[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":-5,"_8":9,"_10":11},"actionData","errors","root",{"_473":-5,"_480":-5,"_481":482,"_483":484,"_485":486,"_487":488,"_489":490,"_491":492,"_493":321,"_494":495,"_496":497,"_498":499},"routes/_store+/_readers+/read_/route","routes/_store+/_readers+/read_.$slug/route",{"_16":315,"_316":317,"_318":319,"_320":321,"_322":-7},"routes/_store+/_readers+/read_.$slug.$chapterId/route",{"_12":13,"_14":15,"_16":17,"_18":19,"_20":21},"title","Building IT Policy Programs for Higher Education","content","

About CampusCISO

https://leanpub.com/campusciso_it_policy

Contact

https://leanpub.com/campusciso_it_policy","book",{"_33":34,"_12":13,"_35":36,"_37":38,"_39":40,"_41":15,"_42":43},"nextChapter",{"_22":23,"_12":24,"_25":-5,"_26":27,"_28":29,"_30":-5,"_31":-5,"_32":-5},"sections",[],"level",2,"Glossary of Terms","description","path","#glossary-of-terms","fileCount",1,"quizType","sectionNum","youtubeId","previewContent","

\nExecutive Summary\n
\nPart I: Foundations\n
\nChapter 1: The As-Built Standard\n
- \nDesign Drawings vs. As-Built Reality\n
- \nWhat Happens When Governance Debt Comes Due\n
- \nWhat a Well-Built Program Makes Possible\n
- \nThe Blueprint Is Not Your Building\n
- \nChapter 1 Key Takeaways\n
\n
\nChapter 2: The 2026 Policy Landscape\n
- \nA Yearly Snapshot of the Sector\n
- \nAbout the Data\n
- \nThree Patterns That Define the Landscape\n
- \nAdditional Gaps Across the Sector\n
- \nInterpreting the Data\n
- \nWhat the Data Leaves Out\n
- \nChapter 2 Key Takeaways\n
\n
\nChapter 3: The Site Conditions\n
- \nThe Warning\n
- \nThe Soil Conditions: Shared Governance\n
- \nThe Exterior Windows: Academic Freedom\n
- \nThe Public Easements: Open Campus\n
- \nThe Unplanned Paths: Shadow IT\n
- \nChapter 3 Key Takeaways\n
\n
\nChapter 4: Framework Alignment\n
- \nThe Defensibility Imperative\n
- \nFour Common Frameworks\n
- \nMatching the Framework to Your Team\n
- \nChapter 4 Key Takeaways\n
\n
\nPart II: The Framework\n
\nChapter 5: The Blueprints\n
- \nDesign Your Internal Building Layout\n
- \nThe Governance Hierarchy\n
- \nChapter 5 Key Takeaways\n
\n
\nChapter 6: The Inventory\n
- \nReading the Inventory\n
- \nPolicies (17)\n
- \nStandards (24)\n
- \nWhere to Go Next\n
- \nChapter 6 Key Takeaways\n
\n
\nPart III: Applying the Framework\n
\nChapter 7: Structural Loads\n
- \nThe Weight Your Building Must Support\n
- \nA. The Foundation: Universal Loads\n
- \nB. Environmental Loads\n
- \nC. Mission-Specific Loads\n
- \nDetermining Your Institution’s Regulatory Load\n
- \nChapter 7 Key Takeaways\n
\n
\nChapter 8: Designing for Research\n
- \nThe Research Distinction\n
- \nPrincipal Investigators Are Like Entrepreneurs\n
- \nResearch Computing: A Different Architecture\n
- \nHow Research Governance Works\n
- \nHow Research Data Is Managed\n
- \nChapter 8 Key Takeaways\n
\n
\nChapter 9: Designing Your Policy Architecture\n
- \nThe Too-Many-Programs Trap\n
- \nRisk-Tiered Data Classification\n
- \nMinimize the Scope of Your Most Restrictive Tier\n
- \nMapping Regulations to the Framework\n
- \nSupporting New Compliance Requirements\n
- \nWhat Makes the Layering Work\n
- \nFrom Structure to Execution\n
- \nChapter 9 Key Takeaways\n
\n
\nPart IV: Building Your Program\n
\nChapter 10: Conducting the Inspection\n
- \nDocumentation Meets Reality\n
- \nThe Quick Inspection\n
- \nThe Inspection Process\n
- \nStep 1: Gather Your Documentation\n
- \nStep 2: Create Your Inventory\n
- \nStep 3: Assess Against the Framework\n
- \nStep 4: Prioritize Your Gaps\n
- \nStep 5: Document Your Findings\n
- \nYour Inspection Is Complete\n
- \nChapter 10 Key Takeaways\n
\n
\nChapter 11: The Improvement Roadmap\n
- \nFrom Inspection to Roadmap\n
- \nWhy Annual Reviews Should Be Your Standard\n
- \nThe Prioritization Hierarchy\n
- \nPhase 1: Shore Up the Foundation\n
- \nPhase 2: Address the Structural Loads\n
- \nPhase 3: Plan for Expansion\n
- \nBuilding Your Roadmap\n
- \nDon’t Forget the Culture Work\n
- \nCommunication Template\n
- \nChapter 11 Key Takeaways\n
\n
\nConclusion: The Path Forward\n
- \nWhere to go from here\n
- \nDocument Information\n
\n
\nAbout CampusCISO\n
\nGlossary of Terms\n

Executive Summary

You know your policy library has gaps. You just don’t know which ones matter most, or how to find them in a timeframe your team can actually afford.

Higher education IT policy isn’t a documentation problem. It’s a governance problem. Most institutions maintain written policies. But the distance between what should be documented and what exists creates what this guide calls Governance Debt. Like deferred maintenance on a building, it follows predictable patterns and compounds over time. Regulations change, threats evolve, and higher education best practices shift each year, while the documentation stays where it was when someone last had time to update it.

This guide shows you how to measure your Governance Debt and pay it down, not through a one-time renovation project but through an annual cycle your team can actually sustain.

How this guide came together. Over years of advisory work with higher education CIOs and CISOs, we kept seeing the same patterns. Some institutions had well-documented authentication programs but nothing written down for ransomware response. Others had critical technical practices that existed entirely in senior staff members’ heads. We started tracking the patterns as reference material for our own engagements. That reference material evolved into the CampusCISO IT Policy Framework. The 2026 Edition reflects analysis of 410 institutional policy libraries across every Carnegie tier, including every R1 research university in the United States.

Three core patterns emerged from the institutions we reviewed:

\nThe Authentication Floor. Identity management is the one area of consensus. We found documented password and access-control practice at over 80% of institutions at every tier, and password standards at 100% of large research universities.\n
\nThe Ransomware Cliff. Attack volumes against education have nearly doubled in recent years. But we found documented ransomware response procedures at only 57% of large research universities and just 2% of small baccalaureate institutions.\n
\nThe Oral Tradition Liability. Critical technical practices live in people’s heads instead of written standards. Publicly documented standards fall from 76% at the largest research universities to 37% at community colleges. Not having documented standards creates a risk that when staff leave, the institution’s security program leaves with them.\n

We defined a framework of 17 policies and 24 standards that reflect what higher education institutions actually do. This was based on observed data from 410 institutions, not what a generic framework prescribes.

What you’ll know how to do after reading this:

\nIdentify which policy gaps at your institution create real exposure\n
\nMap your regulatory obligations to the policies and standards that support them, including the overlapping requirements that trip up many IT leaders\n
\nRun either the 20-hour Quick Inspection described in Chapter 10 or the full Inspection and improvement-planning exercise that requires 70 to 130 hours\n
\nEstablish an annual review and refresh program that fits your team’s actual capacity, with a defensible framework to prioritize what to tackle first and what can wait\n

The goal isn’t to fix everything at once. It’s to establish the annual cadence that keeps your Governance Debt from compounding.

