Yes, based on focus of policies, e.g. campus wide or internal department. Policies applying only to resources operated by distributed academic and administrative units are set and administered by the unit. Unit policies may not contradice university-wide policies. Office of Inormation Technology sets policies for the central resources that it administers. However, IT and data policies may also be set at the college or departmental level.
Policies are often unwritten or established practices.
Departments can create policies beyond those established centrally to cover their facilities. Determined by scope of the issue, and differences in campus or department operations. Departments have discretion to develop more restrictive policy in addition to institutional security policy.