Forum of Incident Response & Security Teams

home *** CD-ROM | disk | FTP | other *** search

/ Forum of Incident Response & Security Teams / Forum_of_Incident_Response_and_Security_Teams_FIRST_October_1994.iso / ethics / virgina.txt < prev next >

Wrap

Text File | 1994-07-08 | 13KB | 350 lines

If you want more information on the guidelines and how they were formed, Lore Balkan and Phil Sheldon presented a paper at CAUSE '89 entitled, "Developing Guidelines for Information Resource Management: A Grass-Roots Process in a Decentralized Environment." Janet Terry University Systems Analysis & Services Virginia Tech ************************************************************************** Virginia Polytechnic Institute and State University No. 2005 Rev. 0 Policy and Procedures Date: November 14, 1989 Subject: Guidelines for University Administrative Information Resource Management --------------------------------------------------------------------------- 1.0 Purpose While all administrative data captured using University assets are re- sources of the University, they vary in their relevance to the administra- tive processes of the University. This policy is intended to apply to those data which are critical to the administration of the University. While these data may reside in different data base management systems and on different machines, these data in aggregate may be thought of as forming a logical data base, which will herein be called the ADMINISTRATIVE UNIVER- SITY DATA BASE (AUDB). This terminology is not intended to imply that these data now or in the future should reside in a single physical data base. Rather, it is a recognition that regardless of where these data re- side, there are some general principles of data management that should be applied in order to maintain the value and guarantee effective use of the information resource. 2.0 Policy 2.1 Information Management Roles o The University is considered the DATA OWNER of all University adminis- trative data. o University officials, such as the Controller, the Associate Vice Presi- dent for Personnel Resources, and the Registrar, are responsible for data in their functional areas and are considered DATA CUSTODIANS. o Staff delegated the responsibility for information management activ- ities related to maintenance and dissemination of data are considered DATA STEWARDS. o Individuals who have need for University data in order to perform their assigned duties and are therefore authorized access are considered DATA USERS. o The function of applying formal guidelines and tools to manage the Uni- versity's information resource is termed DATA ADMINISTRATION. Those data administration activities that do not fall within the realm of re- sponsibility of designated data custodians are the responsibility of the Information Resource Management (IRM) department. 2.2 Data Included in the AUDB o A data element is considered part of the AUDB and should conform to AUDB standards if it satisfies one or more of the following criteria: - It is relevant to planning, managing, operating, or auditing major administrative functions. - It is referenced or required for use by more than one organiza- tional unit. Data elements used internally by a single department or office are not typically part of the AUDB. - It is included in an official University administrative report. - It is used to derive an element that meets the criteria above. o Data elements which meet the criteria for inclusion may be identified as such by a data custodian, a data steward, IRM, or a user group. o A data custodian should be identified for each data element to be in- cluded in the AUDB. o IRM should assist in the negotiations for inclusion and for identifica- tion of data custodians. 2.3 Data Capture o The data custodian is responsible for complete, accurate, valid, and timely data capture. These responsibilities may be delegated to data stewards. o Electronic data should be captured at or near its creation point as identified by the data custodian. 2.4 Data Storage o An official data storage location for each data element should be iden- tified by the data custodian. o A official data storage location of valid codes and values for each data element should be identified by the data custodian. o Data element names, formats, and codes should be consistent with Uni- versity standards. o Archiving requirements and strategies for storing historical data should be determined for each data element by the data custodian. o IRM should assist in determining data storage location and archiving requirements for AUDB data. 2.5 Data Validation and Correction o Applications that capture and update AUDB data should incorporate edit and validation checks to assure the accuracy of the data. o The accuracy of any element can be questioned by any authorized data user. The data user has the responsibility to help correct the problem by supplying as much detailed information as available. o The data custodian or delegated data steward is responsible for re- sponding to questions and correcting inconsistencies if necessary. o Upon written identification and notification of erroneous data, correc- tive measures should be taken as soon as possible or in accordance with the consensus of the users to: - Correct the cause of the erroneous data. - Correct the data in the official data storage location. - Notify users who have received or accessed erroneous data. 2.6 Data Manipulation, Modification, and Reporting o The data custodian is responsible for authorizing manipulation, modifi- cation, or reporting of AUDB data elements and for creating derived el- ements, which are also members of the AUDB. o The data custodian is responsible for ensuring that data maintained are consistent with official University reporting requirements. o The data custodian has ultimate responsibility for proper use of AUDB data; individual data users will be held accountable for their specific uses of the data. o All extracted or reported AUDB records should include the time and date of data capture. 