Environmental Scan: What Policy and Process Approaches Work (and Don't Work)?

1. Environmental Scan: What Policy and Process Approaches Work (and Don't Work)?

2. Your Presenters Andrea Beesing(amb3@cornell.edu)Assistant Director, IT Security, Cornell University Liz Salley (salley@umich.edu) Product Manager, Identity and Access Management, University of Michigan Renee Shuey(rshuey@psu.edu) Identity and Access Management Lead, The Pennsylvania State University

3. Agenda • Andrea, Liz, and Renee will each review policy and process considerations, focusing on: • Governance • Stakeholder Engagement • Id & Access Management Team Structure • Q&A

4. University of Michigan MCommunity Project Liz Salley (salley@umich.edu) Product Manager, Michigan Administrative Information Services and Functional Lead of MCommunity Identity and Access Management Project http://www.itcs.umich.edu/mcommunity/

5. Project Structure • UM IT-Commons Initiative. In 2003, IT Stewards urged leadership to invest in a enterprise directory infrastructure with the goal of improving campus-wdie service provisioning. • Building the Business Case. In 2004, a joint project of UM’s IT Central Services (ITCS) and Administrative Information Services (MAIS) was launched. • Implemention. In 2006, project was funded and a team established. Team resources have been allocated from both ITCS and MAIS, as well as the Health System, and our two smaller campuses (UM-Flint and UM-Dearborn.)

6. Data & Governance: Beginnings • Data policies . U-M has long-standing policies and a structure for institutional data stewardship and management. http://www.mais.umich.edu/access/policies.html • Unique ID in place. Existing IdM systems are already using a single, institutional Net ID (U-M "uniqname") and number ID (UMID). • Single ERP system in place. Student and HRMS systems of record already transitioned from many separate mainframe applications to a single, integrated PeopleSoft ERP system.

7. Data & Governance: Convening a Team • Governance Board convened before project was funded. Membership includes: • Institutional data managers for student, employee, and alumni data • IT directors and managers from representative schools, colleges, health system, and libraries • IdM project leads from central IT units • Established high-level scope and vision • Championed the business case • Confirm implementation decisions and priorites

8. Data & Governance: Key Outcomes • Strong vs. weak identities • Vocabulary: How do we talk to campus about what this means? • Minimum data standards • Identity lifecycle • http://www.itcs.umich.edu/itcsdocs/r1458/#identity

9. Data and Governance: Key Outcomes • Authority and accountability • How do we enforce standards in a highly decentralized environment? (System enforcement vs. guidelines and best practices) • Decentralized authority and accountability to ensure guidelines and best practices are followed • Resources for IT directors • See “MCommunity Sponsoring Authority Policies and Agreement”http://www.itcs.umich.edu/itcsdocs/r1460/

10. Stakeholder Engagement • Focus Groups. Early focus groups were conducted to raise awareness of the project initiative and to gather compelling user stories that shaped the business case for the project. • Rotating Governance Board Membership. University delegated data mangers hold permanent position on the Board. • Alpha Testers. Technical staff from several schools, colleges, and university units have served as early testers – essentially expanding the size and talent of our development team. • Steering Team. Bi-monthly steering team meeting with project sponsors aligns project priorities with campus-wide priorities.