The CampusCISO® IT Policy Framework is a reference for IT policy in higher education, grounded in annual research.
What it is: An inventory of 17 policies and 24 standards, with prevalence data showing what large research institutions actually publish and support. Each item is classified as Universal, Common, or Emerging based on observed adoption patterns at research universities, so you can see at a glance which items are sector-wide expectations and which are still emerging.
The evidence base: The framework is built from the 2026 CampusCISO IT Policy Study, a systematic review of policy libraries at 410 colleges and universities including a complete census of all 187 R1 research universities in the United States. The framework is updated annually as new research data becomes available.
What's inside the 2026 Edition:
- The complete inventory of 17 policies and 24 standards organized by prevalence (Universal, Common, Emerging)
- Insights into seven sector-wide gaps where higher education consistently falls behind regulatory or threat-driven expectations
- How to determine your 0 to 100 Diagnostic Score combining quantitative coverage and qualitative governance assessment, with four relative maturity levels (Mature, Developing, Foundational, Minimal)
- An overview of the framework's design philosophy and the annual research that validates and updates it
- Edition history documenting how the framework has evolved
- A Self-Assessment method institutions can use to baseline their own policy programs
How to use it: The framework is designed to be used as a reference for self-directed work. Institutions can complete the appended Self-Assessment themselves to identify and prioritize gaps. Paid editions include the Self-Assessment as a formatted, printable PDF. Other resources in the CampusCISO IT Policy family, including the companion guide and paid advisory engagements, are available at campusciso.com/it-policy-guide.
Who it's for: CIOs, CISOs, IT leadership, and governance committees at higher education institutions of any size. Consultants and advisors who serve the sector will find the framework useful as a vendor-neutral reference grounded in peer data.
Updated annually. The 2026 Edition reflects the 2026 CampusCISO IT Policy Study. Subsequent editions will incorporate new data and reclassify items as sector practices evolve.
