Newsgroups: bit.listserv.cumrec-l
Date:         Thu, 1 Oct 1992 15:50:48 EDT
From:         Janet Terry <TERRYJ@VTVM2.BITNET>
Subject:      access policy

Many notes ago, someone (I'm sorry I forgot who and I didn't save the note)
requested policies on data access.  I am including in this note the guidelines
that Virginia Tech has adopted for its administrative data.  If you want more
information on the guidelines and how they were formed, Lore Balkan and Phil
Sheldon presented a paper at CAUSE '89 entitled, "Developing Guidelines for
Information Resource Management:  A Grass-Roots Process in a Decentralized
Environment."

Janet Terry
University Systems Analysis & Services
Virginia Tech
**************************************************************************

  Virginia Polytechnic Institute and State University
                                               No. 2005 Rev. 0
  Policy and Procedures                        Date: November 14, 1989

  Subject:  Guidelines for University Administrative Information Resource
  Management
  ---------------------------------------------------------------------------




  1.0  Purpose


  While all administrative data captured using University assets are re-
  sources of the University, they vary in their relevance to the administra-
  tive processes of the University.  This policy is intended to apply to
  those data which are critical to the administration of the University.
  While these data may reside in different data base management systems and
  on different machines, these data in aggregate may be thought of as forming
  a logical data base, which will herein be called the ADMINISTRATIVE UNIVER-
  SITY DATA BASE (AUDB).  This terminology is not intended to imply that
  these data now or in the future should reside in a single physical data
  base.  Rather, it is a recognition that regardless of where these data re-
  side, there are some general principles of data management that should be
  applied in order to maintain the value and guarantee effective use of the
  information resource.


  2.0  Policy


  2.1  Information Management Roles


  o   The University is considered the DATA OWNER of all University adminis-
      trative data.

  o   University officials, such as the Controller, the Associate Vice Presi-
      dent for Personnel Resources, and the Registrar, are responsible for
      data in their functional areas and are considered DATA CUSTODIANS.

  o   Staff delegated the responsibility for information management activ-
      ities related to maintenance and dissemination of data are considered
      DATA STEWARDS.

  o   Individuals who have need for University data in order to perform their
      assigned duties and are therefore authorized access are considered DATA
      USERS.

  o   The function of applying formal guidelines and tools to manage the Uni-
      versity's information resource is termed DATA ADMINISTRATION.  Those
      data administration activities that do not fall within the realm of re-
      sponsibility of designated data custodians are the responsibility of
      the Information Resource Management (IRM) department.



  2.2  Data Included in the AUDB


  o   A data element is considered part of the AUDB and should conform to
      AUDB standards if it satisfies one or more of the following criteria:

      -   It is relevant to planning, managing, operating, or auditing major
          administrative functions.
      -   It is referenced or required for use by more than one organiza-
          tional unit.  Data elements used internally by a single department
          or office are not typically part of the AUDB.

      -   It is included in an official University administrative report.

      -   It is used to derive an element that meets the criteria above.

  o   Data elements which meet the criteria for inclusion may be identified
      as such by a data custodian, a data steward, IRM, or a user group.

  o   A data custodian should be identified for each data element to be in-
      cluded in the AUDB.

  o   IRM should assist in the negotiations for inclusion and for identifica-
      tion of data custodians.



  2.3  Data Capture


  o   The data custodian is responsible for complete, accurate, valid, and
      timely data capture.  These responsibilities may be delegated to data
      stewards.

  o   Electronic data should be captured at or near its creation point as
      identified by the data custodian.



  2.4  Data Storage


  o   An official data storage location for each data element should be iden-
      tified by the data custodian.

  o   A official data storage location of valid codes and values for each
      data element should be identified by the data custodian.

  o   Data element names, formats, and codes should be consistent with Uni-
      versity standards.

  o   Archiving requirements and strategies for storing historical data
      should be determined for each data element by the data custodian.

  o   IRM should assist in determining data storage location and archiving
      requirements for AUDB data.



  2.5  Data Validation and Correction


  o   Applications that capture and update AUDB data should incorporate edit
      and validation checks to assure the accuracy of the data.

  o   The accuracy of any element can be questioned by any authorized data
      user.  The data user has the responsibility to help correct the problem
      by supplying as much detailed information as available.

  o   The data custodian or delegated data steward is responsible for re-
      sponding to questions and correcting inconsistencies if necessary.



  o   Upon written identification and notification of erroneous data, correc-
      tive measures should be taken as soon as possible or in accordance with
      the consensus of the users to:

      -   Correct the cause of the erroneous data.

      -   Correct the data in the official data storage location.

      -   Notify users who have received or accessed erroneous data.



  2.6  Data Manipulation, Modification, and Reporting


  o   The data custodian is responsible for authorizing manipulation, modifi-
      cation, or reporting of AUDB data elements and for creating derived el-
      ements, which are also members of the AUDB.

  o   The data custodian is responsible for ensuring that data maintained are
      consistent with official University reporting requirements.

  o   The data custodian has ultimate responsibility for proper use of AUDB
      data; individual data users will be held accountable for their specific
      uses of the data.

  o   All extracted or reported AUDB records should include the time and date
      of data capture.



