner for each policy- UCLAhttp://www.adminvc.ucla.edu/appm/_Responsible_Dept.asp- University of California, Systemhttp://www.ucop.edu/ucophome/coordrev/da/

30. Examples of Best Practices: Predevelopment 3. Determine the best “Policy Path”- Georgia Tech: Policy Processhttp://www.oit.gatech.edu/inside_oit/directorates/PS/policy_dev_process.cfm- Cornell University: Policy Processhttp://www.policy.cornell.edu/CM_Images/Uploads/POL/pol_processmap.pdf?CFID=447932&CFTOKEN=25227860 4. Assemble a team to develop policy

31. Examples of Best Practices: Development 5. Agree on common definitions and terms- University of California, Berkeleyhttp://campuspol.chance.berkeley.edu/GlossaryofTerms.doc- University of Minnesota - Levels and Definitionshttp://www.fpd.finop.umn.edu/groups/ppd/documents/appendix/policyhierarchy.cfm 6. Use a common format- Arizona State Universityhttp://www.asu.edu/aad/manuals/cam/cam402-01.html- University of Vermonthttp://www.uvm.edu/%7Euvmppg/ppg/format.rtf

32. Examples of Best Practices: Development 7. Obtain approval at owner and senior levels- Boston Collegehttp://www.bc.edu/offices/policies/meta-elements/doc/policies/I/1-125-001.shtml- University of California, Berkeleyhttp://campuspol.chance.berkeley.edu/CampusReview.htm 8. Plan communication, publicity, and education- University of California, Davishttp://manuals.ucdavis.edu/- University of Minnesotahttp://process.umn.edu/groups/ppd/documents/main/new.cfm

33. Examples of Best Practices: Development 9. Put information online and accessible from one location- George Washington Universityhttp://my.gwu.edu/mod/upolicy/- Indiana University http://www.indiana.edu/~policies/ 10. Provide search capability- University of California, Davishttp://manuals.ucdavis.edu/policysearch_vsearchform.cfm- University of Tennesseehttps://san4.dii.utk.edu/servlet/page?_pageid=2648&_dad=portal30&_schema=PORTAL30

34. Examples of Best Practices: Maintenance 11. Develop a plan for active maintenance and review- University of Minnesotahttp://process.umn.edu/groups/controller/documents/main/libmaint_home.cfm 12. Encourage users to provide feedback- Arizona State Universityhttp://www.asu.edu/aad/manuals/feedback.html- UCLAhttp://www.adminvc.ucla.edu/appm/appm_feedback.html

35. Examples of Best Practices: Maintenance 13. Archive changes and date new releases with an “Effective Date”- James Madison Universityhttp://www.jmu.edu/JMUpolicy/datelist.shtml- University of Georgiahttp://www.busfin.uga.edu/manual/ 14. Measure outcomes by monitoring or testing

36. Successes and Benefits of Policy Process

37. University of Minnesota:Successes and Benefits • 80% of Non-Regents policies formatted • We can count our policies, forms & contracts (238, 476, 123) • All policies have an owner • People use the Policy Library (10,000 “hits” a month)

38. University of Minnesota:Successes and Benefits • People see a managed policy development process • Policy organization sets the stage for other improvements • Financial One Stop websiteA “How To” for Financial tasks with links to policy, forms, contracts, tools, training, risks, audit results & more.http://process.umn.edu/groups/controller/documents/main/osf_home.cfm