Information Security Management Policy

Policy Number	Policy Owner
10006.2	Information Technology Services

1.0 Purpose

The State University of New York at Plattsburgh (“SUNY Plattsburgh”) is committed to protecting the confidentiality, integrity, and availability of institutional information and technology resources in support of its academic, research, administrative, and public service mission.

This policy establishes the University’s Information Security Management Program and provides the governance framework for managing information security risks, protecting institutional information assets, supporting compliance with applicable laws and regulations, and promoting the secure and responsible use of technology throughout the University.

The Information Security Management Program establishes institutional governance, accountability, and oversight for information security while supporting innovation, operational effectiveness, and the University’s educational mission.

2.0 Revision History

Date	Version Number	Change Description	Referenced Section
12/4/12	1.0	New Document	Entire Document
10/7/15	1.1	Minor Revisions
1/11/17	1.2	Minor Revisions
12/13/18	1.3	Minor Revisions
2/1/22	1.4	Minor Revisions	Owner Name
10/5/26	2.0	Major Revisions	Comprehensive revision establishing the Information Security Management Program and aligning the policy with SUNY Information Security Policy 6900, institutional governance practices, and current cybersecurity standards.

Date

Version Number

Change Description

Referenced Section

12/4/12

1.0

New Document

Entire Document

10/7/15

1.1

Minor Revisions

1/11/17

1.2

Minor Revisions

12/13/18

1.3

Minor Revisions

2/1/22

1.4

Minor Revisions

Owner Name

10/5/26

2.0

Major Revisions

Comprehensive revision establishing the Information Security Management Program and aligning the policy with SUNY Information Security Policy 6900, institutional governance practices, and current cybersecurity standards.

Review Process / Approval

Action:	Units	Date
Policy Review	Information Technology Services Management Services
Policy Approval	Executive Council	12/4/12

Action:

Units

Date

Policy Review

Information Technology Services
Management Services

Policy Approval

Executive Council

12/4/12

3.0 Units and Persons Affected

This policy applies to all faculty, staff, students, volunteers, employees of the Research Foundation and College Auxiliary Services, contractors, consultants, vendors, and other authorized users who access, use, manage, or support University information, technology resources, or institutional information on behalf of SUNY Plattsburgh.

This policy applies to all University-owned, leased, managed, or contracted information systems, networks, cloud services, applications, devices, and technology resources, as well as institutional information regardless of format, storage location, or transmission method.

Individuals and organizations acting on behalf of the University are expected to comply with this policy and any supporting standards, procedures, and related institutional requirements.

4.0 Policy

4.1 Guiding Principles

SUNY Plattsburgh’s Information Security Management Program is founded upon the following principles.

Security is a Shared Responsibility
Protecting institutional information and technology resources is the responsibility of every member of the University community. Effective information security requires collaboration among faculty, staff, students, administrators, affiliates, contractors, and third-party service providers.

Risk-Based Decision Making
Information security decisions shall be based upon the assessment of institutional risk, legal and regulatory requirements, operational needs, and the potential impact to the University’s mission.

Support for the Institutional Mission
Information security shall enable and support teaching, learning, research, administration, and public service by balancing appropriate safeguards with operational effectiveness, innovation, accessibility, and usability.

Protection of Institutional Information
Institutional information shall be protected throughout its lifecycle through administrative, technical, and physical safeguards that are appropriate to the information’s classification, sensitivity, and business value.

Compliance and Accountability
The University shall comply with applicable federal and state laws, SUNY policies, contractual obligations, and institutional requirements while promoting individual accountability for protecting institutional information.

Continuous Improvement
The Information Security Management Program shall be continuously evaluated and enhanced to address emerging threats, evolving technologies, changing business requirements, lessons learned from security incidents, and the results of risk assessments, audits, and compliance reviews.

The University shall periodically evaluate the effectiveness of the Information Security Management Program, including its governance processes, staffing, technology, and operational resources, to ensure the program continues to support institutional objectives, regulatory requirements, and evolving cybersecurity risks. This evaluation shall include consideration of the University’s Internal Control review process, conducted on a four-year cycle, as well as other applicable institutional, SUNY, and external assessments.

