[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":-5,"_8":9,"_10":11},"actionData","errors","root",{"_469":-5,"_476":-5,"_477":478,"_479":480,"_481":482,"_483":484,"_485":486,"_487":488,"_489":318,"_490":491},"routes/_store+/_readers+/read_/route","routes/_store+/_readers+/read_.$slug/route",{"_16":312,"_313":314,"_315":316,"_317":318,"_319":-7},"routes/_store+/_readers+/read_.$slug.$chapterId/route",{"_12":13,"_14":15,"_16":17,"_18":19,"_20":21},"title","Building IT Policy Programs for Higher Education","content","

Part III: Applying the Framework

https://leanpub.com/campusciso_it_policy","book",{"_33":34,"_12":13,"_35":36,"_37":38,"_39":40,"_41":42,"_43":15},"nextChapter",{"_22":23,"_12":24,"_25":-5,"_26":27,"_28":29,"_30":-5,"_31":-5,"_32":-5},"sections",[],"level",2,"Chapter 8: Structural Loads","description","path","#chapter-8-structural-loads","fileCount",1,"quizType","sectionNum","youtubeId","previewContent","

\nExecutive Summary\n
\nPart I: Foundations\n
\nChapter 1: The As-Built Standard\n
- \nDesign Drawings vs. As-Built Reality\n
- \nThe Stakes: What Happens When Governance Debt Comes Due\n
- \nThe Promise: What a Well-Built Program Makes Possible\n
- \nThe Blueprint Is Not Your Building\n
- \nChapter 1 Key Takeaways\n
\n
\nChapter 2: The 2026 Policy Landscape\n
- \nA Yearly Snapshot of the Sector\n
- \nAbout the Data\n
- \nThree Patterns That Define the Landscape\n
- \nAdditional Gaps Across the Sector\n
- \nInterpreting the Data\n
- \nWhat the Data Leaves Out\n
- \nChapter 2 Key Takeaways\n
\n
\nChapter 3: The Site Conditions\n
- \nThe Warning\n
- \nThe Soil: Shared Governance\n
- \nThe Light: Academic Freedom\n
- \nThe Access: Open Campus\n
- \nShadow IT: The Unofficial Infrastructure\n
- \nChapter 3 Key Takeaways\n
\n
\nChapter 4: Framework Alignment\n
- \nThe Defensibility Imperative\n
- \nFour Common Frameworks\n
- \nRight-Sizing for Your Team\n
- \nThe Layered Approach\n
- \nThe Metaframework Approach\n
- \nChapter 4 Key Takeaways\n
\n
\nPart II: The Framework\n
\nChapter 5: The Blueprints\n
- \nThe Load-Bearing Walls\n
- \nThe Governance Hierarchy\n
- \nChapter 5 Key Takeaways\n
\n
\nChapter 6: The Policy Inventory\n
- \nThe 17 Policies\n
\n
\nChapter 7: The Standards Inventory\n
- \nThe 24 Standards\n
\n
\nPart III: Applying the Framework\n
\nChapter 8: Structural Loads\n
- \nThe Weight Your Building Must Support\n
- \nA. The Foundation: Universal Loads\n
- \nB. Environmental Loads\n
- \nC. Mission-Specific Loads\n
- \nCalculating Your Institution’s Regulatory Load\n
- \nChapter 8 Key Takeaways\n
\n
\nChapter 9: Designing for Research\n
- \nThe Research Distinction\n
- \nPrincipal Investigators Are Entrepreneurs\n
- \nResearch Computing: A Different Architecture\n
- \nHow Research Governance Works\n
- \nHow Research Data Flows\n
- \nChapter 9 Key Takeaways\n
\n
\nChapter 10: Designing for the Highest Tiers\n
- \nThe Too-Many-Programs Trap\n
- \nRisk-Tiered Data Classification\n
- \nMinimize the Scope of Your Most Restrictive Tier\n
- \nMapping Regulations to the Framework\n
- \nSupporting New Compliance Requirements\n
- \nWhat Makes the Layering Work\n
- \nFrom Structure to Execution\n
- \nChapter 10 Key Takeaways\n
\n
\nPart IV: Building Your Program\n
\nChapter 11: Conducting the Inspection\n
- \nDocumentation Meets Reality\n
- \nIf You Only Have 20 Hours\n
- \nThe Inspection Process\n
- \nStep 1: Gather Your Documentation\n
- \nStep 2: Create Your Inventory\n
- \nStep 3: Assess Against the Framework\n
- \nStep 4: Prioritize the Gaps\n
- \nStep 5: Document Your Findings\n
- \nYour Inspection Is Complete\n
- \nAdditional Support For Your Assessments\n
- \nChapter 11 Key Takeaways\n
\n
\nChapter 12: The Improvement Roadmap\n
- \nFrom Inspection to Roadmap\n
- \nWhy Annual Review Is the Standard\n
- \nThe Prioritization Hierarchy\n
- \nPhase 1: Shore Up the Foundation\n
- \nPhase 2: Address the Structural Loads\n
- \nPhase 3: Future-Proof the Structure\n
- \nBuilding This Year’s Roadmap\n
- \nThe Culture Work\n
- \nThe Project Toolkit\n
- \nChapter 12 Key Takeaways\n
\n
\nConclusion: The Path Forward\n
- \nDocument Information\n
\n
\nGlossary of Terms\n

Executive Summary

You know your policy library has gaps. You just don’t know which ones matter most, or how to find them in a timeframe your team can actually afford.

Higher education IT policy isn’t a documentation problem. It’s a governance problem. Most institutions maintain written policies. But the distance between what should be documented and what exists creates what this guide calls Governance Debt. Like deferred maintenance on a building, it follows predictable patterns and compounds over time. Regulations change, threats evolve, and higher education best practices shift each year, while the documentation stays where it was when someone last had time to update it.

This guide shows you how to measure your Governance Debt and pay it down, not through a one-time renovation project but through an annual cycle your team can actually sustain.

How this guide came together. Over years of advisory work with higher education CIOs and CISOs, we kept seeing the same patterns. Some institutions had well-documented authentication programs but nothing written down for ransomware response. Others had critical technical practices that existed entirely in senior staff members’ heads. We started tracking the patterns as reference material for our own engagements. That reference material evolved into the CampusCISO IT Policy Framework. The 2026 edition reflects analysis of 410 institutional policy libraries across every Carnegie tier, including every R1 research university in the United States.

Three core patterns emerged from the institutions we reviewed:

\nThe Authentication Floor. Identity management is the one area where we found near-universal documented practice.\n
\nThe Ransomware Cliff. Attack volumes against education have nearly doubled in recent years, but we found documented ransomware response procedures at only 57% of Tier 1 (R1) research universities and just 2% of Tier 4 (baccalaureate) institutions.\n
\nThe Oral Tradition Liability. Critical technical practices live in people’s heads instead of written standards. When staff leave, the institution’s security program leaves with them.\n

We defined a framework of 17 policies and 24 standards that reflect what higher education institutions actually do. This was based on observed data from more than 400 institutions, not what a generic framework prescribes.

What you’ll know how to do after reading this:

\nIdentify which policy gaps at your institution create real exposure\n
\nMap your regulatory obligations to the policies and standards that support them, including overlapping requirements that trip up many institutions (FERPA, GLBA, HIPAA, CMMC, NSPM-33, export controls, state breach laws, and the CUI protections now applying to Federal Student Aid data)\n
\nConduct either a high-level self-assessment in about 20 staff hours or a more thorough roadmap exercise in about 70 to 130 hours\n
\nEstablish an annual review and refresh program that fits your team’s actual capacity, with a defensible framework to prioritize what to tackle first and what can wait\n

The goal isn’t to fix everything at once. It’s to establish the annual cadence that keeps your Governance Debt from compounding.

Who this guide is for: CIOs, CISOs, IT leadership, and governance committees at higher education institutions of any size. While the regulatory examples are US-specific, you can apply the structural principles to institutions in any jurisdiction.

\n\n

* * *

Part I: Foundations

Chapter 1: The As-Built Standard

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Design Drawings vs. As-Built Reality

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Stakes: What Happens When Governance Debt Comes Due

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Promise: What a Well-Built Program Makes Possible

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Blueprint Is Not Your Building

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 1 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 2: The 2026 Policy Landscape

* * *

\n\n

A Yearly Snapshot of the Sector

The CampusCISO IT Policy Framework describes the elements of a well-developed higher education IT policy program. This guide shows you how to interpret and apply that framework. This chapter shows you what the sector has actually built against it as of 2026.

We publish a new edition of the framework each year, grounded in fresh research across hundreds of colleges and universities. The 2026 edition draws on 410 institutions, including every R1 research university in the United States. The data behind this chapter comes from that review.

The snapshot changes each year. Ransomware response procedures that appear at 57% of Tier 1 institutions today will appear at a different percentage next year, because more institutions will write them. AI governance policies at 47% today will either climb sharply or stall out, and either outcome tells you something. International Travel Security standards at 6% today are the kind of number that has nowhere to go but up.

Because the numbers move, the chapter moves with them. You’re reading the 2026 edition. If you’re reading this in 2027 or later, pick up the newer edition for the current measurements. The other chapters in this guide won’t have changed much. This one will.

About the Data

Instead of starting with what frameworks tell institutions to do, we looked at what they’re doing. For each institution, we identified the policy repository, mapped every document to our framework inventory, and evaluated how their governance structure coordinates security decisions.

\n\n

Throughout this guide, we organize institutions into CampusCISO Institutional Tiers for benchmarking. CampusCISO uses these tiers across our diagnostic services to provide granularity without identifying specific institutions.

The tiers are currently based on the Carnegie Classification of Institutions of Higher Education, but we designed the system to accommodate non-US institutions in future updates.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

CampusCISO Tier	Current Composition (2026 Sample Size)
Tier 1	R1: Doctoral universities, very high research activity (187)
Tier 2	R2/RCU: Doctoral universities, high research activity (86)
Tier 3	Masters and non-research graduate institutions (39)
Tier 4	Baccalaureate colleges (35)
Tier 5	Community and associate’s colleges (38)
Special Focus	Specialized and tribal institutions (25)

We mapped the framework against NIST CSF 2.0, NIST SP 800-171, CIS Controls v8, and ISO 27001/27002. The goal is to complement those standards, not compete with them.

This framework has three limitations worth noting.

\nThe research measures publicly documented policies, so institutions with robust but unpublished policies may appear less developed.\n
\nAssessments reflect a point in time (December 2025 through January 2026).\n
\nThe presence of a policy document doesn’t guarantee effective implementation.\n

This framework measures governance architecture, not operational effectiveness.

\n\n

What we found wasn’t a single coherent standard. It was hundreds of institutions solving the same problems in different ways, with different names, unique structures, and varying levels of completeness. We distill those diverse approaches into a common framework of 17 policies that establish governance authority and institutional intent, plus 24 standards that specify technical requirements and operational procedures. Each year’s research refines the framework as institutional practice evolves. Throughout this book, we’ll refer to policies and standards using reference numbers like P-01 for policies and S-01 for standards.

The 2026 edition provides a map of where the sector has built consensus and where critical gaps remain. Some policies are nearly universal. Others are quickly gaining traction but haven’t reached critical mass. And some, including ones that federal regulators already ask about, barely exist at all.

Three Patterns That Define the Landscape

Governance Debt doesn’t accumulate evenly. When we analyzed the data, three distinct patterns emerged, each revealing something different about where higher education stands today. You’ll probably recognize some of them in your own environment.

The Authentication Floor

Here’s the good news: some things are working. Over 80% of institutions at every tier have adopted standards for passwords (S-03) and access controls (S-06). Regardless of size, budget, or complexity, nearly every institution has built at least this much. This is the floor, and it proves that sector-wide consensus on security controls is possible. The question is why so few policies and standards have reached such widespread adoption.

The Ransomware Cliff

You already know cyber threats are getting worse. By Q1 2025, weekly cyberattacks against the education sector had increased 73% year-over-year. By Q2 2025, education was absorbing an average of 4,388 attacks per week, more than double the global cross-sector average ¹. Studies consistently show education is one of the most-attacked sectors globally.