Who this guide is for: CIOs, CISOs, IT leadership, and governance committees at higher education institutions of any size. While the regulatory examples are US-specific, you can apply the structural principles to institutions in any jurisdiction.

\n\n

* * *

Part I: Foundations

Chapter 1: The As-Built Standard

Every information security program starts with design drawings.

Whether you inherited a security program or you’re building one from scratch, somewhere in that first month you sketched out the architecture you wanted: framework controls mapped to every system, clean data classification tiers, and a policy repository where everything cross-references perfectly. Maybe you even color-coded it. The mental image was perfect.

Then reality hit.

Budget cuts landed before you could hire your second analyst. The medical school runs its own IT and won’t return your calls. A “temporary” authentication workaround from 2019 is now critical infrastructure. The registrar’s office bought a new cloud service last Tuesday and didn’t tell anyone.

Your design drawings are already obsolete.

Design Drawings vs. As-Built Reality

In construction, architects produce two sets of documentation. The design drawings show what the building should look like: clean lines, perfect specifications, everything in its place. Then there are the as-built drawings, created after construction is complete. These show what got built: the electrical conduit that had to route around an unexpected beam, the HVAC duct that shifted six inches so the door would open, and the structural reinforcement added when the soil report came back worse than expected.

As-built drawings are messier than design drawings. But they’re the only accurate map of the building. When something breaks twenty years later, you don’t reach for the architect’s original vision. You reach for the as-built documentation because that reflects what’s there.

The same gap exists in every university’s security program.

Generic frameworks (e.g., NIST, ISO, or CISA) tell you what a security program should look like. They’re design drawings. Comprehensive, well-organized, theoretically complete. But they don’t tell you what was built at your university. They don’t tell you which policies survived contact with shared governance, decentralized IT, academic freedom expectations, and six-month board approval cycles. They don’t tell you what to prioritize when you have three staff to support forty competing compliance obligations.

This framework bridges that gap with real-world data on what gets built, documented through direct observation across higher education.

But first, we need a name for what we’re looking at.

Every university has a gap between the security program they designed and the program they operate. Policies that were approved but never published. Standards that exist as institutional knowledge but were never written down. Controls that cover one regulation but miss two others. Practices that worked when one person managed them, but that person left three years ago.

We call that accumulated distance Governance Debt.

Governance Debt is like deferred maintenance. Every year that a patching standard goes undocumented or an access review process lives in someone’s head instead of a written procedure, the cost of formalizing your program grows. And when an auditor arrives, or your team struggles with communication plans during a malware outbreak, or a federal sponsor asks to see your compliance documentation, you discover the debt has come due.

This guide helps you measure Governance Debt, understand where it accumulated, and pay it down systematically before something forces your hand.

Chapter 2 shows how Governance Debt is distributed across the sector, measured by the 2026 Edition of the framework. But first, the case for why measurement matters.

What Happens When Governance Debt Comes Due

Higher education faces a technology threat landscape that’s growing faster than most institutions can adapt. Governance Debt doesn’t cause security incidents, but it makes institutions less prepared to prevent them, slower to respond, and more exposed to the fallout.

The threat landscape is real and accelerating.

Education has become one of the most-attacked sectors in the world, and the volume is still rising. Chapter 2 documents the trend in detail. The pressure reaches even the best-resourced institutions. In 2023, Stanford University experienced three separate security incidents, with the Akira ransomware group claiming exfiltration of 430GB of data ¹. Carnegie Mellon disclosed unauthorized access to personal information of over 7,300 individuals ². The University of Michigan suffered a breach affecting 230,000 students, faculty, and staff ³.

These are well-resourced institutions with large dedicated security teams. Smaller institutions face the same threats with fewer resources to respond.

Compliance failures now carry real legal consequences.

Compliance risk is no longer theoretical. Georgia Tech Research Corporation paid $875,000 to resolve allegations that its Controlled Unclassified Information (CUI) protection program didn’t meet federal requirements ⁴. Penn State settled a False Claims Act lawsuit over similar research compliance attestation gaps for $1.25 million ⁵. The GLBA Safeguards Rule puts federal student aid eligibility at risk for non-compliance ⁶. And CMMC 2.0 requirements (finalized in late 2024 ⁷) added another layer of contractual obligation for institutions conducting defense-related research.

Institutions that haven’t invested in their policy frameworks and compliance programs are finding themselves exposed, not just to security incidents, but to legal liability.

None of this means a strong program prevents every incident. There is no such thing as absolute security, and even a well-built information security program will still face incidents, breaches, and hard audits. That isn’t a contradiction. It’s the nature of risk management, where the goal is never to eliminate risk but to manage it deliberately so the institution can absorb what it can’t prevent. You might see an institution held up as a model in one chapter of this guide and cited as a cautionary example in another. That’s the point, not an oversight. It reflects the world we actually work in.

Regulatory fragmentation multiplies the burden.

Most institutions face overlapping (and sometimes conflicting) requirements. For example, a student health clinic record might be subject to FERPA’s “reasonable” standard, HIPAA’s prescriptive controls, and NIST 800-171’s detailed specifications.

Without a unified governance approach, you might end up maintaining separate compliance programs for each regulation. Audit costs grow every year, and the gaps between programs make it easier for things to fall through.

\n\n

What a Well-Built Program Makes Possible

\"Paying — Figure 1. Paying down Governance Debt stabilizes the institution, replacing temporary workarounds with defensible, load-bearing architecture.

So what does it look like when Governance Debt is paid down and your program is working?

\nIt looks like a board-level policy that delegates security authority to the CISO so technical standards can be updated as threats evolve without waiting for 12-month approval cycles.\n
\nIt looks like a single data classification scheme where a system handling student health records gets controls that satisfy FERPA, HIPAA, and state breach laws simultaneously.\n
\nIt looks like one encryption standard, properly documented, that satisfies GLBA, HIPAA, and PCI-DSS requirements at the same time.\n
\nIt looks like a college sysadmin who follows the institutional server hardening standard and knows the next auditor will find compliant systems.\n
\nIt looks like a GLBA auditor who asks about access controls and gets pointed to the same documentation you showed the HIPAA auditor last month.\n
\nAnd it looks like a researcher whose request for a specialized analysis tool gets approved in 48 hours through a streamlined exception process, instead of being blocked by a blanket prohibition.\n

The goal in establishing robust policies and standards isn’t documentation for its own sake. We create IT and security policies that enable the institutional mission rather than obstruct it.

\n\n

The Blueprint Is Not Your Building

This book gives you a blueprint.

You’ll find a framework of 17 policies and 24 standards that captures what well-developed higher education programs have in common. You’ll find a set of structural loads (regulations, threats, and operational realities) that your framework has to support. You’ll find an operational model for handling the loads without building a separate compliance program per regulation. By the time you finish the book, you’ll have a blueprint template and the tools to adapt it.

But a blueprint is not a building.

No two higher education institutions have identical IT policies and governance structures. A community college’s policy library looks different from an R1 research university’s, and it should. A small liberal arts college manages governance differently than a public land-grant with a medical school and a defense research portfolio. If you over-engineer your program for requirements you don’t face, you waste resources and alienate your campus. If you simply copy a peer’s policy library without understanding your own obligations, you create structural blind spots.

The blueprint tells you what’s possible. You still have to build the building.

The rest of this book helps you do that. It shows you how the blueprint was developed, what it contains, how the loads vary across institution types, and how to adapt the template to your own site. Then it walks you through measuring what you have against what the blueprint describes, and turning the gap into a plan.