4.2 Policy Authority

This policy is established under the authority of the President of SUNY Plattsburgh and the Chief Information Officer and is intended to support compliance with applicable federal and New York State laws, SUNY policies, and institutional requirements governing the protection of institutional information and technology resources.

This policy establishes the University’s Information Security Management Program and authorizes the development of supporting standards, procedures, technical standards, and guidance necessary to implement and maintain the program. These supporting documents may be approved and maintained by Information Technology Services under the direction of the Chief Information Officer and do not require formal revision of this policy unless institutional governance or policy requirements materially change.

This policy aligns with, and supports implementation of:

SUNY Information Security Policy 6900
Applicable New York State cybersecurity and information technology policies
Federal and State privacy and information security laws and regulations
Institutional policies governing data governance, technology use, privacy, records management, and risk management

4.3 Information Security Management Program

SUNY Plattsburgh shall maintain an Information Security Management Program to provide governance, leadership, and oversight for protecting institutional information and technology resources.

The Information Security Management Program establishes a coordinated, risk-based approach for identifying, assessing, managing, and reducing information security risks while supporting the University’s academic mission, operational objectives, legal obligations, and strategic priorities.

The program shall be aligned with applicable SUNY policies, New York State requirements, recognized information security frameworks, and institutional governance practices.

4.4 Program Objectives

The Information Security Management Program is intended to:

Protect the confidentiality, integrity, and availability of institutional information and technology resources.
Identify, assess, and manage information security risks using a risk-based approach.
Support compliance with applicable federal and state laws, SUNY policies, contractual obligations, and institutional requirements.
Promote secure and responsible use of technology throughout the University.
Support institutional resilience through security planning, monitoring, incident response, and continuous improvement.
Foster a culture of shared responsibility for information security across the campus community.

4.5 Governance

The Information Security Management Program shall provide institutional governance for information security through the development of policies, standards, procedures, technical standards, and guidance that support the University’s information security objectives.

The program shall be administered by Information Technology Services under the direction of the Chief Information Officer and implemented through designated information security personnel.

The Information Security Management Program shall collaborate with institutional governance functions including, as applicable:

To promote consistent institutional decision-making, reduce organizational risk, and support secure adoption of technology.

4.5.1 Program Resources

The University shall support the Information Security Management Program with an appropriate level of professional, technical, administrative, and operational resources necessary to effectively administer the program and fulfill applicable institutional, SUNY, and regulatory information security requirements.

The resources necessary to support the Information Security Management Program will vary based on factors including, but not limited to, the size and complexity of the University; the number and diversity of information systems, technology services, and institutional data; the volume and complexity of Information Security Reviews and technology acquisitions; applicable legal, regulatory, contractual, and policy requirements; the University’s cybersecurity risk profile; and the scope of information security services provided.

What constitutes an appropriate level of resources may differ over time and shall be periodically evaluated as part of the University’s continuous improvement process to ensure the Information Security Management Program remains effective, sustainable, and aligned with institutional priorities, emerging technologies, and evolving cybersecurity risk.

4.6 Risk Management

Information security decisions shall be based upon the assessment and management of institutional risk.

The University shall implement administrative, technical, and physical safeguards appropriate to the sensitivity of institutional information and the potential impact of security incidents.

Risk management activities may include:

Information security controls shall be commensurate with identified risks and institutional priorities.

4.7 Information Classification and Protection

Institutional information shall be protected according to its classification, sensitivity, legal requirements, contractual obligations, and business value. Data classification will follow the SUNY Data Risk Classification Policy Guidelines.

Information Owners (Data Owners) and Information Stewards are responsible for ensuring that institutional information is appropriately classified, protected, accessed, retained, and disposed of in accordance with applicable policies and standards based upon available resources. The university shall provide adequate resources to ITS, departments, and data owners to comply with this policy.

Information security controls shall be applied throughout the information lifecycle, including creation, storage, processing, transmission, sharing, archival, and secure destruction.

4.8 Security Awareness and Education

Information security awareness is a shared institutional responsibility.

The University shall provide appropriate information security awareness, education, and training to faculty, staff, students, and other authorized users based upon their roles and responsibilities.

Training may include topics such as information security best practices, phishing awareness, password security, data protection, privacy, incident reporting, and emerging cybersecurity risks.