  2.7  Data Security


  o   All AUDB data should be secured and access granted to a data user only
      for University business on a "need-to-know" basis and within predefined
      access rules and security requirements.

  o   The data custodian has ultimate responsibility for determining security
      requirements and authorizing access.

  o   The individuals or office responsible for implementing access control
      will be identified and charged with this responsibility in writing by
      the data custodian.

  o   The data custodian is responsible for documenting authorization proce-
      dures.

  o   The data custodian is responsible for monitoring and reviewing security
      implementation and authorized access.

  o   All data users of AUDB data should sign a statement indicating their
      understanding of the level of access provided and their responsibility
      to likewise maintain the inherent privacy, accessibility, and integrity
      of the data they are provided.

  o   The data custodian is responsible for assuring that data are backed up
      and recoverable in response to events that compromise data integrity
      such as system failure, inadvertent faulty manipulation, unauthorized
      user penetration, or other unforeseen disasters.


  2.8  Data Documentation


  o   Documentation of data elements should be provided to IRM in machine-
      readable format and will reside in a UNIVERSITY DATA RESOURCE DICTION-
      ARY.

  o   IRM is responsible for the data administration function of maintaining
      the University Data Resource Dictionary and for making it readily ac-
      cessible to data custodians, data stewards, and data users.  In es-
      sence, IRM is data custodian for the the University Data Resource
      Dictionary.

  o   Documentation of data elements is the ultimate responsibility of the
      data custodian.

  o   Documentation/definition for each data element should at least include:

      -   Name and Alias Names

      -   Description

      -   Data Custodian

      -   Usage and Relationships

      -   Frequency of Update

      -   Source for Data Capture

      -   Official Data Storage Location and Format

      -   Description of Validation Criteria and/or Edit Checks

      -   Description, Meaning, and Location of Allowable Codes

      -   Access Rules and Security Requirements

      -   Archiving Requirements

      -   Data Storage Location of Extracts

  o   Documentation for derived AUDB data elements should include the algo-
      rithms or decision rules for the derivation.

  o   Change in any of these characteristics should be noted to IRM and/or
      recorded in the University Data Resource Dictionary in advance of the
      change.



  2.9  Data Availability


  o   Data Custodians are responsible for providing accessible, meaningful,
      and timely machine-readable AUDB data for University use.  This activ-
      ity may be assigned to data stewards or to other University officials
      within the predefined access rules and authorization procedures.

  o   Data custodians and IRM share responsibility for AUDB data compatibil-
      ity, accessibility, and interfaces.



  3.0  Procedures


  These GUIDELINES FOR UNIVERSITY ADMINISTRATIVE INFORMATION RESOURCE MANAGE-
  MENT have been prepared by the Information Resource Management (IRM) de-
  partment and the Office of Institutional Research and Planning Analysis in
  association with the Administrative Systems Users Group (ASUG).  They serve
  as a statement of objectives to manage the administrative information re-
  source.  These GUIDELINES apply to all AUDB data.  In addition, these
  GUIDELINES should be considered and followed where possible by all those
  who capture data and manage administrative information systems using assets
  of the University.  STANDARDS AND PROCEDURES SHOULD BE DEVELOPED TO CONFORM
  TO THE OBJECTIVES EMBODIED IN THESE GUIDELINES.

  Copies of these GUIDELINES or related standards documents are available
  from the Information Resource Management Department and from the Adminis-
  trative Information System.



  3.1  Updates


  As an ongoing document, these GUIDELINES FOR UNIVERSITY ADMINISTRATIVE IN-
  FORMATION RESOURCE MANAGEMENT will be maintained and revised as needed by
  the Information Resource Management department (IRM) in cooperation with
  data custodians and administrative systems users groups.  All administra-
  tive system users are encouraged to correspond with IRM describing any sug-
  gestions for improving these GUIDELINES.  When corresponding please refer
  to the document title and provide an appropriate section and page number
  reference.

  Changes or updates to these GUIDELINES will be reviewed by the AGENCY RE-
  CORDS ADMINISTRATOR to ensure compliance with MANAGEMENT OF UNIVERSITY RE-
  CORDS (University Policy 2000) and related State regulations.  Revisions to
  these GUIDELINES will be sent to the manager of the Administrative Informa-
  tion System (before the effective date of the change, if possible).  The
  update will be made, the date and revision number changed and the revision
  noted in Section 6.0, and returned to be approved and released.


  4.0  Definitions


  1.  AUDB (ADMINISTRATIVE UNIVERSITY DATA BASE) is a conceptual term used to
      identify that body of data critical to University planning, management
      and business operations.

  2.  DATA ADMINISTRATION is the function of applying formal guidelines and
      tools to manage the University's information resource.

  3.  DATA CUSTODIANS are the University officials responsible for managing a
      segment of the University's information resource.

  4.  DATA STEWARDS are staff members delegated the responsibility for data
      maintenance and data dissemination.

  5.  DATA USERS are individuals who are authorized access to University data
      required by them to perform their assigned duties.

  6.  UNIVERSITY DATA RESOURCE DICTIONARY is a database system that functions
      as a repository that contains comprehensive information about Univer-
      sity data and documentation of University administrative systems.



  5.0  References


  1.  Policy 2000, "Management of University Records."


  6.0  Approvals and Revisions


      Approved January 5, 1989 by the Administrative Systems Users Group
      (ASUG).

      Approved November 14, 1989 by the Director of the Office of Institu-
      tional Research and Planning Analysis, James R. Montgomery.
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU