91视频

Overview

The Division of Student Affairs (DSA) IT Services maintains a risk register that identifies technology risks associated with critical services that have a high probability of occurrence, a high operational impact, or both. Risks are continuously evaluated in collaboration with University Information Technology (UIT) and prioritized based on their potential effect on university operations, information security, regulatory compliance, and business continuity.

Potential risks to the DSA IT environment include the following categories:

Cybersecurity Risks

• Malware, ransomware, and phishing attacks
• Unauthorized access to systems or data
• Credential compromise and account takeover
• Insider threats
• Data breaches involving confidential or protected information

Infrastructure Risks

• Server or storage failures
• Network outages or degraded performance
• Power interruptions affecting IT services
• Hardware failures
• Environmental events impacting data center operations

Application and Software Risks

• Enterprise application failures
• Software vulnerabilities
• Unsupported or end-of-life applications
• Failed software updates or patches
• Integration failures between systems

Cloud and Third-Party Service Risks

• Vendor service outages
• Software-as-a-Service (SaaS) disruptions
• Cloud storage availability issues
• Third-party security incidents
• Vendor contract or support limitations

Data Management Risks

• Data loss or corruption
• Inadequate backup or recovery processes
• Accidental deletion of critical information
• Improper data retention or disposal
• Inaccurate or inconsistent data

Business Continuity Risks

• Natural disasters
• Extended utility outages
• Pandemic or public health events
• Loss of critical personnel
• Failure of disaster recovery processes

Operational Risks

• Insufficient staffing or technical expertise
• Delays in technology procurement
• Inadequate documentation
• Failure to follow established IT procedures
• Technology project delays or implementation failures

Information Security and Compliance Risks

• Noncompliance with university policies
• Failure to meet regulatory or contractual requirements
• Inadequate access controls
• Incomplete security awareness training
• Audit findings requiring remediation

Endpoint and Device Risks

• Lost or stolen computers and mobile devices
• Unsupported operating systems
• Delayed security patching
• Hardware lifecycle issues
• Unauthorized software installation

Website and Digital Services Risks

• Website outages
• Content management system vulnerabilities
• Accessibility compliance deficiencies
• Domain or certificate expiration
• Web application attacks

Physical Security Risks

• Unauthorized access to IT equipment
• Theft or vandalism of technology assets
• Damage from fire, flooding, or other environmental hazards
• Failure of environmental controls in equipment rooms

DSA IT Services reviews these risks on an ongoing basis and works with University Information Technology (UIT) to implement appropriate mitigation strategies, maintain service continuity, and ensure compliance with university security and technology standards.

IT Service Continuity Management Overview

The goal of IT Service Continuity Management (SCM) is to support the overall business continuity management processes by ensuring that the required IT technical and service facilities (including computing systems, network infrastructure, data repositories, applications, telecommunications, environment, technical support, and service desk) can be resumed within the required and agreed business levels.

IT Service Continuity Management At The Division Of Student Affairs

The DSA IT Services Continuity Management Plan is modeled after the University of Houston Information Technology service continuity plan, which covers University-wide IT assets and services. The DSA plan focuses on the continuity of IT assets controlled by the DSA, not those managed or owned by other divisions or the University itself. The current DSA IT Services Business Continuity Plan is available upon request.

Overview

All software purchases are centralized and handled by DSA IT Services. Software is purchased through business services in accordance with University MAPP purchasing procedures. Software is reviewed regularly by DSA IT Services to ensure it is up to date and meets the division's goals. The DSA IT Services personnel (technology manager and information security officer) have P-Card authority to purchase IT equipment and software. Most transactions are done with a P-Card, and only amounts over $5,000 are handled through a purchase order.

• Purchases of software that require an annual subscription renewal or are cloud-based will be the sole responsibility of the requesting department (i.e., the Adobe Creative Suites).

