Section I

1.1 WHEREAS, three Information Technology (IT) Security Policies were enacted as emergency policies on June 25, 2015 by UO's Interim President, and were set to expire on December 26, 2015, but have been temporarily extended in order to revise these policies to better fit the IT security needs of a diversity of campus groups; and

1.2 WHEREAS, policies covering these activities are vital for: a) maintenance of a secure IT infrastructure at UO, and b) maintaining appropriate checks and balances on the manner in which IT security and related matters of campus data policy are conducted; and

1.3 WHEREAS, UO's Chief Information Security Officer (CISO) Will Laney contacted members of United Academics, SEIU, and the University Senate in Fall of 2015 for their collaborative assistance in revising and improving these policies so that they could be enacted as standard non-emergency polices; and

1.4 WHEREAS, a group of six senators (volunteering in response to two invitations to participate that were extended on the senate floor) met with the CISO on Nov. 25, 2015 to discuss these policy revisions and further collaborated on revisions prior to and after this meeting; and

1.5 WHEREAS, the three policies appended hereto have met with approval of the CISO’s office, representatives of UA and SEIU, and the senators involved in the collaborative revision process (and are appended in both finalized form and showing redline edits to the emergency versions of these policies);

Section II

2.1 BE IT THEREFORE MOVED that the Senate approves the Information Security Program Policy as appended below; and

2.2 BE IT THEREFORE MOVED that the Senate approves the Data Security Incident Response Policy as appended below; and

2.3 BE IT THEREFORE MOVED that the Senate approves the Data Classification Policy as appended below in the Related Documents section.