read on 9/13/2022

Alright, simple.

“Computer Resource, Electronic Resource, IT Resource and Personal Device have slightly nuanced definitions but could potentially be consolidated. For your consideration, I've noted potential definitions that may be entailed or implied interpretations within IT Resource.” The commenter continued to note that if including electronic communication within “college business operation,” then “electronic resource” is entailed within “computer resource” and “IT resource.” Further, the commenter noted that “computer resource,” “electronic resource,” and “personal device” appear entailed under “IT resource” if used to perform college business.

Two commenters made several notes for minor grammar and clarity edits.

The Data Governance Council commented, “While the policy acknowledges that the data governance council “establishes and maintains data classifications,” (IV.F.1) this policy seems to add some classifications. The policy has a classification for “sensitive” data (III.U) and “Confidential information” (III.G).  These are both classifications that don’t exist in the current Data Classification Guide. Switching from “Confidential Information” to “Confidential Data” is also a suggestion to provide consistent language across documents."

The Data Governance Council commented, “The council seeks clarification on the term “data handling” in section IV.F.2. We suggest the term “data transmission” may be more appropriate. Data handling is a broader term that encompasses all actions by data custodians and other data owners. Our reading of this policy suggests the intent of IV.F.2. is to establish OIT’s responsibilities in security data as it is moved or stored within a system or between systems. Alternatively, we would suggest just removing “Data handling” completely from the section and have it just referenced the encryption requirements. . . . The council seeks clarification on how we envision the IT technicians’ role established in IV.F.3. We suggest making this section clearer that this is about technical security of the data and not about general data management practices (i.e., definitions and data quality controls).  The council is also interested to learn more about what tools and software IT technicians will use to “document” the procedures they are to establish under this section.