Chapter 1 Key Takeaways

\n
Design drawings aren’t enough. Generic frameworks tell you what a security program should look like. They don’t tell you what survives contact with shared governance, decentralized IT, and months-long board approval cycles. You need a blueprint built from what higher education institutions actually do, not from what frameworks say they should do.
\n
\n
Governance Debt has concrete consequences. Not because it causes incidents, but because it leaves institutions less prepared to prevent them, slower to respond, and more exposed to legal and regulatory fallout.
\n
\n
Well-built policies and standards strengthen operations. The goal isn’t documentation for its own sake. It’s unified governance, risk-based decision frameworks, reduced audit burden, and security controls that enable rather than obstruct the institutional mission.
\n
\n
The blueprint isn’t the building. A framework that works at an R1 won’t fit a community college without adaptation. The rest of this book helps you adapt.
\n

Chapter 2 presents the 2026 Edition of the CampusCISO IT Policy Framework. We reviewed 410 institutions, identified three diagnostic patterns that repeat across the sector, and documented where the gaps fall. It measures Governance Debt across higher education. These findings will refresh each year. The other chapters in this guide largely will not.

* * *

\n\n

BleepingComputer, “Stanford: Data of 27,000 People Stolen in September Ransomware Attack,” 2023, https://www.bleepingcomputer.com/news/security/stanford-data-of-27-000-people-stolen-in-september-ransomware-attack/.↩︎
Cybernews, “Carnegie Mellon University Suffers Cyberattack,” 2023, https://cybernews.com/news/carnegie-mellon-university-suffers-cyberattack/.↩︎
Inside Higher Ed, “Hackers Access Data of 230K at University of Michigan,” October 2023, https://www.insidehighered.com/news/quick-takes/2023/10/25/hackers-access-data-230k-university-michigan.↩︎
U.S. Department of Justice, “Georgia Tech Research Corporation Agrees to Pay $875,000 to Resolve Civil Cyber-Fraud Litigation,” September 2025, https://www.justice.gov/opa/pr/georgia-tech-research-corporation-agrees-pay-875000-resolve-civil-cyber-fraud-litigation.↩︎
U.S. Department of Justice, Eastern District of Pennsylvania, “Penn State Agrees to Pay $1.25 Million to Resolve False Claims Act Allegations Relating to Non-Compliance with Contractual Cybersecurity Requirements,” October 22, 2024, https://www.justice.gov/usao-edpa/pr/penn-state-agrees-pay-125-million-resolve-false-claims-act-allegations-relating-non.↩︎
U.S. Department of Education, Office of Federal Student Aid, “Updates to the Gramm-Leach-Bliley Act Cybersecurity Requirements,” February 9, 2023, https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements.↩︎
Cybersecurity Maturity Model Certification (CMMC) Program Final Rule (2024), https://www.federalregister.gov/documents/2024/10/15/2024-23123/cybersecurity-maturity-model-certification-cmmc-program.↩︎

Chapter 2: The 2026 Policy Landscape

* * *

\n\n

A Yearly Snapshot of the Sector

The CampusCISO IT Policy Framework describes the elements of a well-developed higher education IT policy program. This guide shows you how to interpret and apply that framework. This chapter shows you what the sector has actually built against it as of 2026.

We publish a new edition of the framework each year, grounded in fresh data from hundreds of colleges and universities. The 2026 Edition draws on 410 institutions, including every R1 research university in the United States. The data behind this chapter comes from that review.

The snapshot changes each year. Ransomware response procedures we found at 57% of Tier 1 institutions today will land at a different percentage next year, because more institutions will write them. AI governance policies at 47% today will either climb sharply or stall out, and either outcome tells you something. International Travel Security standards at 6% today are the kind of number that has nowhere to go but up.

Because the numbers move, the chapter moves with them. You’re reading the 2026 Edition. If you’re reading this in 2027 or later, pick up the newer edition for the current measurements. The other chapters in this guide won’t have changed much. This one will.

About the Data

Instead of starting with what frameworks tell institutions to do, we looked at what they’re doing. For each institution, we identified the policy repository, mapped every document to our framework inventory, and evaluated how their governance structure coordinates security decisions.

\n\n

Throughout this guide, we organize institutions into CampusCISO Institutional Tiers for benchmarking. CampusCISO uses these tiers across our diagnostic services to provide granularity without identifying specific institutions.

The tiers are currently based on the Carnegie Classification of Institutions of Higher Education, but we designed the system to accommodate non-US institutions in future updates.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

CampusCISO Tier	Current Composition (2026 Sample Size)
Tier 1	R1: Doctoral universities, very high research activity (187)
Tier 2	R2/RCU: Doctoral universities, high research activity (86)
Tier 3	Master’s and non-research graduate institutions (39)
Tier 4	Baccalaureate colleges (35)
Tier 5	Community and associate’s colleges (38)
Special Focus	Specialized and tribal institutions (25)

We aligned the framework to common standards, including NIST CSF 2.0, NIST SP 800-171, and ISO 27001/27002. The goal is to complement those standards, not compete with them.

This framework has three limitations worth noting.

\nThe research measures publicly documented policies, so institutions with robust but unpublished policies may appear less developed.\n
\nAssessments reflect a point in time (December 2025 through January 2026).\n
\nThe presence of a policy document doesn’t guarantee effective implementation.\n

This framework analyzes governance architecture, not operational effectiveness.

What we found wasn’t a single coherent standard. It was hundreds of institutions solving the same problems in different ways, with different names, unique structures, and varying levels of completeness. We distilled those diverse approaches into a common framework of 17 policies that establish governance authority and institutional intent, plus 24 standards that specify technical requirements and operational procedures. Throughout this book, we’ll refer to policies and standards using reference numbers like P-01 for policies and S-01 for standards.

Each year’s research refines the framework as institutional practice evolves. The 2026 Edition provides a map of where the sector has built consensus and where critical gaps remain. Some policies are nearly universal. Others are quickly gaining traction but haven’t reached critical mass. And some, including ones that federal regulators already ask about, barely exist at all.

Three Patterns That Define the Landscape

Governance Debt doesn’t accumulate evenly. When we analyzed the data, three distinct patterns emerged, each revealing something different about where higher education stands today. You’ll probably recognize some of them in your own environment.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Pattern	What it measures	What our review found
Authentication Floor	Whether basic identity controls (passwords S-03, access control S-06) are documented	Over 80% at every tier. The one place the sector has consensus.
Ransomware Cliff	Whether a ransomware response plan is documented	57% at Tier 1, 41% at Tier 2, 2% at Tier 4. The plan thins out fast at smaller institutions.
Oral Tradition Liability	Whether technical standards are written down, not just policies	Policies exceed 75% at every tier, but published standards fall from 76% at Tier 1 to 37% at Tier 5.

The Authentication Floor

The good news is that some things are working. Over 80% of institutions at every tier have adopted standards for passwords (S-03) and access controls (S-06). Regardless of size, budget, or complexity, nearly every institution has built at least this much. This is the floor, and it proves that sector-wide consensus on security controls is possible. The question is why so few policies and standards have reached such widespread adoption.

The floor is real, but it measures breadth, not depth. A password standard that still mandates old complexity rules (eight characters, one uppercase, and one special character) instead of new guidance (longer length, passkeys, and phishing-resistant MFA) still counts as present, while giving a false sense of safety. And few institutions have standards that govern the service accounts, API keys, machine credentials, and AI agent identities that now outnumber human users on most campus networks.

The Ransomware Cliff

You already know cyber threats are getting worse. In Q2 2025, education absorbed an average of 4,388 cyberattacks per organization per week, a 31% year-over-year increase and more than double the global cross-sector average ¹. Studies consistently show education is one of the most-attacked sectors globally.

So how many institutions have documented what to do when ransomware activates at 2 AM? At Tier 1 institutions, 57%. At Tier 2, 41%. At Tier 4 (baccalaureate) institutions, 2%. The institutions most likely to lack dedicated security staff are also the least likely to have written down a response plan.

The Oral Tradition Liability

The backup schedule lives in a sysadmin’s head. The patching timeline is “when we get to it.” The access review process is “we know who should have an account.”

Across the sector, more than 75% of institutions at every tier publish their IT policies to public repositories. But the technical standards that turn those policies into operational practice tell a different story. Published standards drop from 76% at Tier 1 to just 37% at Tier 5. We call this decline Tier Decay, reflecting how documented practice thins out as you move down the tiers.

