Elements of the ISP

1.  Risk Identification and Assessment. National Louis intends through its ISP to identify and assess external and internal risks to the security, confidentiality, and integrity of covered information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information. The ISP Coordinator will provide guidance to appropriate personnel in the central administration, academic units, and other university units in evaluating their current practices and procedures and in assessing reasonably anticipated risks to covered information in their respective areas. The ISP Coordinator will work with appropriate personnel to establish procedures for identifying and assessing risks in the following areas:

• Employee Training and Management. The ISP Coordinator will coordinate with the appropriate personnel to evaluate the effectiveness of current employee training and management procedures relating to the access and use of covered information.

• Information Systems. The ISP Coordinator will coordinate with the appropriate personnel to assess the risks to covered information associated with the university's information systems, including network and software design as well as information processing, storage, transmission and disposal.

Detecting, Preventing and Responding to Attacks and System Failures The ISP Coordinator will coordinate with the appropriate personnel to evaluate procedures for and methods of detecting, preventing and responding to attacks, intrusions or other system failures.

2. Designing and Implementing Safeguards.  The ISP Coordinator will coordinate with appropriate personnel to design and implement safeguards, as needed, to control the risks identified in assessments and will develop a plan to regularly test or otherwise monitor the effectiveness of such safeguards. Such testing and monitoring may be accomplished through existing network monitoring and problem escalation procedures.

3. Overseeing Service Providers. The ISP Coordinator, in conjunction with the Office of the General Counsel and with National Louis Purchasing Services & Supplier Management, will assist in instituting methods for selecting and retaining service providers that are capable of maintaining appropriate safeguards for covered information. The ISP Coordinator will work with the Office of the General Counsel to develop and incorporate standard, contractual provisions for  service providers that will require providers to implement and maintain appropriate safeguards. These standards will apply to all existing and future contracts entered into with service providers to the extent required under GLBA, provided that amendments to contracts entered into prior to June 24, 2002 are not required to be effective until May 2004.

4. Adjustments to Program. The ISP Coordinator will evaluate and adjust the ISP as needed, based on the risk identification and assessment activities undertaken pursuant to the ISP, as well as any material changes to National Louis's operations or other circumstances that may have a material impact on the ISP.

Data Stewards