So how many institutions have documented what to do when ransomware activates at 2 AM? At Tier 1 institutions, 57%. At Tier 2, 41%. At Tier 4 (baccalaureate) institutions, 2%. The institutions most likely to lack dedicated security staff are also the least likely to have written down a response plan.

The Oral Tradition Liability

The backup schedule lives in a sysadmin’s head. The patching timeline is “when we get to it.” The access review process is “we know who should have an account.”

Across the sector, more than 75% of institutions at every tier publish their IT policies to public repositories. But the technical standards that turn those policies into operational practice tell a different story. Published standards drop from 76% at Tier 1 to just 37% at Tier 5. Sometimes the gap reflects documentation hidden behind authentication that an outside assessment can’t reach. But in our advisory work with campuses of all sizes, we often find something more fundamental. The documentation either doesn’t exist, or it hasn’t been updated in years and stays locked away rather than exposing the accumulated Governance Debt.

Governance Debt hits smaller institutions especially hard. Often, one or two people carry the entire operational playbook in their heads. But the principle applies to institutions of all sizes. When your team doesn’t know what’s expected, you can’t expect the outcomes you need. Staff turnover erases undocumented practices overnight. Auditors and insurance underwriters can’t verify what isn’t written down. And decentralized IT units can’t follow standards that don’t exist in a form they can reference.

The Authentication Floor proves the sector can reach consensus. The other two patterns show where Governance Debt is compounding, and why understanding the current state matters before you start measuring your own institution against it.

Additional Gaps Across the Sector

Beyond the three diagnostic patterns, we identified several additional gaps worth calling out. These are areas where the regulatory environment or the threat landscape has moved faster than institutional documentation.

Research Security Documentation. Federal research security requirements have expanded significantly in recent years. NSPM-33 (National Security Presidential Memorandum 33) arrived in 2021, the CHIPS and Science Act followed in 2022, and CMMC 2.0 took effect in December 2024. Institutional documentation has not kept pace. At Tier 1 institutions, we found International Travel Security (S-24) published at just 6% and Security Exception Management (S-23) at 7%. These are the operational policies that make federal research compliance possible.

AI Governance Policy. At Tier 1, we found documented AI governance policies at 47% of institutions. At Tier 3 (non-research graduate), adoption dropped to 32%. AI tools are everywhere, but governance hasn’t caught up. Institutions’ exposure to AI risks that affect data protection and academic integrity grows every day.

Third-Party Risk Monitoring. 95% of institutions assess vendors during procurement, but only 15% continue monitoring afterward ². Breaches involving third party providers like MOVEit ³ and Blackbaud ⁴ showed what can happen after the contract is signed.

Zero Trust Architecture. We found a Zero Trust standard at only 7% of Tier 1 institutions, dropping to nearly zero at smaller institutions. Even though 70% of security professionals want training on Zero Trust ⁵, almost no institution has documented strategies.

Identifying policy gaps at your institution may feel overwhelming, but we’ll help you prioritize which to correct first.

Interpreting the Data

Two conventions shape how the data in this chapter should be read. The first distinguishes prevalence from applicability. The second defines the prevalence tiers the rest of the book uses.

Prevalence vs. Applicability

One important distinction before we go further: this guide shows the “prevalence” of different policies and standards. This represents what percentage of institutions have documented a policy or standard, not how many institutions need one.

For example, we found Identity Theft Prevention (P-16) policies at only 11% of Tier 1 institutions. That doesn’t mean identity theft prevention isn’t important. The FTC Red Flags Rule has required written identity theft prevention programs since 2009 for any institution that extends credit to students (including tuition payment plans). The 11% figure likely means the sector has a policy documentation gap, not that 89% of institutions made a deliberate decision to skip it.

The same logic applies to emerging items like AI Governance (P-12) at 47% and International Travel Security (S-24) at 6%. Low prevalence can show that a requirement is new, that institutions are slow to document existing practices, or that the sector has a genuine blind spot. Low adoption rates don’t make the item optional for your institution. Your regulatory profile (Chapter 4) determines which policies and standards you need. Prevalence data tells you where you stand relative to peers, not where you should stop building.

The Public/Private Divergence

One final pattern worth noting: public institutions consistently show higher policy adoption rates than private institutions. While this may indicate that private institutions are more likely to keep policies and standards behind authentication, that explanation alone doesn’t match the observed data.

At Tier 1, visibility rates are nearly identical: 94% of public institutions and 96% of private institutions publish their policies publicly. But public institutions still score over 6 points higher on average using our 100-point IT policy adoption score. The gap is real. Public institutions face state requirements, shared governance mandates, and public accountability expectations that all push toward formal documentation.

At non-research institutions, the difference between public and private institutions is less clear. Small private institutions are more likely to place their documentation behind authentication, so our assessment can see less of what they’ve built. We can’t say for certain how wide the public versus private adoption gaps are at those tiers.

The practical takeaway: if you’re benchmarking against peers, public institution adoption rates are more reliable across all tiers. Private institution rates should be treated as directional rather than definitive.

Prevalence Tiers

In the framework, we calculate prevalence as the percent of Tier 1 institutions that have publicly published a policy or standard. Prevalence tells you how common an item is across the sector. It doesn’t tell you whether that item applies to your institution.

Based on the prevalence data, we divide the IT Policy Framework into three tiers.

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

Tier	Definition
Universal	Found at 90% or more of Tier 1 institutions. Typically legally or operationally essential.
Common	Found at 50-89% of Tier 1 institutions. Indicators of well-developed security programs.
Emerging	Found at fewer than 50% of Tier 1 institutions. Growing in importance.

\n\n

What the Data Leaves Out

The framework measures what’s written down. It doesn’t measure why.

Why has the sector reached broad consensus on authentication standards but not on ransomware response? Why do 94% of Tier 1 institutions publish policies while only 37% of Tier 5 institutions publish their standards? Why are institutions with the smallest security teams also the least likely to have a documented plan for the threats they face most?

The numbers surface the patterns. They don’t explain them.

The rest of the book works on the explanation. Chapter 3 maps the cultural and operational site conditions that shape what higher education institutions can build: shared governance, academic freedom, the open campus, and the dynamics that make university security programs structurally different from anything in the corporate or government playbook. From there, the book walks through framework alignment, the regulatory loads institutions carry, the 41-item inventory in detail, the research enterprise, and the operational model that holds it all together.

