CampusCISO IT Policy Bundle

Higher education IT policy isn't a documentation problem. It's a governance problem.

The distance between what should be documented and what actually exists creates Governance Debt, and it compounds the same way deferred maintenance does. When it comes due during a ransomware attack, a compliance audit, or a federal grant review, it transforms from a documentation gap into a direct financial and legal liability.

The evidence base: We reviewed the policy libraries of 410 colleges and universities, including every R1 research university in the United States, and studied what they actually published, where the gaps were, and how institutions across the sector are addressing them. The results form the 2026 CampusCISO® IT Policy Study. This study is incorporated into a series of resources, including this book and the CampusCISO IT Policy Framework (free Community Edition on Leanpub).

Three diagnostic patterns emerged from the 2026 study: an Authentication Floor that proves consensus is possible. A Ransomware Cliff where documented response procedures drop from 57% at large research institutions to 2% at baccalaureate institutions. And an Oral Tradition Liability where critical technical practices live in people's heads instead of written standards.

What you'll find inside:

• The three diagnostic patterns and the prevalence data behind them
• Why higher education security programs are fundamentally different from corporate and government approaches, and how to design for shared governance, academic freedom, and decentralized IT
• A framework of 17 policies and 24 standards grounded in observed practice, built to work alongside NIST, ISO, and other guidance
• Regulatory context for common higher education requirements, including FERPA, GLBA, HIPAA, CMMC, export controls, and state breach laws
• A two-tier inspection methodology to measure your Governance Debt: a 20-hour Quick Inspection for fast triage, or the full Inspection that you can complete in 70-130 staff hours
• A template for phased improvements with a stakeholder briefing template and guidance on prioritizing gaps
• The CampusCISO IT Policy Self-Assessment as a formatted, printable PDF, included with your purchase

Who it's for: CIOs, CISOs, IT leadership, and governance committees at higher education institutions of any size.

More from CampusCISO: Other resources in the CampusCISO IT Policy family are available at campusciso.com/it-policy-guide.

The CampusCISO® IT Policy Framework is a reference for IT policy in higher education, grounded in annual research.

What it is: An inventory of 17 policies and 24 standards, with prevalence data showing what large research institutions actually publish and support. Each item is classified as Universal, Common, or Emerging based on observed adoption patterns at research universities, so you can see at a glance which items are sector-wide expectations and which are still emerging.

The evidence base: The framework is built from the 2026 CampusCISO IT Policy Study, a systematic review of policy libraries at 410 colleges and universities including a complete census of all 187 R1 research universities in the United States. The framework is updated annually as new research data becomes available.

What's inside the 2026 Edition:

• The complete inventory of 17 policies and 24 standards organized by prevalence (Universal, Common, Emerging)
• Insights into seven sector-wide gaps where higher education consistently falls behind regulatory or threat-driven expectations
• How to determine your 0 to 100 Diagnostic Score combining quantitative coverage and qualitative governance assessment, with four relative maturity levels (Mature, Developing, Foundational, Minimal)
• An overview of the framework's design philosophy and the annual research that validates and updates it
• Edition history documenting how the framework has evolved
• A Self-Assessment method institutions can use to baseline their own policy programs

How to use it: The framework is designed to be used as a reference for self-directed work. Institutions can complete the appended Self-Assessment themselves to identify and prioritize gaps. Paid editions include the Self-Assessment as a formatted, printable PDF. Other resources in the CampusCISO IT Policy family, including the companion guide and paid advisory engagements, are available at campusciso.com/it-policy-guide.

Who it's for: CIOs, CISOs, IT leadership, and governance committees at higher education institutions of any size. Consultants and advisors who serve the sector will find the framework useful as a vendor-neutral reference grounded in peer data.

Updated annually. The 2026 Edition reflects the 2026 CampusCISO IT Policy Study. Subsequent editions will incorporate new data and reclassify items as sector practices evolve.