2.7 Data Security o All AUDB data should be secured and access granted to a data user only for University business on a "need-to-know" basis and within predefined access rules and security requirements. o The data custodian has ultimate responsibility for determining security requirements and authorizing access. o The individuals or office responsible for implementing access control will be identified and charged with this responsibility in writing by the data custodian. o The data custodian is responsible for documenting authorization proce- dures. o The data custodian is responsible for monitoring and reviewing security implementation and authorized access. o All data users of AUDB data should sign a statement indicating their understanding of the level of access provided and their responsibility to likewise maintain the inherent privacy, accessibility, and integrity of the data they are provided. o The data custodian is responsible for assuring that data are backed up and recoverable in response to events that compromise data integrity such as system failure, inadvertent faulty manipulation, unauthorized user penetration, or other unforeseen disasters. 2.8 Data Documentation o Documentation of data elements should be provided to IRM in machine- readable format and will reside in a UNIVERSITY DATA RESOURCE DICTION- ARY. o IRM is responsible for the data administration function of maintaining the University Data Resource Dictionary and for making it readily ac- cessible to data custodians, data stewards, and data users. In es- sence, IRM is data custodian for the the University Data Resource Dictionary. o Documentation of data elements is the ultimate responsibility of the data custodian. o Documentation/definition for each data element should at least include: - Name and Alias Names - Description - Data Custodian - Usage and Relationships - Frequency of Update - Source for Data Capture - Official Data Storage Location and Format - Description of Validation Criteria and/or Edit Checks - Description, Meaning, and Location of Allowable Codes - Access Rules and Security Requirements - Archiving Requirements - Data Storage Location of Extracts o Documentation for derived AUDB data elements should include the algo- rithms or decision rules for the derivation. o Change in any of these characteristics should be noted to IRM and/or recorded in the University Data Resource Dictionary in advance of the change. 2.9 Data Availability o Data Custodians are responsible for providing accessible, meaningful, and timely machine-readable AUDB data for University use. This activ- ity may be assigned to data stewards or to other University officials within the predefined access rules and authorization procedures. o Data custodians and IRM share responsibility for AUDB data compatibil- ity, accessibility, and interfaces. 3.0 Procedures These GUIDELINES FOR UNIVERSITY ADMINISTRATIVE INFORMATION RESOURCE MANAGE- MENT have been prepared by the Information Resource Management (IRM) de- partment and the Office of Institutional Research and Planning Analysis in association with the Administrative Systems Users Group (ASUG). They serve as a statement of objectives to manage the administrative information re- source. These GUIDELINES apply to all AUDB data. In addition, these GUIDELINES should be considered and followed where possible by all those who capture data and manage administrative information systems using assets of the University. STANDARDS AND PROCEDURES SHOULD BE DEVELOPED TO CONFORM TO THE OBJECTIVES EMBODIED IN THESE GUIDELINES. Copies of these GUIDELINES or related standards documents are available from the Information Resource Management Department and from the Adminis- trative Information System. 3.1 Updates As an ongoing document, these GUIDELINES FOR UNIVERSITY ADMINISTRATIVE IN- FORMATION RESOURCE MANAGEMENT will be maintained and revised as needed by the Information Resource Management department (IRM) in cooperation with data custodians and administrative systems users groups. All administra- tive system users are encouraged to correspond with IRM describing any sug- gestions for improving these GUIDELINES. When corresponding please refer to the document title and provide an appropriate section and page number reference. Changes or updates to these GUIDELINES will be reviewed by the AGENCY RE- CORDS ADMINISTRATOR to ensure compliance with MANAGEMENT OF UNIVERSITY RE- CORDS (University Policy 2000) and related State regulations. Revisions to these GUIDELINES will be sent to the manager of the Administrative Informa- tion System (before the effective date of the change, if possible). The update will be made, the date and revision number changed and the revision noted in Section 6.0, and returned to be approved and released. 4.0 Definitions 1. AUDB (ADMINISTRATIVE UNIVERSITY DATA BASE) is a conceptual term used to identify that body of data critical to University planning, management and business operations. 2. DATA ADMINISTRATION is the function of applying formal guidelines and tools to manage the University's information resource. 3. DATA CUSTODIANS are the University officials responsible for managing a segment of the University's information resource. 4. DATA STEWARDS are staff members delegated the responsibility for data maintenance and data dissemination. 5. DATA USERS are individuals who are authorized access to University data required by them to perform their assigned duties. 6. UNIVERSITY DATA RESOURCE DICTIONARY is a database system that functions as a repository that contains comprehensive information about Univer- sity data and documentation of University administrative systems. 5.0 References 1. Policy 2000, "Management of University Records." 6.0 Approvals and Revisions Approved January 5, 1989 by the Administrative Systems Users Group (ASUG). Approved November 14, 1989 by the Director of the Office of Institu- tional Research and Planning Analysis, James R. Montgomery.