The data in this chapter is the starting point. The rest of the book is how you use it.

Chapter 2 Key Takeaways

\n
This chapter is a 2026 snapshot. The CampusCISO IT Policy Framework evolves slowly, and this guide’s interpretation of it is durable. The prevalence figures, three patterns, and additional gaps in this chapter will refresh with each edition of the framework.
\n
\n
Three diagnostic patterns shape the current landscape. A strong Authentication Floor proves the sector can reach consensus. A steep Ransomware Cliff shows where response documentation falls off at smaller institutions. An Oral Tradition Liability shows where technical practices live in people’s heads instead of written standards.
\n
\n
Prevalence is not applicability. Low adoption of a policy across the sector doesn’t make it optional for your institution. Your regulatory profile determines what you need. The data tells you where you stand relative to peers, not where you should stop building.
\n
\n
The data measures governance architecture, not operational effectiveness. A documented ransomware response plan scores the same as one that’s been tested monthly. Whether your backups actually restore, whether your policies are actually followed, and whether your controls actually work are separate questions this data doesn’t answer.
\n

Chapter 3 looks at the ground the sector builds on: shared governance, academic freedom, the open campus, and the cultural dynamics that make higher education security programs fundamentally different from anything in the corporate playbook.

* * *

\n\n

Sophos, The State of Ransomware in Education 2025 (2025).↩︎
EDUCAUSE, “EDUCAUSE QuickPoll Results: Third-Party Risk Management Practices in Higher Education,” August 2024, https://er.educause.edu/articles/2024/8/educause-quickpoll-results-third-party-risk-management-practices-in-higher-education.↩︎
Dark Reading, “MOVEit Breach Impact on Higher Education,” 2023, https://www.darkreading.com/cyberattacks-data-breaches/moveit-breach-impact-higher-education.↩︎
Inside Higher Ed, “US Institutions Affected by Blackbaud Cyberattack,” July 2020, https://www.insidehighered.com/quicktakes/2020/07/31/us-institutions-affected-blackbaud-cyberattack.↩︎
ISC2, “Zero Trust Skills Gap,” June 2024, https://www.isc2.org/Insights/2024/06/Zero-Trust-Skills-Gap.↩︎

Chapter 3: The Site Conditions

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Warning

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Soil: Shared Governance

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Policy as Legislation

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Getting Things Done Takes Longer

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What Shared Governance Looks Like

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What This Means for Your Program

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Light: Academic Freedom

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Your Mission Is Inquiry

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Security Cannot Obstruct Learning

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Designing Programs That Let Light In

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What This Means for Your Program

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Access: Open Campus

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Residential Networks and Guest Access

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

BYOD Is the Baseline

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Perimeter Defense Is Ineffective

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Rethinking Where Security Protections Live

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Shadow IT: The Unofficial Infrastructure

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Why Shadow IT Thrives in Higher Education

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Working With Shadow IT, Not Against It

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What This Means for Your Program

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 3 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 4: Framework Alignment

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Defensibility Imperative

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The “Reasonable Security” Problem

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Safe Harbor Laws: Framework Alignment as Legal Protection

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Beyond Legal Protection

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Four Common Frameworks

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

NIST Cybersecurity Framework 2.0 (NIST CSF)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

NIST SP 800-171 (Protecting CUI)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

CIS Controls v8

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

ISO 27001/27002

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Right-Sizing for Your Team

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Layered Approach

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Metaframework Approach

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 4 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Part II: The Framework

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 5: The Blueprints

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Load-Bearing Walls

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Governance Hierarchy

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Policies: The “Why”

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Standards: The “What” and “How”

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Why This Distinction Matters

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What Well-Developed Frameworks Look Like

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 5 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 6: The Policy Inventory

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The 17 Policies

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Universal Policies (7)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Common Policies (5)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Emerging Policies (5)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 7: The Standards Inventory

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The 24 Standards

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Universal Standards (11)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Common Standards (9)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Emerging Standards (4)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Part III: Applying the Framework

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 8: Structural Loads

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Weight Your Building Must Support

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

A. The Foundation: Universal Loads

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

FERPA: The Student Records Constant

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

GLBA Safeguards Rule: The Financial Aid Floor

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

PCI-DSS: The Payment Card Reality

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

ADA and Section 508: The Accessibility Baseline

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

HEOA and Copyright: The P2P Compliance Requirement

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

B. Environmental Loads

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Privacy Laws: The Patchwork Problem

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

FTC Red Flags Rule: The Forgotten Mandate

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Cyber Insurance Requirements: The Market Load

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

C. Mission-Specific Loads

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Protecting Controlled Unclassified Information (CUI)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

CMMC: How DoD Verifies Compliance

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

NSPM-33 and CHIPS Act: The Research Security Landscape

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Export Controls: The International Collaboration Constraint

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

HIPAA: The Health System Load

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Calculating Your Institution’s Regulatory Load

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Assessment questions:

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 8 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 9: Designing for Research

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Research Distinction

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Principal Investigators Are Entrepreneurs

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Research Computing: A Different Architecture

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Why Research Computing Doesn’t Fit Typical Security Controls

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The General Approach: Tiered Environments

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What This Means for Your Program

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

How Research Governance Works

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Research Governance Has Its Own Authority Structure

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What This Means for Governance

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

How Research Data Flows

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Research Data Outlives the Project

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Research Data Management Plans

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Retention Horizons Stretch Decades

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\nThis content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Research Sponsors Have Different Requirements

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

How Research Requirements Shift Security Priorities

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What This Means for Your Planning

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 9 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 10: Designing for the Highest Tiers

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Too-Many-Programs Trap

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Risk-Tiered Data Classification

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Four-tier Data Classification Framework

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Minimize the Scope of Your Most Restrictive Tier

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Mapping Regulations to the Framework

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Supporting New Compliance Requirements

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Anti-Pattern: A New Policy for Every Requirement

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

A Better Approach: Map, Then Enhance

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

What Makes the Layering Work

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

From Structure to Execution

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 10 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Part IV: Building Your Program