4.9 Third-Party Risk Management

Third-party service providers that create, receive, maintain, process, transmit, or otherwise have access to institutional information or technology resources shall be evaluated for information security risks appropriate to the nature of the service and the sensitivity of the information involved.

Information security reviews may consider vendor security practices, regulatory compliance, contractual requirements, privacy protections, business continuity capabilities, and other factors necessary to protect institutional information.

Appropriate contractual safeguards shall be incorporated into agreements when required by law, regulation, SUNY policy, or institutional standards.

4.10 Technology Procurement and Information Security Review

Information security shall be incorporated into institutional technology procurement and technology governance processes.

Technology acquisitions involving software, hardware, cloud services, hosted applications, artificial intelligence technologies, network-connected devices, or services that create, receive, maintain, process, or transmit institutional information shall undergo an Information Security Review when required by institutional procurement procedures.

Information Security Reviews shall be coordinated with other institutional governance processes, including data governance, accessibility review, procurement review, privacy review, and Artificial Intelligence governance, as applicable.

The campus Information Security Review process, administered through the institutional procurement workflow, provides a consistent, risk-based approach for evaluating technology prior to acquisition or implementation.

The University recognizes that effective implementation of the Information Security Management Program requires appropriate institutional governance, administrative support, and technical resources. The Information Security Review process shall be administered using a risk-based approach, with institutional resources, review processes, and governance practices periodically evaluated to support timely reviews and the continued effectiveness of the Information Security Management Program.

Information Security Reviews may evaluate, as appropriate:

Information security risks
Institutional data classification
Regulatory and contractual compliance
Vendor cybersecurity posture
Identity and access management
Authentication requirements
Network architecture and security implications
Data protection and privacy requirements
Business continuity and disaster recovery capabilities
Technology functionality and associated information security risks

Completion of an Information Security Review does not constitute approval for procurement or implementation. Additional institutional reviews or approvals may be required in accordance with applicable University policies and procedures.

4.11 Security Incident Reporting

Actual or suspected information security incidents shall be reported promptly through established University reporting procedures.

The Information Security Management Program shall coordinate response activities consistent with institutional incident response procedures to minimize operational disruption, protect institutional information, satisfy legal and regulatory obligations, and support recovery efforts.

Information security incidents shall be documented, evaluated, and used to improve institutional security controls and risk management practices.

4.12 Continuous Improvement

The Information Security Management Program shall be periodically evaluated to ensure its continued effectiveness and alignment with institutional objectives.

Program improvements may be informed by:

Supporting standards, procedures, technical standards, and guidance shall be reviewed and updated as necessary to maintain an effective and sustainable information security program.

5.0 Definitions

For purposes of this policy, the following definitions apply.

Confidentiality — Protecting information from unauthorized access, disclosure, or use.

Integrity — Protecting information from unauthorized modification or destruction while ensuring its accuracy and completeness.

Availability — Ensuring authorized users have timely and reliable access to information and technology resources.

Information Security Management Program — The University’s coordinated governance, risk management, policies, standards, procedures, technical controls, and administrative activities established to protect institutional information and technology resources.

Institutional Information — Information created, received, maintained, transmitted, or used in support of the University’s academic, research, administrative, or operational activities, regardless of format or storage location.

Information Owner (Data Owner) — The individual or organizational unit responsible for determining the appropriate classification, use, protection, and access requirements for institutional information.

Information Steward — An individual designated to manage institutional information on behalf of an Information Owner (Data Owner) and ensure information is handled in accordance with institutional requirements.

Information Security Review — A formal, risk-based evaluation of technology acquisitions, services, systems, or projects to identify information security risks and recommend appropriate safeguards prior to implementation or procurement.

Information Technology Resources — University-owned, leased, managed, or contracted computing systems, networks, cloud services, software, hardware, mobile devices, telecommunications systems, applications, and related technologies.

Risk — The potential for harm resulting from unauthorized access, disclosure, modification, destruction, disruption, or misuse of institutional information or technology resources.

System Owner — The individual or organizational unit responsible for the operational management, functionality, and ongoing oversight of a University technology system or service.

6.0 Responsibilities

Protecting institutional information and technology resources is a shared responsibility. While all members of the University community have a role in safeguarding institutional information, specific responsibilities are assigned as follows.

President
The President has overall executive responsibility for ensuring that the University maintains an effective information security program that supports the institution’s mission, strategic priorities, and legal obligations.

