Endpoint Management and Security

Layout for printing
Policy Number:
UW-526
Responsible Office:
Division of Information Technology (DoIT)

University Policy

Rationale/​Purpose:

Effective management of computers and computing devices is a fundamental requirement for protecting the intellectual property, confidentiality, integrity, and availability of our institutional information and information technology (IT) resources. This policy enables faculty and staff in performing the university's mission of teaching and learning, research, and outreach. Divisional, departmental, and unit administrators are responsible for complying with this policy.

Intentional management of electronic devices accessing university resources and used to conduct university business to an appropriate standard provides for the reliability and availability of the device to conduct university business, and the security and integrity of university data. Enforcement of this policy reduces the risk of security breaches that could compromise the integrity of university IT infrastructure and protects the university against reputational harm, unintended access, exposure, modification, or removal of university-owned data. This policy promotes good stewardship of UW–Madison's significant investments in IT resources, which include IT infrastructure, computing systems, network systems and industrial control systems.

The associated Endpoint Management and Security policy standards/procedures provide guidance for the complex and diverse needs of UW–Madison, making it possible to comply with UW System policy in addition to federal and other grant requirements.

Scope:

This policy applies to any device, virtual or physical, used to conduct UW-related business, that connects to the UW System-managed network, and/or is used to access, manage, process, or store UW System data. Devices include endpoints purchased or obtained through UW–Madison and personally owned devices that are used to conduct the work of the university.

Policy:
  1. All devices accessing campus resources must be intentionally managed to reduce risk and safeguard proper and efficient operation of and appropriate access to the intended resource. Applicable standards are outlined in the standards document.
    1. Standards for a particular device are to be determined based on the use of the device and the sensitivity/risk of data accessed from a device.
    2. Risk executives are responsible for reviewing exposure risk for any given endpoint; they are encouraged to work with the Office of Cybersecurity to assist with risk assessments.
  2. The chief information officer and vice provost for information technology, working with key stakeholders and representatives across campus, is responsible for the collaborative development and maintenance of the standards in support of this policy, and for providing the common tools, processes, and support.
  3. Divisions, departments, and units are responsible for creating, documenting, maintaining, and implementing standards for managing endpoints that are specific to the risk and operations of their respective mission.
  4. Personal endpoints used to conduct university research and/or business are to be managed by their owner or designee. Owners or designees are responsible for ensuring the device meets the applicable guidelines and standards of this policy.
  5. Risk executives must accept the risk of noncompliance or direct actions to mitigate the risk.
Related UW-Madison Policies:
Related UW–Madison Documents, Web Pages, or Other Resources:
External References:

Policy Administration

Approval Authority:
Chief Information Officer & Vice Provost for Information Technology
Policy Manager:
Assistant Director, Cybersecurity Program and Business Services
Contact:
IT Policy Writer and Analyst -- Heather Johnston, HEATHER.JOHNSTON@WISC.EDU
Effective Date:
04-08-2022
Date Issued:
04-08-2021
Retrieved:
01-17-2025 11:48:52