IT Services Transition Weekly Program Management Working Session

1. IT Services TransitionWeekly Program Management Working Session February 28, 2011 | Monday | 1:00 – 3:00pm

2. IT Security: Overview of List of "Services" identified to date Discussion around Next Steps and Impacts on Other WGs / IT Service Areas (Jay Carter, Liz Egan, Christian Hamer) IT Service Delivery WGs: Checkpoint on 2 key templates R1 Customer Input Summary; and Enhanced IT Service Definition Template Foundational WGs: Round-robin status updates Communications HR Finance Agenda 2

3. IT Security WG Debrief 3

4. IT Services Catalog - Security • Agenda • Review approach to crossover services – RACI - Jay • Review KC Advisor feedback and proposed principles - Liz/ Jay/ Christian • Battle of the Catalogs: Multi-services vs. Bundled services - Jay/ Christian • University Obligations – Liz • Next steps

5. RACI Role Distinction • Responsible The entity that actually performs the work to achieve the task. There is typically one entity designated as Responsible, although others can be delegated to assist in the work required. Ongoing management and support. • Accountable The entity ultimately accountable for the correct and thorough completion of the deliverable or task, and the one to whom the Responsible entity is accountable. In other words, an Accountable entity must sign off (Approve) on work that the Responsible entity provides. There must be only one Accountable entity specified for each task or deliverable. Product management. Assure compliance and Approver sign-off. • Consulted Those whose opinions are sought and potentially influence outcomes; and with whom there is two-way communication. Assure compliance and Approver sign-off. • Informed Those who are kept up-to-date on progress, often only on completion of the task or deliverable; and with whom there is just one-way communication.

6. IT Services Catalog - Security

7. IT Services Catalog - Security

8. Information Security Services – Advisor Feedback Only list what I can order Describe the service I will receive, e.g., what will you do for me? Flatten services to combine complimentary services View through the eyes on the customer not IT

9. Information Security Services Before Feedback: After Feedback: Vulnerability Assessment, Penetration Testing and Code Analysis Digital Certificate Management Computer Security Incident Response and Digital Forensic Investigation Security Operations Center Security Consulting Security Education • Policy and Compliance • Protection Services • Response Services • Monitoring, Detection and Testing Services • Security Compliance Consulting • Remediation Guidance • Security Education

10. Information Security Service Catalog – 1st DRAFT

11. Information Security Service Catalog – 2nd DRAFT

12. University Obligations • Security and Privacy Policy • University Compliance Management • Security, Privacy, HIPAA, FERPA, others? • DMCA Management • Law Enforcement Interaction

13. Security Services Catalog – Next Steps Define and refine consultative and core services Address varieties of consulting Define core platform Finalize required and bundled services High level review across all Service areas; address all required services

14. IT Service Delivery WGsCheckpoint on 2 Templates 14

15. IT Service Delivery WGs • R1 Customer Input Summary (see separate .doc template) • Confirm purpose • Confirm target due date: 3/7, Monday @ COB • Enhanced IT Service Definition Template (see separate .doc template) • Still under development • Will email out @ end of day today • Next steps: email back feedback / high priority additional changes; email clarification questions, too

16. Foundational WGsRound-robin Status Updates 16

17. Program-wide Status Snapshot: Key Updates Only