Information Security and Privacy Program Charter

Penn is committed to preeminence in research, teaching, and service.  As a result, Penn owns significant assets in the form of information.  Penn’s informational assets include, but are not limited to, student education records, employment records, financial information, research data, protected health information, alumni and donor information, Penn operational data, Penn intellectual property, and other data relating to Penn’s infrastructure, technology resources, and information security.  The improper use of such information, the unauthorized or inadvertent disclosure, alteration or destruction of information assets, or a significant interruption in their availability, can disrupt Penn’s ability to fulfill its mission.  Such actions can also result in regulatory, legal, financial and/or reputational risk to Penn and to the individuals whose data Penn maintains.

This charter applies to all members of the Penn community including students, staff, faculty members, officers, and employees of the University as well as other individuals authorized to use and/or access University technology resources and data.

• Information security and privacy protection serve as the cornerstones by which members of the Penn community (defined in Scope, above) can demonstrate that they are good stewards of the data entrusted to them.
• The Information Security and Privacy programs strive to ensure that information security and privacy efforts consistently demonstrate a commitment to the core mission and principles of the University while protecting the overall security and privacy of information at Penn. 
• It is understood that successful information security and privacy programs at Penn will involve not only the protection of University data and systems but also the appropriate preservation of personal privacy.  
• This Charter and Penn’s information security and data privacy policies (identified below) define the principles and terms of the Penn’s Information Security and Privacy programs as well as the responsibilities of the members of the Penn community in carrying out and adhering to the respective program requirements.

• Applicant Data Policy
• Closed Circuit Television Monitoring and Recording of Public Areas for Safety and Security Purposes
• Confidentiality of Health Records under HIPAA
• Confidentiality of Faculty & Staff Records – HR Policy 201
• Confiscation of Publications on Campus
• Confidentiality of Student Records
• Computer Security Policy
• Guidelines on Open Expression
• Information Systems Security Incident Responses
• Photocopying for Educational Use
• Policy on Acceptable Use of Electronic Resources
• Policy on Computer Disconnection from PennNet
• Policy on Requirements for Authenticated Access to PennNet
• Policy on Security of Electronic Protected Health Information (ePHI)
• Policy on Unauthorized Copying of Copyrighted Media
• Protocols for the University Archives and Records Center

• Privacy in the Electronic Environment
• Privacy of Alumni Data
• Red Flag Rule
• Relationships Between Members of the University Community and Intelligence Organizations
• Social Security Numbers

All members of the Penn community have a responsibility to help ensure that Penn’s information assets are used only in the proper pursuit of the University’s mission and that the confidentiality, integrity, and availability of Penn’s information is maintained, regardless of where it is processed or stored.  All members of the Penn community have an obligation to appropriately use and protect information in a manner that is respectful of personal privacy.  Members of the Penn community also must use and protect information in compliance with applicable laws. 

The Information Security program and Privacy program described below are charged with assisting and supporting members of the Penn community in meeting these responsibilities and strengthening accountability.

The Information Systems and Computing (ISC) Information Security program is charged with overseeing University efforts to preserve the confidentiality, integrity, and availability of Penn’s digital assets, the University network, systems, and data.  This includes coordinating  School and Center security-related activities, developing and implementing proactive technical and non-technical measures to help detect and prevent security risks, establishing policy, standards, and guidance, and providing an effective incident response when necessary.

The University Information Security Officer is responsible for overseeing the ISC Information Security program. 

The Vice President of Information Technology (IT) & University Chief Information Officer (CIO) is responsible for identifying and delegating the responsibility for information security, for approving security policies, standards and guidelines, overseeing incident response as necessary, and reporting periodically to senior University administration and the Board of Trustees on matters of Information Security.

The Office of Audit, Compliance, and Privacy (OACP) University Privacy program is responsible for developing an overall privacy framework to:

1. Establish governance, implementation and accountability structures across the University with respect to privacy 
2. Ensure compliance with federal and state privacy laws as well as Penn’s privacy-related policies and procedures
3. Raise awareness about privacy risks and how to mitigate those risks; 4) and provide an effective incident response when necessary

The University Privacy Officer is responsible for overseeing the OACP University Privacy program.

The Associate Vice President for Audit Compliance and Privacy is responsible for identifying and delegating the responsibility for implementation of the University Privacy program, providing a senior-level review of privacy-related policies and key privacy initiatives, overseeing incident response as necessary, and reporting periodically to senior University administration and the Board of Trustees on matters involving University Privacy.

Schools and Centers are responsible for establishing local Security and Privacy mechanisms to ensure compliance with University policies and guidelines, protect data, systems, and networks, implement security and privacy-related controls, and to cooperate with the Office of Information Security and the Office of Privacy in responding to incidents.

The Information Security program and the Privacy program maintain strong relationships with the Office of General Counsel, Division of Public Safety, Information Systems and Computing, the Office of Audit, Compliance, and Privacy, the Provost and EVP offices, the Office of Student Conduct, and many other offices handling confidential University data.  These partners are essential to the provision of information security services and privacy protections to the Penn community.

The following have been established to provide input, support, and steering to the Information Security program and the Privacy program:

• Privacy & Security Executive Committee (PSEC) –   Broad-based membership of senior Penn leaders providing input to ensure that the implementation of security and privacy controls and policy requirements remain strong, appropriate and in alignment with the University mission.
• IT Roundtable (ITR) and the IT Security Council (IT-SEC) – The role of ITR is to share knowledge across Penn IT organizations and provide input to IT decisions and policies that have University-wide implications.  IT-SEC, a sub-group of ITR, is responsible for providing feedback to ISC Information Security on matters relating to the execution and operation of their respective local information security programs.
• Network Policy Committee (NPC) - The NPC's charge is to develop, review and recommend IT or data-related policies for approval to IT Roundtable, and ultimately to the Vice President for IT and University CIO.
• Senior Incident Response Team (SIRT) – SIRT is made up of senior Penn leaders who provide input on the approach to handling significant privacy or security incidents.  

Violations of any Information Security and/or Privacy policies identified above may result in corrective actions as set forth in the applicable policy.

The Information Security program, the Privacy program, and this Charter are evaluated on an ongoing basis by the Provost and the Executive Vice President of the University.