Information Security Governance Policy

4.02

(1)  Purpose

This policy establishes an information security governance framework for all institutions governed by the Board of Regents (Board) for the Oklahoma Agricultural and Mechanical Colleges (OAMC). It authorizes the Council of IT Officers (CITO), to develop, coordinate, maintain, and monitor an Information Security Program that is risk-based, accountable, and aligned with OAMC and institutional priorities.

(2)   Scope

This policy applies to all institutions governed by the Board and institutional information, data, systems, applications, technology services, networks, infrastructure, and third-party services. It applies to employees, students, contractors, affiliates, and other parties who access, manage, operate, or support those resources.

(3)   Governance Structure

CITO shall oversee implementation of this policy through its Governance Operating Model (GOM) to lead information security governance and establish an information security program across all OAMC institutions.

(4)   Information Security Program

CITO shall develop, maintain, and periodically review an OAMC Information Security Program Plan (ISPP). The ISPP shall define the program’s governance requirements, objectives, safeguards, measures, and reporting practices and may include institution-specific implementation plans and supporting governance artifacts.

The Information Security Program shall address, as appropriate:

• Identification, assessment, prioritization, treatment, monitoring, and reporting of information security risk;
• Protection of the confidentiality, integrity, and availability of institutional information and technology resources;
• Identity, access, device, data, application, network, third-party, incident-response, resilience, and security-awareness governance;
• Compliance with applicable law, regulation, contract, Board policy, and approved system standards;
• Coordination of audit findings, control gaps, remediation plans, exceptions, and risk acceptance; and
• Program goals, performance measures, resource needs, and continuous improvement.

(5)   Council Responsibilities

• CITO shall: Establish and maintain OAMC information security governance requirements, guidelines, and control objectives designed to support consistent compliance with applicable laws, regulations, contractual obligations, Board policies, and standards, while preserving the responsibilities assigned to the qualified individual and institutional leadership;
• Approve and maintain supporting procedures, guidelines, templates, control objectives, assessment methods, and other program documentation within its delegated authority;
• Coordinate OAMC and institution-specific risk assessments, compliance reviews, security planning, and remediation oversight;
• Establish documented processes for security exceptions and risk acceptance, including review, approval, duration, compensating controls, and escalation;
• Request information reasonably necessary to evaluate risk, measure program effectiveness, monitor remediation, and support governance reporting;
• Recommend priorities, corrective actions, investments, and resource needs to institutional leadership; and
• Escalate material, unresolved, or OAMC information security risks to executive leadership or the Board, as appropriate.

(6)   Institutional Responsibilities

Each OAMC institution shall participate in the Information Security Program and will implement applicable policies and standards, provide requested risk and compliance information necessary to support OAMC information security governance, reporting, risk management, and address identified security risks through remediation, compensating controls, or documented risk acceptance.

(7)   Accountability

Compliance with this policy, the ISPP, and participation in the established information security governance program is required by all institutions within the OAMC. CITO may provide oversight of compliance and identified security risks, recommend appropriate action, and escalate unresolved or material concerns within the established GOM.