Sometimes the gap reflects documentation hidden behind authentication that an outside assessment can’t reach. But in our advisory work with campuses of all sizes, we often find something more fundamental. The work is usually getting done. It just isn’t written down. The documentation either doesn’t exist, or it hasn’t been updated in years and stays locked away rather than exposing the accumulated Governance Debt.

Governance Debt hits smaller institutions especially hard. Often, one or two people carry the entire operational playbook in their heads. But the principle applies to institutions of all sizes. When your team doesn’t know what’s expected, you can’t expect the outcomes you need. Staff turnover erases undocumented practices overnight. Auditors and insurance underwriters can’t verify what isn’t written down. And decentralized IT units can’t follow standards that don’t exist in a form they can reference.

The Authentication Floor proves the sector can reach consensus. The other two patterns show where Governance Debt is compounding, and why understanding the current state matters before you start measuring your own institution against it.

Additional Gaps Across the Sector

Beyond the three diagnostic patterns, we identified several additional gaps worth calling out. These are areas where the regulatory environment or the threat landscape has moved faster than institutional documentation.

Research Security Documentation. Federal research security requirements have expanded significantly in recent years. NSPM-33 (National Security Presidential Memorandum 33) arrived in 2021, the CHIPS and Science Act followed in 2022, and CMMC 2.0 took effect in December 2024. Institutional documentation has not kept pace. At Tier 1 institutions, we found International Travel Security (S-24) published at just 6% and Security Exception Management (S-23) at 7%. These are operational policies that make federal research compliance possible.

AI Governance Policy. At Tier 1, we found documented AI governance policies at 47% of institutions. At Tier 3 (non-research graduate), adoption dropped to 32%. AI tools are everywhere, but governance hasn’t caught up. Institutions’ exposure to AI risks that affect data protection and academic integrity grows every day.

Third-Party Risk Monitoring. 95% of institutions assess vendors during procurement, but only 15% continue monitoring afterward ². Breaches involving third party providers like MOVEit ³ and Blackbaud ⁴ showed what can happen after the contract is signed.

Zero Trust Architecture. We found a Zero Trust standard at only 7% of Tier 1 institutions, dropping to nearly zero at smaller institutions. Even though 70% of security professionals want training on Zero Trust ⁵, almost no institution has documented strategies.

Identifying policy gaps at your institution may feel overwhelming, but we’ll help you prioritize which to correct first.

Interpreting the Data

Two conventions shape how the data in this chapter should be read. The first distinguishes prevalence from applicability. The second defines the prevalence tiers the rest of the book uses.

Prevalence vs. Applicability

Before we go further, there’s one thing to be aware of. This guide shows the “prevalence” of different policies and standards. This represents what percentage of institutions have documented a policy or standard, not how many institutions need one.

For example, we found Identity Theft Prevention (P-16) policies at only 11% of Tier 1 institutions. That doesn’t mean identity theft prevention isn’t important. The FTC Red Flags Rule has required written identity theft prevention programs since 2009 for any institution that extends credit to students (including tuition payment plans). The 11% figure likely means the sector has a policy documentation gap, not that 89% of institutions made a deliberate decision to skip it.

The same logic applies to emerging items like AI Governance (P-12) at 47% and International Travel Security (S-24) at 6%. Low prevalence can show that a requirement is new, that institutions are slow to document existing practices, or that the sector has a genuine blind spot. Low adoption rates don’t make the item optional for your institution. Your regulatory profile (Chapter 7) determines which policies and standards you need. Prevalence data tells you where you stand relative to peers, not where you should stop building.

Prevalence Tiers

In the framework, we calculate prevalence as the percentage of Tier 1 institutions that have publicly published a policy or standard. Prevalence tells you how common an item is across the sector. It doesn’t tell you whether that item applies to your institution.

Based on the prevalence data, we divide the IT Policy Framework into three tiers.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Tier	Definition
Universal	Found at 90% or more of Tier 1 institutions. Typically legally or operationally essential.
Common	Found at 50-89% of Tier 1 institutions. Indicators of well-developed security programs.
Emerging	Found at fewer than 50% of Tier 1 institutions. Growing in importance.

\n\n

What the Data Leaves Out

The framework measures what’s written down. It doesn’t measure why.

Why has the sector reached broad consensus on authentication standards but not on ransomware response? Why do 95% of Tier 1 institutions publish policies while only 37% of Tier 5 institutions publish their standards? Why are institutions with the smallest security teams also the least likely to have a documented plan for the threats they face most?

The numbers surface the patterns. They don’t explain them.

The rest of the book works on the explanation. Chapter 3 maps the cultural and operational site conditions that shape what higher education institutions can build. From there, the book walks through framework alignment, the regulatory loads institutions carry, the 41-item inventory in detail, the research enterprise, and the operational model that holds it all together.

The data in this chapter is the starting point. The rest of the book is how you use it.

The Public/Private Divergence

If you’re benchmarking against peers, public institution adoption rates are more reliable across all tiers. Private institution rates should be treated as directional rather than definitive. Here’s why.

Public institutions consistently show higher policy adoption rates than private institutions. While this may indicate that private institutions are more likely to keep policies and standards behind authentication, that explanation alone doesn’t match the observed data.

At Tier 1, visibility rates are nearly identical. 94% of public institutions and 96% of private institutions publish their policies publicly. But public institutions still score over 6 points higher on average on our 100-point Diagnostic Score. The gap is real. Public institutions face state requirements, shared governance mandates, and public accountability expectations that all push toward formal documentation.

At non-research institutions, the difference between public and private institutions is less clear. Small private institutions are more likely to place their documentation behind authentication, so our assessment can see less of what they’ve built. We can’t say for certain how wide the public versus private adoption gaps are at those tiers.

Chapter 2 Key Takeaways

\n
This chapter is a 2026 snapshot. The CampusCISO IT Policy Framework evolves slowly, and this guide’s interpretation of it is durable. The prevalence figures, three patterns, and additional gaps in this chapter will refresh with each edition of the framework.
\n
\n
Three diagnostic patterns shape the current landscape. A strong Authentication Floor proves the sector can reach consensus. A steep Ransomware Cliff shows where response documentation falls off at smaller institutions. An Oral Tradition Liability shows where technical practices live in people’s heads instead of written standards.
\n
\n
Prevalence is not applicability. Low adoption of a policy across the sector doesn’t make it optional for your institution. Your regulatory profile determines what you need. The data tells you where you stand relative to peers, not where you should stop building.
\n
\n
The data measures governance architecture, not operational effectiveness. A documented ransomware response plan scores the same as one that’s been tested monthly. Whether your backups actually restore, whether your policies are actually followed, and whether your controls actually work are separate questions this data doesn’t answer.
\n

Chapter 3 looks at the ground the sector builds on: shared governance, academic freedom, the open campus, and the cultural dynamics that make higher education security programs fundamentally different from anything in the corporate playbook.

