Documents Contributed by ECAR and Security Planning

Information security is a process of business risk management that must be performed on an ongoing basis. It is critical to take an approach to information security that examines the risks and security objectives within the environment in which the organization operates. Any comprehensive approach to information security must include a feedback mechanism that measures the performance of the process so that risks are managed appropriately and determines whether the organization's security objectives are being met. Burton Group (www.burtongroup.com) provides technically in-depth research and advisory services for colleges and universities, government agencies, and commercial enterprises. Burton Group's practical and unbiased research and advice helps technologists make smart IT infrastructure decisions in increasingly complex environments. Burton Group covers directories, identity management, application platforms, architecture, and network and telecom infrastructure topics. Like ECAR, Burton Group is an unbiased advocate for the user and more than 80 percent of Burton Group's clients are user organizations rather than suppliers.

This research bulletin describes a functional framework for higher education compliance with the HIPAA IT security final rule. The framework, which can be adapted for individual universities, includes an institutional plan, an organizational process, reporting and tracking mechanisms, and training. It is based on principles of leveraging the compliance process to create a more secure institution-wide IT environment.

This bulletin examines how higher education is coping with managing information technology security from the policy perspective. It focuses particular attention on policy processes and programs that address the tensions between preserving confidentiality, ensuring data integrity, and maintaining an academic environment in which information is easily available to authorized users.

This is the June 2003 ECAR survey instrument used for ECAR Research Study concerning Information Technology Security Practice in Higher Education.