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 11: Conducting the Inspection

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Documentation Meets Reality

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

If You Only Have 20 Hours

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Inspection Process

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Step 1: Gather Your Documentation

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Estimating the Effort: The Resource Reality Check

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

A Note on the Public/Private Divergence

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Watch for Fragmentation

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Scale of the Problem

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

How Fragmentation Happens

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Best Practices for Preventing Fragmentation

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

During Your Inspection

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Step 2: Create Your Inventory

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Step 3: Assess Against the Framework

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

For Each Policy (P-01 through P-17)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

For Each Standard (S-01 through S-24)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Scoring Guidance

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Understanding Your Maturity Score

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Quick Self-Assessment

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Step 4: Prioritize the Gaps

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Priority 1: Universal Items with Gaps

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Priority 2: Legally Required Items

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Priority 3: Mission-Critical Items

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Priority 4: Common Items with Gaps

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Priority 5: Emerging Items

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Step 5: Document Your Findings

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Your Inspection Is Complete

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Additional Support For Your Assessments

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Free Self-Assessment Worksheet

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The CampusCISO IT Policy Diagnostic

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The CampusCISO IT Policy Roadmap

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Learning More

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 11 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 12: The Improvement Roadmap

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

From Inspection to Roadmap

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Why Annual Review Is the Standard

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Prioritization Hierarchy

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Phase 1: Shore Up the Foundation

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Acceptable Use of Information Technology (P-03)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Privacy Policy (P-05)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Information Security Policy (P-09)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Phase 1 Checkpoint

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Phase 1 Quick Win: Extract Embedded Standards

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Phase 2: Address the Structural Loads

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Compliance-Driven Priorities

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

If you extend credit to students (most institutions):

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

If you process payment cards (most institutions):

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

If you have federal research funding (R1/R2 institutions):

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Operationally-Driven Priorities

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

If ransomware is one of your top IT risks:

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

If third-party vendor management is one of your major risks:

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Phase 2 Checkpoint

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Phase 3: Future-Proof the Structure

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

AI Governance (P-12)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Digital Presence / Web Governance (P-14)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Institutional Access to Electronic Information (P-17)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Zero Trust Architecture (S-20)

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Building This Year’s Roadmap

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Estimating the Work

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Matching Commitments to Capacity

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Three Commitment Buckets

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Closing the Annual Cycle

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Culture Work

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Project Toolkit

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

The Stakeholder Brief

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Why We Are Updating Our Policy Framework

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Chapter 12 Key Takeaways

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Conclusion: The Path Forward

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Document Information

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Contact

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

For Complete Framework Details

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

\n\n

Glossary of Terms

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Acronyms

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Key Terms

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Framework Reference Codes

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n

Additional Resources

This content is not available in the sample book. The book can be purchased on Leanpub at https://leanpub.com/campusciso_it_policy.\n\n

