Security

Report: Registrars and Enrollment Leaders Need a Heavier Hand in IT Security

• By Dian Schaffhauser
• 10/23/18

Because registrars and enrollment managers make decisions daily that affect securing data, both roles should be "key members" of the cybersecurity team. According to a new paper on information security in higher education, those individuals should meet regularly with the CIO and chief information security officer to weigh in on incident response plans, risk management and training programs. When they're holding staff meetings, information security needs to be a standing agenda item. And they should be involved in taking inventory of the data and who has access to it.

"Why Cybersecurity Matters" was produced by the National Student Clearinghouse, Educause and the Research and Education Networking Information Sharing and Analysis Center (REN-ISAC).

According to the report, at least some of the responsibility for responding to a data breach will rest with the registrar's office and the office of enrollment management. For that reason, the leaders of those units need to understand how breaches could happen, how student data is being secured and what challenges the IT office faces in securing data.

Also, because they interact with third-party companies that are working with student data and institutional systems, they need to be prepared to ask hard questions of those vendors about cybersecurity practices, among them:

• Does the organization use multifactor authentication?
• Does the organization have an incident response plan defined?
• When and how will notification be done when a breach occurs?

The paper offers an action list of recommended actions for these roles, including:

• Pinpointing the risks and sorting out with IT which organization is responsible for what security steps;
• Making sure that endpoints are automatically updated;
• Implementing multifactor authentication; and
• Knowing everyone who has access to the data, how and why.

The 12-page report is openly available on the Student Clearinghouse website.