The President delegates operational responsibility for administering the Information Security Management Program to the Chief Information Officer.

Chief Information Officer
The Chief Information Officer (CIO) provides executive leadership, strategic direction, and institutional oversight for the Information Security Management Program.

The CIO is responsible for:

Establishing and maintaining the University’s Information Security Management Program.
Approving supporting information security standards, procedures, technical standards, and guidance.
Ensuring appropriate information security governance across the institution.
Supporting compliance with SUNY policy, applicable laws, and regulatory requirements.
Coordinating information security initiatives with institutional strategic priorities.
Reporting significant information security risks and program status to University leadership, as appropriate.

Chief Information Security Officer
The Chief Information Security Officer (CISO) provides strategic leadership for the University’s cybersecurity program and advises the Chief Information Officer on information security risks, emerging threats, compliance obligations, and security strategy.

Responsibilities include:

Providing leadership for institutional cybersecurity initiatives.
Advising on information security governance and risk management.
Supporting development of institutional security standards and practices.
Coordinating major security initiatives and strategic planning.
Providing executive guidance during significant information security incidents.

Information Security Officer
The Information Security Officer (ISO) is responsible for the operational administration of the Information Security Management Program.

Responsibilities include:

Coordinating implementation of institutional information security policies and standards.
Performing or coordinating information security risk assessments.
Conducting Information Security Reviews for technology acquisitions and implementations.
Coordinating security awareness and training activities.
Supporting incident response activities.
Monitoring compliance with institutional information security requirements.
Coordinating security assessments, audits, and remediation efforts.

Information Security Personnel
Information Security personnel support implementation and operation of the Information Security Management Program through technical, operational, and administrative activities.

Responsibilities may include:

Security monitoring
Vulnerability management
Security investigations
Incident response
Security engineering
Identity and access management
Security awareness
Security documentation
Technical consulting and risk assessments

Information Owners (Data Owners) and Information Stewards
Information Owners (Data Owners) and Information Stewards are responsible for the institutional information entrusted to their care.

Responsibilities include:

Classifying institutional information.
Determining appropriate access to institutional information.
Supporting compliance with applicable legal, regulatory, contractual, and institutional requirements.
Working with Information Technology Services to implement appropriate information security controls.
Participating in information security reviews affecting systems under their responsibility.

System Owners
System Owners are responsible for the operational oversight of institutional technology systems and services.

Responsibilities include:

Ensuring systems are operated securely and in accordance with institutional policy.
Participating in required Information Security Reviews.
Coordinating implementation of security recommendations.
Managing system-specific risks.
Supporting periodic security assessments and compliance activities.
Notifying Information Technology Services of significant system changes that may affect information security.

Supervisors and Managers
Supervisors are responsible for promoting compliance with institutional information security requirements within their respective areas.

Responsibilities include:

Ensuring employees understand applicable information security responsibilities.
Supporting required security awareness training.
Reporting suspected information security incidents.
Supporting implementation of institutional information security practices.

Users
All authorized users of University information and technology resources are responsible for:

Protecting institutional information.
Using University technology responsibly.
Following applicable information security policies, standards, and procedures.
Protecting authentication credentials.
Promptly reporting suspected information security incidents.
Completing required information security awareness training.
Exercising sound judgment when handling institutional information.

7.0 Procedures

8.0 Forms

9.0 Appendix

This policy shall be implemented in conjunction with applicable federal and state laws, SUNY policies, and University standards and procedures, including, but not limited to:

10.0 Distribution and Training

Method	Date
Campus Handbook	10/9/26
Faculty / Staff Digest	10/14/26
Student Digest	10/14/26
Other	N/A

Method

Date

Campus Handbook

10/9/26

Faculty / Staff Digest

10/14/26

Student Digest

10/14/26

Other

N/A

Upon approval, this policy shall be published in the SUNY Plattsburgh Campus Handbook and made available to the University community through appropriate institutional communication channels.

Information Technology Services shall maintain supporting standards, procedures, technical guidance, and related implementation documents necessary to support this policy.

The University shall provide appropriate information security awareness, education, and role-based training to support compliance with this policy and foster a culture of shared responsibility for protecting institutional information.

Information Security Management Policy

Policy Information