\n\n","metaText","A data-driven guide to measuring and closing IT policy gaps in higher education. Based on a study of 410 institutions including every R1 university in the US.","slug","campusciso_it_policy","showReadLinkString","sample","tocStructure",[44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,19,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132],"publicChapterContent",{"_22":23,"_12":310,"_25":-5,"_26":311,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":308,"_25":-5,"_26":309,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":306,"_25":-5,"_26":307,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":304,"_25":-5,"_26":305,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":302,"_25":-5,"_26":303,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":300,"_25":-5,"_26":301,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":298,"_25":-5,"_26":299,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":296,"_25":-5,"_26":297,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":294,"_25":-5,"_26":295,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":292,"_25":-5,"_26":293,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":290,"_25":-5,"_26":291,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":288,"_25":-5,"_26":289,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":286,"_25":-5,"_26":287,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":284,"_25":-5,"_26":285,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":282,"_25":-5,"_26":283,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":280,"_25":-5,"_26":281,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":278,"_25":-5,"_26":279,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":276,"_25":-5,"_26":277,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":274,"_25":-5,"_26":275,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":272,"_25":-5,"_26":273,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":270,"_25":-5,"_26":271,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":268,"_25":-5,"_26":269,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":266,"_25":-5,"_26":267,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":264,"_25":-5,"_26":265,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":262,"_25":-5,"_26":263,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":260,"_25":-5,"_26":261,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":258,"_25":-5,"_26":259,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":256,"_25":-5,"_26":257,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":254,"_25":-5,"_26":255,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":252,"_25":-5,"_26":253,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":250,"_25":-5,"_26":251,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":248,"_25":-5,"_26":249,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":246,"_25":-5,"_26":247,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":244,"_25":-5,"_26":245,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":242,"_25":-5,"_26":243,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":240,"_25":-5,"_26":241,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":238,"_25":-5,"_26":239,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":236,"_25":-5,"_26":237,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":234,"_25":-5,"_26":235,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":232,"_25":-5,"_26":233,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":230,"_25":-5,"_26":231,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":228,"_25":-5,"_26":229,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":226,"_25":-5,"_26":227,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":224,"_25":-5,"_26":225,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":222,"_25":-5,"_26":223,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":220,"_25":-5,"_26":221,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":218,"_25":-5,"_26":219,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":216,"_25":-5,"_26":217,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":214,"_25":-5,"_26":215,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":212,"_25":-5,"_26":213,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":210,"_25":-5,"_26":211,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":208,"_25":-5,"_26":209,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":206,"_25":-5,"_26":207,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":204,"_25":-5,"_26":205,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":202,"_25":-5,"_26":203,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":200,"_25":-5,"_26":201,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":198,"_25":-5,"_26":199,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":196,"_25":-5,"_26":197,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":194,"_25":-5,"_26":195,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":192,"_25":-5,"_26":193,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":190,"_25":-5,"_26":191,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":188,"_25":-5,"_26":189,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":186,"_25":-5,"_26":187,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":184,"_25":-5,"_26":185,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":182,"_25":-5,"_26":183,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":180,"_25":-5,"_26":181,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":178,"_25":-5,"_26":179,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":176,"_25":-5,"_26":177,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":174,"_25":-5,"_26":175,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":172,"_25":-5,"_26":173,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":170,"_25":-5,"_26":171,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":168,"_25":-5,"_26":169,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":166,"_25":-5,"_26":167,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":164,"_25":-5,"_26":165,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":162,"_25":-5,"_26":163,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":160,"_25":-5,"_26":161,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":158,"_25":-5,"_26":159,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":156,"_25":-5,"_26":157,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":154,"_25":-5,"_26":155,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":152,"_25":-5,"_26":153,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":150,"_25":-5,"_26":151,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":148,"_25":-5,"_26":149,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":146,"_25":-5,"_26":147,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":144,"_25":-5,"_26":145,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":142,"_25":-5,"_26":143,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":140,"_25":-5,"_26":141,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":138,"_25":-5,"_26":139,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":136,"_25":-5,"_26":137,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":133,"_25":-5,"_26":134,"_28":29,"_30":-5,"_31":-5,"_32":-5},"Glossary of Terms","#glossary-of-terms",3,"Document Information","#document-information","Conclusion: The Path Forward","#conclusion-the-path-forward","Chapter 12 Key Takeaways","#chapter-12-key-takeaways","The Project Toolkit","#the-project-toolkit","The Culture Work","#the-culture-work","Building This Year’s Roadmap","#building-this-years-roadmap","Phase 3: Future-Proof the Structure","#phase-3-future-proof-the-structure","Phase 2: Address the Structural Loads","#phase-2-address-the-structural-loads","Phase 1: Shore Up the Foundation","#phase-1-shore-up-the-foundation","The Prioritization Hierarchy","#the-prioritization-hierarchy","Why Annual Review Is the Standard","#why-annual-review-is-the-standard","From Inspection to Roadmap","#from-inspection-to-roadmap","Chapter 12: The Improvement Roadmap","#chapter-12-the-improvement-roadmap","Chapter 11 Key Takeaways","#chapter-11-key-takeaways","Additional Support For Your Assessments","#additional-support-for-your-assessments","Your Inspection Is Complete","#your-inspection-is-complete","Step 5: Document Your Findings","#step-5-document-your-findings","Step 4: Prioritize the Gaps","#step-4-prioritize-the-gaps","Step 3: Assess Against the Framework","#step-3-assess-against-the-framework","Step 2: Create Your Inventory","#step-2-create-your-inventory","Step 1: Gather Your Documentation","#step-1-gather-your-documentation","The Inspection Process","#the-inspection-process","If You Only Have 20 Hours","#if-you-only-have-20-hours","Documentation Meets Reality","#documentation-meets-reality","Chapter 11: Conducting the Inspection","#chapter-11-conducting-the-inspection","Part IV: Building Your Program","#part-iv-building-your-program","Chapter 10 Key Takeaways","#chapter-10-key-takeaways","From Structure to Execution","#from-structure-to-execution","What Makes the Layering Work","#what-makes-the-layering-work","Supporting New Compliance Requirements","#supporting-new-compliance-requirements","Mapping Regulations to the Framework","#mapping-regulations-to-the-framework","Minimize the Scope of Your Most Restrictive Tier","#minimize-the-scope-of-your-most-restrictive-tier","Risk-Tiered Data Classification","#risk-tiered-data-classification","The Too-Many-Programs Trap","#the-too-many-programs-trap","Chapter 10: Designing for the Highest Tiers","#chapter-10-designing-for-the-highest-tiers","Chapter 9 Key Takeaways","#chapter-9-key-takeaways","How Research Data Flows","#how-research-data-flows","How Research Governance Works","#how-research-governance-works","Research Computing: A Different Architecture","#research-computing-a-different-architecture","Principal Investigators Are Entrepreneurs","#principal-investigators-are-entrepreneurs","The Research Distinction","#the-research-distinction","Chapter 9: Designing for Research","#chapter-9-designing-for-research","Chapter 8 Key Takeaways","#chapter-8-key-takeaways","Calculating Your Institution’s Regulatory Load","#calculating-your-institutions-regulatory-load","C. Mission-Specific Loads","#c-mission-specific-loads","B. Environmental Loads","#b-environmental-loads","A. The Foundation: Universal Loads","#a-the-foundation-universal-loads","The Weight Your Building Must Support","#the-weight-your-building-must-support","Part III: Applying the Framework","#part-iii-applying-the-framework","The 24 Standards","#the-24-standards","Chapter 7: The Standards Inventory","#chapter-7-the-standards-inventory","The 17 Policies","#the-17-policies","Chapter 6: The Policy Inventory","#chapter-6-the-policy-inventory","Chapter 5 Key Takeaways","#chapter-5-key-takeaways","The Governance Hierarchy","#the-governance-hierarchy","The Load-Bearing Walls","#the-load-bearing-walls","Chapter 5: The Blueprints","#chapter-5-the-blueprints","Part II: The Framework","#part-ii-the-framework","Chapter 4 Key Takeaways","#chapter-4-key-takeaways","The Metaframework Approach","#the-metaframework-approach","The Layered Approach","#the-layered-approach","Right-Sizing for Your Team","#right-sizing-for-your-team","Four Common Frameworks","#four-common-frameworks","The Defensibility Imperative","#the-defensibility-imperative","Chapter 4: Framework Alignment","#chapter-4-framework-alignment","Chapter 3 Key Takeaways","#chapter-3-key-takeaways","Shadow IT: The Unofficial Infrastructure","#shadow-it-the-unofficial-infrastructure","The Access: Open Campus","#the-access-open-campus","The Light: Academic Freedom","#the-light-academic-freedom","The