* * *

\n\n

Check Point Research, “Global Cyber Attacks Surge 21% in Q2 2025,” July 2025, https://blog.checkpoint.com/research/global-cyber-attacks-surge-21-in-q2-2025-europe-experiences-the-highest-increase-of-all-regions/.↩︎
EDUCAUSE, “EDUCAUSE QuickPoll Results: Third-Party Risk Management Practices in Higher Education,” August 2024, https://er.educause.edu/articles/2024/8/educause-quickpoll-results-third-party-risk-management-practices-in-higher-education.↩︎
Dark Reading, “MOVEit Breach Impact on Higher Education,” 2023, https://www.darkreading.com/cyberattacks-data-breaches/moveit-breach-impact-higher-education.↩︎
Inside Higher Ed, “US Institutions Affected by Blackbaud Cyberattack,” July 2020, https://www.insidehighered.com/quicktakes/2020/07/31/us-institutions-affected-blackbaud-cyberattack.↩︎
ISC2, “Zero Trust Skills Gap,” June 2024, https://www.isc2.org/Insights/2024/06/Zero-Trust-Skills-Gap.↩︎

Chapter 3: The Site Conditions

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Warning

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Soil Conditions: Shared Governance

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Policy as Legislation

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Getting Things Done Takes Longer

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What Shared Governance Looks Like

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What This Means for Your Program

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Exterior Windows: Academic Freedom

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Your Mission Is Inquiry

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Security Cannot Obstruct Learning

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Designing Programs That Let Light In

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What This Means for Your Program

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Public Easements: Open Campus

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Residential Networks and Guest Access

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

BYOD Is the Baseline

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Perimeter Defense Is Ineffective

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Rethinking Where Security Protections Live

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Unplanned Paths: Shadow IT

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Why Shadow IT Thrives in Higher Education

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Working With Shadow IT, Not Against It

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What This Means for Your Program

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 3 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 4: Framework Alignment

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Defensibility Imperative

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The “Reasonable Security” Problem

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Safe Harbor Laws: Framework Alignment as Legal Protection

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Beyond Legal Protection

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Four Common Frameworks

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

NIST Cybersecurity Framework 2.0 (NIST CSF)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

NIST SP 800-171 (Protecting CUI)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

CISA Cross-Sector Cybersecurity Performance Goals (CPGs)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

ISO 27001/27002

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Matching the Framework to Your Team

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Layered Approach

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Metaframework Approach

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 4 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Part II: The Framework

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 5: The Blueprints

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Design Your Internal Building Layout

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Governance Hierarchy

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Policies: The “Why”

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Standards: The “What”

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Why This Distinction Matters

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The governance hierarchy in practice

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Example Policy Structures from Higher Education

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 5 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 6: The Inventory

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Reading the Inventory

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Policies (17)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Universal Policies (7)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Common Policies (5)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Emerging Policies (5)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Standards (24)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Universal Standards (11)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Common Standards (9)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Emerging Standards (4)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Where to Go Next

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 6 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Part III: Applying the Framework

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 7: Structural Loads

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Weight Your Building Must Support

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

A. The Foundation: Universal Loads

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

FERPA: The Student Records Constant

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

GLBA Safeguards Rule: The Financial Aid Floor

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

PCI-DSS: The Payment Card Reality

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

ADA and Section 508: The Accessibility Baseline

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

HEOA and Copyright: The P2P Compliance Requirement

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

B. Environmental Loads

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Privacy Laws: The Patchwork Problem

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

FTC Red Flags Rule: The Forgotten Mandate

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Cyber Insurance Requirements: The Market Load

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

C. Mission-Specific Loads

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Protecting Controlled Unclassified Information (CUI)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

CMMC: How DoD Verifies Compliance

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

NSPM-33 and CHIPS Act: The Research Security Landscape

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Export Controls: The International Collaboration Constraint

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

HIPAA: The Health System Load

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Determining Your Institution’s Regulatory Load

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Assessment questions:

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 7 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 8: Designing for Research

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Research Distinction

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Principal Investigators Are Like Entrepreneurs

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Research Computing: A Different Architecture

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Why Research Computing Doesn’t Fit Typical Security Controls

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

A General Approach: Tiered Environments

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What This Means for Your Program

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

How Research Governance Works

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Research Governance Has Its Own Authority Structure

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What This Means for Governance

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

How Research Data Is Managed

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Research Data Management Plans

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Data Retention Might Span Decades

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\nThis content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Research Sponsors May Have Additional Requirements

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

How Research Requirements Shift Security Priorities

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What This Means for Your Planning

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 8 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 9: Designing Your Policy Architecture

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Too-Many-Programs Trap

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Risk-Tiered Data Classification

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Four-tier Data Classification Model

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Distinction between Confidential and Regulated

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The high-water-mark principle

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Minimize the Scope of Your Most Restrictive Tier

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Mapping Regulations to the Framework

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Supporting New Compliance Requirements

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Anti-Pattern: A New Policy for Every Requirement

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

A Better Approach: Classify Data, Then Enhance

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What Makes the Layering Work

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

From Structure to Execution

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 9 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Part IV: Building Your Program

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 10: Conducting the Inspection

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Documentation Meets Reality

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Quick Inspection

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Inspection Process

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Step 1: Gather Your Documentation

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Estimating the Effort: The Resource Reality Check

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

A Note About Scoring

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Watch for Fragmentation

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Scale of the Problem

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

How Fragmentation Happens

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Best Practices for Preventing Fragmentation

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

During Your Inspection

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Step 2: Create Your Inventory

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Step 3: Assess Against the Framework

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

For Each Policy (P-01 through P-17)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

For Each Standard (S-01 through S-24)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Calculating a Diagnostic Score

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Determining Your Relative Maturity

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Step 4: Prioritize Your Gaps

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Priority 1: Universal Items with Gaps

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Priority 2: Legally Required Items

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Priority 3: Mission-Critical Items

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Priority 4: Common Items with Gaps

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Priority 5: Emerging Items

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Step 5: Document Your Findings

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Your Inspection Is Complete

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 10 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 11: The Improvement Roadmap

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

From Inspection to Roadmap

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Why Annual Reviews Should Be Your Standard

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Prioritization Hierarchy

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Phase 1: Shore Up the Foundation

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Acceptable Use of Information Technology (P-03)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Privacy Policy (P-05)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Information Security Policy (P-09)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Phase 1 Checkpoint

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Phase 1 Quick Win: Extract Embedded Standards

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

How to identify candidates

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Phase 2: Address the Structural Loads

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Compliance-Driven Priorities

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

If you extend credit to students (most institutions):

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

If you process payment cards (most institutions):

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

If you have federal research funding (R1/R2 institutions):

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Operationally Driven Priorities

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

If ransomware is one of your top IT risks:

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

If third-party vendor management is one of your major risks:

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Phase 2 Checkpoint

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Phase 3: Plan for Expansion

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

AI Governance (P-12)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Digital Presence / Web Governance (P-14)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Institutional Access to Electronic Information (P-17)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Security Exception Management (S-23)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Zero Trust Architecture (S-20)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Building Your Roadmap

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Estimating the Work

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Matching Commitments to Capacity

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Three Commitment Buckets

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Establishing an Annual Cycle

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Don’t Forget the Culture Work

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Communication Template

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 11 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Conclusion: The Path Forward

Across this guide, we explored why Governance Debt exists, what the landscape looks like, how higher education is different from other sectors, which frameworks fit your team, and which regulatory loads you need to consider. From there, we turned to the work itself.

Looking back, here’s what we covered:

\nThe framework blueprints (Chapters 5 and 6)\n
\nHow to support the research enterprise (Chapter 8)\n
\nHow to simplify meeting overlapping regulations (Chapter 9)\n
\nHow to conduct the Inspection (Chapter 10)\n
\nHow to build the improvement roadmap (Chapter 11)\n

That’s a lot of ground. And now you have a complete view of how to start refreshing your IT policy library.

But let’s be honest about what “doing it yourself” means in higher education. It means relying on staff who already have full-time jobs, competing priorities, and a project roadmap that slides quarter after quarter because there’s always a more urgent fire to fight. Whether you run a project internally or bring in outside help, the work doesn’t have to happen all at once. It does have to start.

Remember the opening of this guide and the gap between design drawings and as-built reality. That gap isn’t a failure. It reflects the actual work needed to maintain IT policies at your institution. Programs evolve under pressure, with limited staff, shifting leadership, and regulations that change faster than documentation can keep up. Building a mature policy program requires closing the gap between your design and your as-built reality.

The work ahead is straightforward even if it isn’t easy. You’ll need to update your policies so they reflect how work actually happens, not how someone imagined it would happen a decade ago. And you’ll need to do this on an annual cadence rather than as a one-time upgrade project. This helps you adapt as regulations change, threats grow, and higher education best practices evolve each year.

The institutions that do this well treat governance as maintenance. Each year’s roadmap gets built from the previous year’s Inspection, and deferred items are evaluated fresh each cycle. This helps you balance effort against risk without letting the backlog paralyze you.

