CampusCISO IT Policy Framework

The CampusCISO IT Policy Framework (2026 Edition) is a benchmark of IT policy and governance practices in higher education. It’s grounded in annual research that now spans more than 400 colleges and universities.

This framework focuses on IT governance maturity: whether an institution has the right technology policies and standards in place. It does not assess operational security controls or technical vulnerabilities, which are addressed by other CampusCISO diagnostic instruments.

Behind that focus lies a harder question: what should a higher education IT policy program contain, and what should those policies actually say? Two common answers fall short. One is a single expert’s opinion. The other is a generic blend of control frameworks and lists of best practices, none written specifically for higher education. This framework takes a third path. It answers the question with evidence, drawn not from any one framework but from the patterns that recur across the sector’s actual practice.

Anyone who has spent time on a campus has seen paths worn into the grass where students take shortcuts instead of following the sidewalk. Urban planners call this phenomenon a “desire path,” and they study it to understand where the official infrastructure failed to match where people actually wanted to go. The same observational approach shapes this framework. We map the desire paths of higher education IT policy, distinguishing between the Universal requirements found at nearly every major research university¹ and the Emerging practices that are still developing consensus.

Our research operates at two levels. At the document level, we identify which policies and standards higher education institutions publish. Those inform the inventory of 17 policies and 24 standards.

At the element level, we look inside those documents to see which specific details appear consistently across the sector. We then cross-reference what we observe with regulatory drivers and authoritative standards from NIST, ISO, NCSC ², and EDUCAUSE.

The framework, as defined in its inventory of policies and standards, is where peer practice, regulation, and authoritative guidance converge into a higher education reference model.

This framework is a maturity rubric, not a control catalog. We identify which policy and standards topics higher education institutions actually document, without prescribing the specific controls within them.

The framework helps institutions move from reactive compliance work (audits, checklists, GRC cycles) toward continuous improvement of their IT policy programs. It provides the shared structural foundation that makes year-over-year improvement practical: validated topic guidance, prevalence-based classifications, and annual research that tracks how the sector evolves.

It complements control frameworks like NIST CSF, NIST SP 800-171, and ISO 27001 rather than replacing them. Control frameworks specify what technical safeguards to implement, while this framework shows what topics a mature IT policy program in higher education actually covers, and where an institution’s program stands relative to peers.

• Benchmark: Comparing a policy library with a peer consensus to identify gaps.
• Assess: Using the included Self-Assessment to determine the institution’s Diagnostic Score.
• Prioritize: Focusing political capital on “Universal” items first, which represent the sector’s baseline for due diligence.
• Implement: Referring to the companion guide, Building IT Policy Programs for Higher Education, for rationale, drafting advice, and implementation strategies.

The CampusCISO IT Policy product family includes additional resources that complement this framework. The companion guide, Building IT Policy Programs for Higher Education (2026 Edition), provides strategic context, regulatory analysis, drafting advice, and implementation strategies for building a complete IT policy program. For the full catalog of related resources, visit campusciso.com/it-policy-guide.

The framework’s structure mirrors how higher education institutions organize policy in practice. Two dimensions shape it: a governance hierarchy that distinguishes policies from standards by their place in an institution’s authority structure, and a prevalence classification that reflects how widely each item is adopted across the sector. The inventories that follow are arranged by both.

Mature institutions distinguish between policies, standards, procedures, and guidelines. This hierarchy assigns the right approval authority at each level: board-level policies change infrequently and require executive sign-off, while technical standards can be updated by IT leadership as threats evolve. Mixing these levels together creates either governance bottlenecks or gaps in oversight.

The annual research determines each item’s classification by measuring its observed prevalence, and classifications shift between editions as sector practice evolves. Emerging items can move toward Common as adoption spreads. Common items can advance to Universal once they reach consensus. The Edition History documents how items have been reclassified across versions.

These board-level policies establish management intent and risk tolerance, delegating implementation details to standards and procedures. Prevalence data reveals which policies are baseline expectations versus emerging areas where the sector is still developing consensus.

The framework groups higher education institutions into five institutional tiers based on Carnegie Classification to enable peer benchmarking. Prevalence figures in this section reflect Tier 1 institutions (R1 research universities) with full documentation visibility. For tier definitions and the scoring formula, see the Methodology and Findings chapter. Individual institutional requirements vary based on regulatory environment, mission, and risk tolerance.

Tier 1 institutions anchor the framework because their programs are the most fully developed and documented in the sector. That makes them its clearest reference point, but most of what the framework measures applies to an institution of any size or type. Only a handful of items are tied to a specific mission, such as sponsored research or international travel. Every institution is measured against that same yardstick, and one of any type can still demonstrate strong maturity. Where a smaller institution scores lower, that often reflects how completely it has documented its program, not whether the governance matters to it.

Standards translate policy intent into technical specifications. While policies establish that data must be protected, standards specify encryption algorithms, password complexity requirements, and patch timelines. These standards represent the technical control areas most commonly documented at higher education institutions.

Prevalence figures in this section also reflect Tier 1 institutions with full documentation visibility.

Explicit alignment to an established cybersecurity framework strengthens an institution’s security program by providing structured guidance, enabling peer comparison, and demonstrating due diligence to auditors and insurers.

Which framework an institution chooses depends on context. For example, research institutions with federal contracts often require NIST alignment, while institutions seeking international partnerships may benefit from ISO certification.

Institutions organize their policy and standards libraries in different ways, and no single structure is required. The examples below range from strict mapping to one NIST control set, to consolidated libraries that hold policy and standard content together, to custom controls catalogs. Each institution publishes its structure openly.

The framework includes a Self-Assessment that produces a single Diagnostic Score from 0 to 100. The score is designed to gauge an institution’s policy and governance maturity relative to the sector, without requiring the institution to adopt or map to any particular control framework.

Cybersecurity programs in higher education vary widely in which frameworks they follow and how they document their controls. Rather than measuring an institution against the specifics of NIST, ISO, or any single standard, the Diagnostic Score looks for the macro patterns that signal a mature policy program: whether the right topics are documented, whether governance roles and approval authorities are clear, and whether standards translate policy intent into technical specifications. Measuring at that level normalizes the variation across the sector into one consistent score, which supports two kinds of comparison: an institution against its peers, and an institution against itself over time.

The Self-Assessment worksheet and its scoring formulas appear in Appendix A. A printable PDF version is available as a download with this book and with the companion guide, Building IT Policy Programs for Higher Education.