Soil: Shared Governance","#the-soil-shared-governance","The Warning","#the-warning","Chapter 3: The Site Conditions","#chapter-3-the-site-conditions","Chapter 2 Key Takeaways","#chapter-2-key-takeaways","What the Data Leaves Out","#what-the-data-leaves-out","Interpreting the Data","#interpreting-the-data","Additional Gaps Across the Sector","#additional-gaps-across-the-sector","Three Patterns That Define the Landscape","#three-patterns-that-define-the-landscape","About the Data","#about-the-data","A Yearly Snapshot of the Sector","#a-yearly-snapshot-of-the-sector","Chapter 2: The 2026 Policy Landscape","#chapter-2-the-2026-policy-landscape","Chapter 1 Key Takeaways","#chapter-1-key-takeaways","The Blueprint Is Not Your Building","#the-blueprint-is-not-your-building","The Promise: What a Well-Built Program Makes Possible","#the-promise-what-a-well-built-program-makes-possible","The Stakes: What Happens When Governance Debt Comes Due","#the-stakes-what-happens-when-governance-debt-comes-due","Design Drawings vs. As-Built Reality","#design-drawings-vs-as-built-reality","Chapter 1: The As-Built Standard","#chapter-1-the-as-built-standard","Part I: Foundations","#part-i-foundations","Executive Summary","#executive-summary",{"_12":13,"_37":38,"_35":36,"_454":455,"_456":457,"_458":459,"_39":40,"_460":461,"_462":463},"parts",[410],"toc",[320,321,322,323,324,325,326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404,405,406,407,408,409],"isUnavailableOnline",false,"unavailableMessage",{"_22":23,"_12":310,"_25":-5,"_26":311,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":308,"_25":-5,"_26":309,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":306,"_25":-5,"_26":307,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":304,"_25":-5,"_26":305,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":302,"_25":-5,"_26":303,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":300,"_25":-5,"_26":301,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":298,"_25":-5,"_26":299,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":296,"_25":-5,"_26":297,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":294,"_25":-5,"_26":295,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":292,"_25":-5,"_26":293,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":290,"_25":-5,"_26":291,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":288,"_25":-5,"_26":289,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":286,"_25":-5,"_26":287,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":284,"_25":-5,"_26":285,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":282,"_25":-5,"_26":283,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":280,"_25":-5,"_26":281,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":278,"_25":-5,"_26":279,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":276,"_25":-5,"_26":277,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":274,"_25":-5,"_26":275,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":272,"_25":-5,"_26":273,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":270,"_25":-5,"_26":271,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":268,"_25":-5,"_26":269,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":266,"_25":-5,"_26":267,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":264,"_25":-5,"_26":265,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":262,"_25":-5,"_26":263,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":260,"_25":-5,"_26":261,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":258,"_25":-5,"_26":259,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":256,"_25":-5,"_26":257,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":254,"_25":-5,"_26":255,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":252,"_25":-5,"_26":253,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":250,"_25":-5,"_26":251,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":248,"_25":-5,"_26":249,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":246,"_25":-5,"_26":247,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":244,"_25":-5,"_26":245,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":242,"_25":-5,"_26":243,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":240,"_25":-5,"_26":241,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":238,"_25":-5,"_26":239,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":236,"_25":-5,"_26":237,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":234,"_25":-5,"_26":235,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":232,"_25":-5,"_26":233,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":24,"_25":-5,"_26":27,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":230,"_25":-5,"_26":231,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":228,"_25":-5,"_26":229,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":226,"_25":-5,"_26":227,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":224,"_25":-5,"_26":225,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":222,"_25":-5,"_26":223,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":220,"_25":-5,"_26":221,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":218,"_25":-5,"_26":219,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":216,"_25":-5,"_26":217,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":214,"_25":-5,"_26":215,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":212,"_25":-5,"_26":213,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":210,"_25":-5,"_26":211,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":208,"_25":-5,"_26":209,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":206,"_25":-5,"_26":207,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":204,"_25":-5,"_26":205,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":202,"_25":-5,"_26":203,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":200,"_25":-5,"_26":201,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":198,"_25":-5,"_26":199,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":196,"_25":-5,"_26":197,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":194,"_25":-5,"_26":195,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":192,"_25":-5,"_26":193,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":190,"_25":-5,"_26":191,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":188,"_25":-5,"_26":189,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":186,"_25":-5,"_26":187,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":184,"_25":-5,"_26":185,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":182,"_25":-5,"_26":183,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":180,"_25":-5,"_26":181,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":178,"_25":-5,"_26":179,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":176,"_25":-5,"_26":177,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":174,"_25":-5,"_26":175,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":172,"_25":-5,"_26":173,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":170,"_25":-5,"_26":171,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":168,"_25":-5,"_26":169,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":166,"_25":-5,"_26":167,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":164,"_25":-5,"_26":165,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":162,"_25":-5,"_26":163,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":160,"_25":-5,"_26":161,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":158,"_25":-5,"_26":159,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":156,"_25":-5,"_26":157,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":154,"_25":-5,"_26":155,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":152,"_25":-5,"_26":153,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":150,"_25":-5,"_26":151,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":148,"_25":-5,"_26":149,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":146,"_25":-5,"_26":147,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":144,"_25":-5,"_26":145,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":142,"_25":-5,"_26":143,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":140,"_25":-5,"_26":141,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":138,"_25":-5,"_26":139,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":135,"_12":136,"_25":-5,"_26":137,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_22":23,"_12":133,"_25":-5,"_26":134,"_28":29,"_30":-5,"_31":-5,"_32":-5},{"_12":13,"_25":411,"_28":412,"_413":414},"",0,"chapters",[415,416,417,418,419,420,421,422,423,424,425,426,427,428,429,430,431,432,433],{"_22":23,"_12":310,"_26":311,"_28":29,"_434":453,"_32":-5},{"_22":23,"_12":308,"_26":309,"_28":29,"_434":452,"_32":-5},{"_22":23,"_12":306,"_26":307,"_28":29,"_434":451,"_32":-5},{"_22":23,"_12":294,"_26":295,"_28":29,"_434":450,"_32":-5},{"_22":23,"_12":278,"_26":279,"_28":29,"_434":449,"_32":-5},{"_22":23,"_12":264,"_26":265,"_28":29,"_434":448,"_32":-5},{"_22":23,"_12":250,"_26":251,"_28":29,"_434":447,"_32":-5},{"_22":23,"_12":248,"_26":249,"_28":29,"_434":446,"_32":-5},{"_22":23,"_12":240,"_26":241,"_28":29,"_434":445,"_32":-5},{"_22":23,"_12":236,"_26":237,"_28":29,"_434":444,"_32":-5},{"_22":23,"_12":232,"_26":233,"_28":29,"_434":443,"_32":-5},{"_22":23,"_12":24,"_26":27,"_28":29,"_434":442,"_32":-5},{"_22":23,"_12":218,"_26":219,"_28":29,"_434":441,"_32":-5},{"_22":23,"_12":204,"_26":205,"_28":29,"_434":440,"_32":-5},{"_22":23,"_12":186,"_26":187,"_28":29,"_434":439,"_32":-5},{"_22":23,"_12":184,"_26":185,"_28":29,"_434":438,"_32":-5},{"_22":23,"_12":160,"_26":161,"_28":29,"_434":437,"_32":-5},{"_22":23,"_12":138,"_26":139,"_28":29,"_434":436,"_32":-5},{"_22":23,"_12":133,"_26":134,"_28":29,"_434":435,"_32":-5},"subsections",[],[408],[397,398,399,400,401,402,403,404,405,406],[385,386,387,388,389,390,391,392,393,394,395],[],[375,376,377,378,379,380,381,382],[368,369,370,371,372,373],[361,362,363,364,365,366],[],[358],[356],[352,353,354],[],[344,345,346,347,348,349],[337,338,339,340,341,342],[329,330,331,332,333,334,335],[323,324,325,326,327],[],[],"coverFeatured",{"_473":475},"coverFeatured2x",{"_473":474},"authors",[464],"samplePdfUrl","https://s3.amazonaws.com/samples.leanpub.com/campusciso_it_policy-sample.pdf?x-amz-checksum-mode=ENABLED&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=0XBXHW3Q9GGV69BT7E82%2F20260429%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260429T223736Z&X-Amz-Expires=518400&X-Amz-SignedHeaders=host&X-Amz-Signature=bcd179d237de87e0b709456651f75c6947cd45ebec26a936de3d353671f8c5bf","sampleEpubUrl","https://s3.amazonaws.com/samples.leanpub.com/campusciso_it_policy-sample.epub?x-amz-checksum-mode=ENABLED&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=0XBXHW3Q9GGV69BT7E82%2F20260429%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260429T223736Z&X-Amz-Expires=518400&X-Amz-SignedHeaders=host&X-Amz-Signature=bd75cdeb446b57457c4f1108b1fb50996b0f76470781e58a3482fbe2822ed3f3",{"_465":466,"_467":468,"_469":470},"id","Z2lkOi8vbGVhbnB1Yi9TdG9yZTo6UHJvZHVjdEF1dGhvci84MzQ0NQ","name","Chris Schreiber","user",{"_471":472},"username","christianschreiber","url","https://d2sofvawe08yqg.cloudfront.net/campusciso_it_policy/s_featured2x?1777322565&1777322565","https://d2sofvawe08yqg.cloudfront.net/campusciso_it_policy/s_featured?1777322565&1777322565","shoppingCartId","shoppingCart",{"_465":505,"_506":412,"_507":496,"_508":411,"_509":510,"_511":512,"_513":496},"locale","en","readerTheme","light","constants",{"_503":504},"publishers",{"_499":500,"_501":502},"learnerOrganizations",[],"needsLocaleCookieSync","announcements",{"_492":493,"_494":-5},"announcement_store",{"_495":496,"_497":498},"announcement_authors","flag",true,"text","