Your Governance Debt doesn’t disappear overnight, but it stops compounding. Start a recurring improvement cycle. Your first roadmap won’t be perfect. That’s fine. Each year, your Inspection and planning process will improve and your Governance Debt will shrink.

\n\n

Where to go from here

Policy work can be tackled internally or with outside support. The CampusCISO offerings below map to a range of institutional needs.

Start with this framework. The CampusCISO IT Policy Framework, updated annually, is freely available at campusciso.com/it-policy-guide. The Community Edition is the foundation that all other CampusCISO IT Policy offerings build on. Institutions can use it on its own as a reference for self-directed work.

Build it with the guide. Building IT Policy Programs for Higher Education interprets the framework. It includes a light assessment workflow and a structured approach to building a development roadmap. An institution with the staff capacity and the patience will find everything it needs in the book to build a defensible IT policy improvement cycle.

Get a baseline diagnostic. The IT Policy Diagnostic delivers a 0-100 score and a prioritized gap list within two business days. It’s the fastest way to answer “Where do we actually stand?” with evidence to bring to leadership. Useful for new CISOs in their first 90 days, programs preparing for audit, and any institution that wants a defensible baseline without committing to a larger engagement.

Get a development roadmap. The IT Policy Roadmap provides a detailed review of every policy in an institution’s portfolio, peer benchmarking, and a sequenced development plan weighted by impact, cost, complexity, and regulatory support. Ideal for institutions that want to identify defensible improvement priorities.

Make it ongoing. CampusCISO membership turns governance from a one-time project into a continuous improvement cycle with ongoing access to expert advisory support.

For the full service catalog, visit campusciso.com.

Document Information

\nPublication: Building IT Policy Programs for Higher Education\n
\nOriginally Published: May 2026\n
\nAuthor: Chris Schreiber, Founder, CampusCISO\n
\nRecommended Citation: Schreiber, C. (2026). Building IT Policy Programs for Higher Education. CampusCISO.\n
\nAvailability: Available at campusciso.com/it-policy-guide\n

