IT Policy on Policies

Version 1.3

Purpose

This policy defines how policies regarding information technology are developed at Fordham University.

Scope

This IT policy, and all policies referenced herein, shall apply to all members of the University community including faculty, students, administrative officials, staff, alumni, authorized guests, delegates, and independent contractors (the “User(s)” or “you”) who use, access, or otherwise employ, locally or remotely, the University’s IT Resources, whether individually controlled, shared, stand-alone, or networked.

Policy Statement

• All policies must be developed following the IT Procedure on Developing Policy 
• All policies must have a “responsible person” assigned to the policy. This person is in charge of authoring the policy and its review. This person must be Director level or higher. 
• All policies must have a review frequency of no less than one year and no greater than three years. 
• All policies must obtain the proper approvals to be valid.  
• The AVP/CISO is responsible for all policies that directly impact Fordham IT. 
• Policies may also require approval from the Office of Legal Counsel (OLC). 
• Policies that impact any party outside of Fordham IT may also receive the OLC's approval. 
• All policies and related procedures must use the templates provided by the Director of IT Risk and Data Integrity or have been approved by the AVP/CISO. 
• Initial procedures issued with a policy must also follow the same approval process as its associated policy. 
• Significant changes to policies, regardless of scope, must obtain AVP/CISO approval. 
• If required, changes to policies should receive the OLC’s approval. 
• Minor changes to policies or procedures only require the approval of the University Information Security Office's Directors. 

Related Policies and Procedures

• Procedure on Developing IT Policies
• Procedure on Developing IT Procedures

Implementation Information

Revision History

Policy Disclaimer Statement

Deviations from policies, procedures, or guidelines published and approved by the University Information Security Office (UISO) may only be done cooperatively between the UISO and the requesting entity with sufficient time to allow for appropriate risk analysis, documentation, and possible presentation to authorized University representatives. Failure to adhere to UISO written policies may be met with University sanctions.