Kick off your book project in 3 hours! Live workshop on Zoom. You’ll leave with a real book project, progress on your first chapter, and a clear plan to keep going. Saturday, May 2, 2026. Learn more…

\n","companies",[],"universities",[],"paypalClientId","AX53Cwz8jR6rVVzzZiZNWWXl0dGagi-GZrjG-S3Ua14E5nrKMn7DxDQ730O4R8LusLPp49ALn6aRVaEy","no-cart","count","free","updatedAt","paymentGateway","STRIPE","cartItems",[],"loading"]

Part III: Applying the Framework

Table of Contents

Executive Summary

Part I: Foundations

Chapter 1: The As-Built Standard

Design Drawings vs. As-Built Reality

The Stakes: What Happens When Governance Debt Comes Due

The Promise: What a Well-Built Program Makes Possible

The Blueprint Is Not Your Building

Chapter 1 Key Takeaways

Chapter 2: The 2026 Policy Landscape

A Yearly Snapshot of the Sector

About the Data

Three Patterns That Define the Landscape

The Authentication Floor

The Ransomware Cliff

The Oral Tradition Liability

Additional Gaps Across the Sector

Interpreting the Data

Prevalence vs. Applicability

Prevalence Tiers

What the Data Leaves Out

Chapter 2 Key Takeaways

Chapter 3: The Site Conditions

The Warning

The Soil: Shared Governance

Policy as Legislation

Getting Things Done Takes Longer

What Shared Governance Looks Like

What This Means for Your Program

The Light: Academic Freedom

Your Mission Is Inquiry

Security Cannot Obstruct Learning

Designing Programs That Let Light In

What This Means for Your Program

The Access: Open Campus

Residential Networks and Guest Access

BYOD Is the Baseline

Perimeter Defense Is Ineffective

Rethinking Where Security Protections Live

Shadow IT: The Unofficial Infrastructure

Why Shadow IT Thrives in Higher Education

Working With Shadow IT, Not Against It

What This Means for Your Program

Chapter 3 Key Takeaways

Chapter 4: Framework Alignment

The Defensibility Imperative

The “Reasonable Security” Problem

Safe Harbor Laws: Framework Alignment as Legal Protection

Beyond Legal Protection

Four Common Frameworks

NIST Cybersecurity Framework 2.0 (NIST CSF)

NIST SP 800-171 (Protecting CUI)

CIS Controls v8

ISO 27001/27002

Right-Sizing for Your Team

The Layered Approach

The Metaframework Approach

Chapter 4 Key Takeaways

Part II: The Framework

Chapter 5: The Blueprints

The Load-Bearing Walls

The Governance Hierarchy

Policies: The “Why”

Standards: The “What” and “How”

Why This Distinction Matters

What Well-Developed Frameworks Look Like

Chapter 5 Key Takeaways

Chapter 6: The Policy Inventory

The 17 Policies

Universal Policies (7)

Common Policies (5)

Emerging Policies (5)

Chapter 7: The Standards Inventory

The 24 Standards

Universal Standards (11)

Common Standards (9)

Emerging Standards (4)

Part III: Applying the Framework

Chapter 8: Structural Loads