About CampusCISO

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Contact

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Glossary of Terms

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Framework Reference Codes

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Definitions

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n\n

\n\n","metaText","A guide to measure and close IT policy gaps in higher education, grounded in annual research across 400+ institutions including every US R1 university.","slug","campusciso_it_policy","tocStructure",[44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,19],"publicChapterContent","showReadLinkString","sample",{"_22":23,"_12":313,"_25":-5,"_26":314,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":311,"_25":-5,"_26":312,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":309,"_25":-5,"_26":310,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":307,"_25":-5,"_26":308,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":305,"_25":-5,"_26":306,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":303,"_25":-5,"_26":304,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":301,"_25":-5,"_26":302,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":299,"_25":-5,"_26":300,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":297,"_25":-5,"_26":298,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":295,"_25":-5,"_26":296,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":293,"_25":-5,"_26":294,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":291,"_25":-5,"_26":292,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":289,"_25":-5,"_26":290,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":287,"_25":-5,"_26":288,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":285,"_25":-5,"_26":286,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":283,"_25":-5,"_26":284,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":281,"_25":-5,"_26":282,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":279,"_25":-5,"_26":280,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":277,"_25":-5,"_26":278,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":275,"_25":-5,"_26":276,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":273,"_25":-5,"_26":274,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":271,"_25":-5,"_26":272,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":269,"_25":-5,"_26":270,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":267,"_25":-5,"_26":268,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":265,"_25":-5,"_26":266,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":263,"_25":-5,"_26":264,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":261,"_25":-5,"_26":262,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":259,"_25":-5,"_26":260,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":257,"_25":-5,"_26":258,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":255,"_25":-5,"_26":256,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":253,"_25":-5,"_26":254,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":251,"_25":-5,"_26":252,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":249,"_25":-5,"_26":250,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":247,"_25":-5,"_26":248,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":245,"_25":-5,"_26":246,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":243,"_25":-5,"_26":244,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":241,"_25":-5,"_26":242,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":239,"_25":-5,"_26":240,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":237,"_25":-5,"_26":238,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":235,"_25":-5,"_26":236,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":233,"_25":-5,"_26":234,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":231,"_25":-5,"_26":232,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":229,"_25":-5,"_26":230,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":227,"_25":-5,"_26":228,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":225,"_25":-5,"_26":226,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":223,"_25":-5,"_26":224,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":221,"_25":-5,"_26":222,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":219,"_25":-5,"_26":220,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":217,"_25":-5,"_26":218,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":215,"_25":-5,"_26":216,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":213,"_25":-5,"_26":214,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":211,"_25":-5,"_26":212,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":209,"_25":-5,"_26":210,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":207,"_25":-5,"_26":208,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":205,"_25":-5,"_26":206,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":203,"_25":-5,"_26":204,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":201,"_25":-5,"_26":202,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":199,"_25":-5,"_26":200,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":197,"_25":-5,"_26":198,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":195,"_25":-5,"_26":196,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":193,"_25":-5,"_26":194,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":191,"_25":-5,"_26":192,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":189,"_25":-5,"_26":190,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":187,"_25":-5,"_26":188,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":185,"_25":-5,"_26":186,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":183,"_25":-5,"_26":184,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":181,"_25":-5,"_26":182,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":179,"_25":-5,"_26":180,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":177,"_25":-5,"_26":178,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":175,"_25":-5,"_26":176,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":173,"_25":-5,"_26":174,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":171,"_25":-5,"_26":172,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":169,"_25":-5,"_26":170,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":167,"_25":-5,"_26":168,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":165,"_25":-5,"_26":166,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":163,"_25":-5,"_26":164,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":161,"_25":-5,"_26":162,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":159,"_25":-5,"_26":160,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":157,"_25":-5,"_26":158,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":155,"_25":-5,"_26":156,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":153,"_25":-5,"_26":154,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":151,"_25":-5,"_26":152,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":149,"_25":-5,"_26":150,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":147,"_25":-5,"_26":148,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":145,"_25":-5,"_26":146,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":143,"_25":-5,"_26":144,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":141,"_25":-5,"_26":142,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":139,"_25":-5,"_26":140,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":137,"_25":-5,"_26":138,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":134,"_25":-5,"_26":135,"_28":29,"_30":-5,"_31":-5,"_32":-5},"About CampusCISO","#about-campusciso",3,"Document Information","#document-information","Where to go from here","#where-to-go-from-here","Conclusion: The Path Forward","#conclusion-the-path-forward","Chapter 11 Key Takeaways","#chapter-11-key-takeaways","Communication Template","#communication-template","Don’t Forget the Culture Work","#dont-forget-the-culture-work","Building Your Roadmap","#building-your-roadmap","Phase 3: Plan for Expansion","#phase-3-plan-for-expansion","Phase 2: Address the Structural Loads","#phase-2-address-the-structural-loads","Phase 1: Shore Up the Foundation","#phase-1-shore-up-the-foundation","The Prioritization Hierarchy","#the-prioritization-hierarchy","Why Annual Reviews Should Be Your Standard","#why-annual-reviews-should-be-your-standard","From Inspection to Roadmap","#from-inspection-to-roadmap","Chapter 11: The Improvement Roadmap","#chapter-11-the-improvement-roadmap","Chapter 10 Key Takeaways","#chapter-10-key-takeaways","Your Inspection Is Complete","#your-inspection-is-complete","Step 5: Document Your Findings","#step-5-document-your-findings","Step 4: Prioritize Your Gaps","#step-4-prioritize-your-gaps","Step 3: Assess Against the Framework","#step-3-assess-against-the-framework","Step 2: Create Your Inventory","#step-2-create-your-inventory","Step 1: Gather Your Documentation","#step-1-gather-your-documentation","The Inspection Process","#the-inspection-process","The Quick Inspection","#the-quick-inspection","Documentation Meets Reality","#documentation-meets-reality","Chapter 10: Conducting the Inspection","#chapter-10-conducting-the-inspection","Part IV: Building Your Program","#part-iv-building-your-program","Chapter 9 Key Takeaways","#chapter-9-key-takeaways","From Structure to Execution","#from-structure-to-execution","What Makes the Layering Work","#what-makes-the-layering-work","Supporting New Compliance Requirements","#supporting-new-compliance-requirements","Mapping Regulations to the Framework","#mapping-regulations-to-the-framework","Minimize the Scope of Your Most Restrictive Tier","#minimize-the-scope-of-your-most-restrictive-tier","Risk-Tiered Data Classification","#risk-tiered-data-classification","The Too-Many-Programs Trap","#the-too-many-programs-trap","Chapter 9: Designing Your Policy Architecture","#chapter-9-designing-your-policy-architecture","Chapter 8 Key Takeaways","#chapter-8-key-takeaways","How Research Data Is Managed","#how-research-data-is-managed","How Research Governance Works","#how-research-governance-works","Research Computing: A Different Architecture","#research-computing-a-different-architecture","Principal Investigators Are Like Entrepreneurs","#principal-investigators-are-like-entrepreneurs","The Research Distinction","#the-research-distinction","Chapter 8: Designing for Research","#chapter-8-designing-for-research","Chapter 7 Key Takeaways","#chapter-7-key-takeaways","Determining Your Institution’s Regulatory Load","#determining-your-institutions-regulatory-load","C. Mission-Specific Loads","#c-mission-specific-loads","B. Environmental Loads","#b-environmental-loads","A. The Foundation: Universal Loads","#a-the-foundation-universal-loads","The Weight Your Building Must Support","#the-weight-your-building-must-support","Chapter 7: Structural Loads","#chapter-7-structural-loads","Part III: Applying the Framework","#part-iii-applying-the-framework","Chapter 6 Key Takeaways","#chapter-6-key-takeaways","Where to Go Next","#where-to-go-next","Standards (24)","#standards-24","Policies (17)","#policies-17","Reading the Inventory","#reading-the-inventory","Chapter 6: The Inventory","#chapter-6-the-inventory","Chapter 5 Key Takeaways","#chapter-5-key-takeaways","The Governance Hierarchy","#the-governance-hierarchy","Design Your Internal Building Layout","#design-your-internal-building-layout","Chapter 5: The Blueprints","#chapter-5-the-blueprints","Part II: The Framework","#part-ii-the-framework","Chapter 4 Key Takeaways","#chapter-4-key-takeaways","Matching the Framework to Your Team","#matching-the-framework-to-your-team","Four Common Frameworks","#four-common-frameworks","The Defensibility Imperative","#the-defensibility-imperative","Chapter 4: Framework Alignment","#chapter-4-framework-alignment","Chapter 3 Key Takeaways","#chapter-3-key-takeaways","The Unplanned Paths: Shadow IT","#the-unplanned-paths-shadow-it","The Public Easements: Open Campus","#the-public-easements-open-campus","The Exterior Windows: Academic Freedom","#the-exterior-windows-academic-freedom","The Soil Conditions: Shared Governance","#the-soil-conditions-shared-governance","The Warning","#the-warning","Chapter 3: The Site Conditions","#chapter-3-the-site-conditions","Chapter 2 Key Takeaways","#chapter-2-key-takeaways","What the Data Leaves Out","#what-the-data-leaves-out","Interpreting the Data","#interpreting-the-data","Additional Gaps Across the Sector","#additional-gaps-across-the-sector","Three Patterns That Define the Landscape","#three-patterns-that-define-the-landscape","About the Data","#about-the-data","A Yearly Snapshot of the Sector","#a-yearly-snapshot-of-the-sector","Chapter 2: The 2026 Policy Landscape","#chapter-2-the-2026-policy-landscape","Chapter 1 Key Takeaways","#chapter-1-key-takeaways","The Blueprint Is Not Your Building","#the-blueprint-is-not-your-building","What a Well-Built Program Makes Possible","#what-a-well-built-program-makes-possible","What Happens When Governance Debt Comes Due","#what-happens-when-governance-debt-comes-due","Design Drawings vs. As-Built Reality","#design-drawings-vs-as-built-reality","Chapter 1: The As-Built Standard","#chapter-1-the-as-built-standard","Part I: Foundations","#part-i-foundations","Executive Summary","#executive-summary",{"_12":13,"_37":38,"_35":36,"_458":459,"_460":461,"_462":463,"_42":43,"_464":465,"_466":467},"parts",[414],"toc",[323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409,410,411,412,413],"isUnavailableOnline",false,"unavailableMessage",{"_22":23,"_12":313,"_25":-5,"_26":314,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":311,"_25":-5,"_26":312,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":309,"_25":-5,"_26":310,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":307,"_25":-5,"_26":308,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":305,"_25":-5,"_26":306,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":303,"_25":-5,"_26":304,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":301,"_25":-5,"_26":302,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":299,"_25":-5,"_26":300,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":297,"_25":-5,"_26":298,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":295,"_25":-5,"_26":296,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":293,"_25":-5,"_26":294,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":291,"_25":-5,"_26":292,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":289,"_25":-5,"_26":290,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":287,"_25":-5,"_26":288,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":285,"_25":-5,"_26":286,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":283,"_25":-5,"_26":284,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":281,"_25":-5,"_26":282,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":279,"_25":-5,"_26":280,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":277,"_25":-5,"_26":278,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":275,"_25":-5,"_26":276,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":273,"_25":-5,"_26":274,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":271,"_25":-5,"_26":272,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":269,"_25":-5,"_26":270,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":267,"_25":-5,"_26":268,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":265,"_25":-5,"_26":266,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":263,"_25":-5,"_26":264,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":261,"_25":-5,"_26":262,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":259,"_25":-5,"_26":260,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":257,"_25":-5,"_26":258,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":255,"_25":-5,"_26":256,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":253,"_25":-5,"_26":254,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":251,"_25":-5,"_26":252,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":249,"_25":-5,"_26":250,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":247,"_25":-5,"_26":248,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":245,"_25":-5,"_26":246,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":243,"_25":-5,"_26":244,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":241,"_25":-5,"_26":242,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":239,"_25":-5,"_26":240,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":237,"_25":-5,"_26":238,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":235,"_25":-5,"_26":236,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":233,"_25":-5,"_26":234,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":231,"_25":-5,"_26":232,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":229,"_25":-5,"_26":230,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":227,"_25":-5,"_26":228,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":225,"_25":-5,"_26":226,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":223,"_25":-5,"_26":224,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":221,"_25":-5,"_26":222,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":219,"_25":-5,"_26":220,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":217,"_25":-5,"_26":218,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":215,"_25":-5,"_26":216,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":213,"_25":-5,"_26":214,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":211,"_25":-5,"_26":212,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":209,"_25":-5,"_26":210,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":207,"_25":-5,"_26":208,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":205,"_25":-5,"_26":206,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":203,"_25":-5,"_26":204,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":201,"_25":-5,"_26":202,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":199,"_25":-5,"_26":200,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":197,"_25":-5,"_26":198,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":195,"_25":-5,"_26":196,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":193,"_25":-5,"_26":194,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":191,"_25":-5,"_26":192,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":189,"_25":-5,"_26":190,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":187,"_25":-5,"_26":188,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":185,"_25":-5,"_26":186,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":183,"_25":-5,"_26":184,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":181,"_25":-5,"_26":182,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":179,"_25":-5,"_26":180,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":177,"_25":-5,"_26":178,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":175,"_25":-5,"_26":176,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":173,"_25":-5,"_26":174,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":171,"_25":-5,"_26":172,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":169,"_25":-5,"_26":170,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":167,"_25":-5,"_26":168,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":165,"_25":-5,"_26":166,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":163,"_25":-5,"_26":164,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":161,"_25":-5,"_26":162,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":159,"_25":-5,"_26":160,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":157,"_25":-5,"_26":158,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":155,"_25":-5,"_26":156,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":153,"_25":-5,"_26":154,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":151,"_25":-5,"_26":152,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":149,"_25":-5,"_26":150,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":147,"_25":-5,"_26":148,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":145,"_25":-5,"_26":146,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":143,"_25":-5,"_26":144,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":141,"_25":-5,"_26":142,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":139,"_25":-5,"_26":140,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":136,"_12":137,"_25":-5,"_26":138,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":134,"_25":-5,"_26":135,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":24,"_25":-5,"_26":27,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_12":13,"_25":415,"_28":416,"_417":418},"",0,"chapters",[419,420,421,422,423,424,425,426,427,428,429,430,431,432,433,434,435,436,437],{"_22":23,"_12":313,"_26":314,"_28":29,"_438":457,"_32":-5},{"_22":23,"_12":311,"_26":312,"_28":29,"_438":456,"_32":-5},{"_22":23,"_12":309,"_26":310,"_28":29,"_438":455,"_32":-5},{"_22":23,"_12":297,"_26":298,"_28":29,"_438":454,"_32":-5},{"_22":23,"_12":281,"_26":282,"_28":29,"_438":453,"_32":-5},{"_22":23,"_12":267,"_26":268,"_28":29,"_438":452,"_32":-5},{"_22":23,"_12":257,"_26":258,"_28":29,"_438":451,"_32":-5},{"_22":23,"_12":255,"_26":256,"_28":29,"_438":450,"_32":-5},{"_22":23,"_12":247,"_26":248,"_28":29,"_438":449,"_32":-5},{"_22":23,"_12":235,"_26":236,"_28":29,"_438":448,"_32":-5},{"_22":23,"_12":233,"_26":234,"_28":29,"_438":447,"_32":-5},{"_22":23,"_12":219,"_26":220,"_28":29,"_438":446,"_32":-5},{"_22":23,"_12":205,"_26":206,"_28":29,"_438":445,"_32":-5},{"_22":23,"_12":187,"_26":188,"_28":29,"_438":444,"_32":-5},{"_22":23,"_12":185,"_26":186,"_28":29,"_438":443,"_32":-5},{"_22":23,"_12":163,"_26":164,"_28":29,"_438":442,"_32":-5},{"_22":23,"_12":141,"_26":142,"_28":29,"_438":441,"_32":-5},{"_22":23,"_12":134,"_26":135,"_28":29,"_438":440,"_32":-5},{"_22":23,"_12":24,"_26":27,"_28":29,"_438":439,"_32":-5},"subsections",[],[],[410,411],[399,400,401,402,403,404,405,406,407,408],[388,389,390,391,392,393,394,395,396,397],[],[378,379,380,381,382,383,384,385],[371,372,373,374,375,376],[364,365,366,367,368,369],[],[357,358,359,360,361],[353,354,355],[],[347,348,349,350],[340,341,342,343,344,345],[332,333,334,335,336,337,338],[326,327,328,329,330],[],[],"coverFeatured",{"_477":479},"coverFeatured2x",{"_477":478},"authors",[468],"samplePdfUrl","https://s3.amazonaws.com/samples.leanpub.com/campusciso_it_policy-sample.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=0XBXHW3Q9GGV69BT7E82%2F20260620%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260620T075849Z&X-Amz-Expires=518400&X-Amz-SignedHeaders=host&X-Amz-Signature=1ad8ed3ab483a934104e1c3cb78ba31b4d50b1bb568dbc22eef8778090a34cb8","sampleEpubUrl","https://s3.amazonaws.com/samples.leanpub.com/campusciso_it_policy-sample.epub?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=0XBXHW3Q9GGV69BT7E82%2F20260620%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260620T075849Z&X-Amz-Expires=518400&X-Amz-SignedHeaders=host&X-Amz-Signature=11d20e2f501feb6feedde1396ea8e436c04b86659275a52e7bd1cf416687e117",{"_469":470,"_471":472,"_473":474},"id","Z2lkOi8vbGVhbnB1Yi9TdG9yZTo6UHJvZHVjdEF1dGhvci84MzQ0NQ","name","Chris Schreiber","user",{"_475":476},"username","christianschreiber","url","https://d2sofvawe08yqg.cloudfront.net/campusciso_it_policy/s_featured2x?1777322565&1777322565","https://d2sofvawe08yqg.cloudfront.net/campusciso_it_policy/s_featured?1777322565&1777322565","shoppingCartId","shoppingCart",{"_469":513,"_514":416,"_515":504,"_516":415,"_517":518,"_519":520,"_521":504},"locale","en","readerTheme","light","constants",{"_511":512},"publishers",{"_507":508,"_509":510},"learnerOrganizations",[],"needsLocaleCookieSync","announcements",{"_500":501,"_502":-5},"sentryEnvironment","production","sentryRelease","063214e46136b0966a4eb4e36fd8e4a730bc4c19","announcement_store",{"_503":504,"_505":506},"announcement_authors","flag",true,"text","

