Information Security at Georgetown University

Georgetown University's commitment to information security serves to create an environment that protects information from security threats that could compromise privacy, productivity, reputation, or intellectual property rights. This commitment recognizes the vital role that information plays in the educational, research, operational, and medical advancement missions of the University, and the importance of taking the necessary steps to protect information in all forms.

Information security is a responsibility shared by the entire University community. The Office of Information Security works with other University departments in a coordinated fashion designed to provide a safe environment, following industry best practices, to prevent problems before they occur through education and prevention, to respond rapidly and effectively when problems arise, and to maintain essential services and business operations after a serious incident. This network includes:

• The University Information Security Officer is designated by the Vice President and Chief Information Officer. This individual stays abreast of security related news, policies and best practices in government, at other organizations and in higher education.
  
  
• Local Information Security Personnel are appointed by Information Service Providers to protect organizational systems and networks and train personnel. They work closely with the University Information Security Officer to implement and consistently enforce policy.
  
  
• The Internal Audit and Management Analysis Department determines whether actual security practices and procedures conform with or deviate from the University Information Security Policy through periodic audits.
  
  
• The Department of Public Safety conducts coordinated patrols on a regular basis to ensure campus security and is vested through the District of Columbia Metropolitan Police Department with full arrest power on all campus property and reports criminal offenses to the appropriate law enforcement agency.

Industry best practices

The various information resources used in the University's educational, research, and operational missions require different levels of security and protection mechanisms. Georgetown University's physical and logical information security follow current industry best practices that are annually audited both internally and externally. In addition, the Office of Information Security routinely performs vulnerability analysis and security reviews of University systems, network, and applications while working with the Department of Public Safety to secure campus facilities and property.

As more information is used and shared by students, faculty and staff, both within and outside the University, a concerted effort must be made to protect information. Georgetown's Office of Information Security conducts ongoing information security campaigns educating the university community about potential security concerns and appropriate preventive practices. Educational campaigns are conducted in a variety of ways including the use of broadcast email, websites, information packets and campus forums to educate users on responsibilities, guidelines, and practices to foster a protected and secure environment.

Note: In order to ensure the integrity of Georgetown University's information security practices, specific approaches or techniques are not publicly discussed.

Updated October 20, 2006.