Kick off your book project in 2 hours, get started with GhostAI in 2 hours, or do both! Free live workshops, on Zoom. You’ll leave with a real book project and a clear plan to keep going. Saturday, June 27, 2026.

\n","companies",[],"universities",[],"paypalClientId","AX53Cwz8jR6rVVzzZiZNWWXl0dGagi-GZrjG-S3Ua14E5nrKMn7DxDQ730O4R8LusLPp49ALn6aRVaEy","no-cart","count","free","updatedAt","paymentGateway","STRIPE","cartItems",[],"loading"]

About CampusCISO

Contact

Table of Contents

Executive Summary

Part I: Foundations

Chapter 1: The As-Built Standard

Design Drawings vs. As-Built Reality

What Happens When Governance Debt Comes Due

What a Well-Built Program Makes Possible

The Blueprint Is Not Your Building

Chapter 1 Key Takeaways

Chapter 2: The 2026 Policy Landscape

A Yearly Snapshot of the Sector

About the Data

Three Patterns That Define the Landscape

The Authentication Floor

The Ransomware Cliff

The Oral Tradition Liability

Additional Gaps Across the Sector

Interpreting the Data

Prevalence vs. Applicability

Prevalence Tiers

What the Data Leaves Out

Chapter 2 Key Takeaways

Chapter 3: The Site Conditions

The Warning

The Soil Conditions: Shared Governance

Policy as Legislation

Getting Things Done Takes Longer

What Shared Governance Looks Like

What This Means for Your Program

The Exterior Windows: Academic Freedom

Your Mission Is Inquiry

Security Cannot Obstruct Learning

Designing Programs That Let Light In

What This Means for Your Program

The Public Easements: Open Campus

Residential Networks and Guest Access

BYOD Is the Baseline

Perimeter Defense Is Ineffective

Rethinking Where Security Protections Live

The Unplanned Paths: Shadow IT

Why Shadow IT Thrives in Higher Education

Working With Shadow IT, Not Against It

What This Means for Your Program

Chapter 3 Key Takeaways

Chapter 4: Framework Alignment

The Defensibility Imperative

The “Reasonable Security” Problem

Safe Harbor Laws: Framework Alignment as Legal Protection

Beyond Legal Protection

Four Common Frameworks

NIST Cybersecurity Framework 2.0 (NIST CSF)

NIST SP 800-171 (Protecting CUI)

CISA Cross-Sector Cybersecurity Performance Goals (CPGs)

ISO 27001/27002

Matching the Framework to Your Team

The Layered Approach

The Metaframework Approach

Chapter 4 Key Takeaways

Part II: The Framework

Chapter 5: The Blueprints

Design Your Internal Building Layout

The Governance Hierarchy

Policies: The “Why”

Standards: The “What”

Why This Distinction Matters

The governance hierarchy in practice

Example Policy Structures from Higher Education

Chapter 5 Key Takeaways

Chapter 6: The Inventory

Reading the Inventory

Policies (17)

Universal Policies (7)

Common Policies (5)

Emerging Policies (5)

Standards (24)

Universal Standards (11)

Common Standards (9)

Emerging Standards (4)