Software License and Maintenance Management

DSA IT Services manages the deployment, licensing, and lifecycle of software used throughout the division. Responsibilities include:

• Verifying software licensing compliance.
• Installing and configuring approved software.
• Applying updates and security patches when appropriate.
• Coordinating license renewals with departments and vendors.
• Maintaining documentation of software ownership and licensing.

Whenever possible, DSA departments utilize software available through university enterprise or site licensing agreements managed by UIT. Specialized software required to support departmental operations is managed in accordance with vendor licensing terms and university policy.

Software Inventory (MAPP 03.03.03)

DSA IT Services maintains an inventory of division-supported software licenses and installations using university-approved endpoint and asset management tools. Software inventory is routinely reviewed to verify licensing compliance, identify unauthorized software, support security audits, and assist with technology planning and budgeting.

The division leverages centralized endpoint management and software inventory solutions provided by University Information Technology to maintain visibility into software deployed on university-owned devices. Periodic audits are conducted to ensure software remains properly licensed, supported, and aligned with operational needs.

Software Retirement and Disposal

When software reaches the end of life, is no longer supported, or is no longer required for business operations, DSA IT Services coordinates its removal from university-owned devices and updates the software inventory accordingly. Legacy installation files and digital installation media are securely deleted when no longer needed. If physical installation media or license materials exist, they are disposed of in accordance with university records management and information security procedures. Transferable software licenses may be reassigned or reallocated when permitted by the vendor's licensing agreement. Retired software is removed from inventory records to maintain an accurate accounting of licensed applications across the Division of Student Affairs.

Overview

All technology purchases for the Division of Student Affairs (DSA) are coordinated through DSA IT Services and must comply with 91视频 procurement procedures, University Information Technology (UIT) standards, and applicable security requirements. Before purchase, DSA IT Services reviews hardware requests to ensure compatibility, security, supportability, and alignment with university technology standards. Standard technology configurations are provided based on an employee's job responsibilities. Employees are generally assigned one primary university-owned computer, consisting of a laptop, docking station, monitor(s), and standard peripherals. Additional computing devices require business justification and approval from department leadership and DSA IT Services.

University-approved vendors and purchasing contracts are used whenever possible to ensure standardized support, warranty coverage, and lifecycle management.

Mobile Devices and Tablets

Tablets and other specialized mobile devices may be purchased when operationally justified and approved by the requesting department's Assistant Vice President (AVP). Departments are responsible for funding specialized equipment and any required software subscriptions. Devices must comply with university security standards and may be enrolled in centralized device management when appropriate.

Printers

To reduce costs, improve security, and support sustainability initiatives, DSA encourages the use of shared network printers whenever practical. Personal desktop printers require departmental approval and should be used only when business operations require printing confidential or sensitive information. Departments are responsible for purchasing printer supplies and replacement equipment. DSA IT Services provides support for network connectivity and basic printer configuration, but does not repair or maintain aging or unsupported printer hardware.

Hardware Lifecycle and Replacement

DSA IT Services manages the lifecycle of university-owned technology to maintain reliable, secure, and supported computing environments. Standard employee computers are generally replaced on a four-year lifecycle, subject to available funding and operational priorities. Replacement schedules may vary based on device condition, manufacturer support, warranty status, and departmental business needs. Equipment no longer suitable for primary use may be redeployed for secondary or limited-purpose functions when appropriate.

Hardware Asset Management

DSA IT Services maintains a current inventory of university-owned computing devices used throughout the Division of Student Affairs in accordance with University Property Management requirements. This inventory supports technology planning, lifecycle management, equipment deployments, and operational support.

Responsibilities include:

• Maintaining an up-to-date inventory of university-owned computers and other supported technology assets.
• Tracking equipment assignments and locations.
• Coordinating technology deployments, transfers, and replacements.
• Supporting annual property inventory verification.
• Assisting departmental property custodians with inventory reconciliation and technology-related asset management.

While DSA IT Services maintains a centralized inventory of computing devices for operational purposes, each asset remains assigned to the inventory of the employee's home department and is the responsibility of that department's designated Property Custodian. Property Custodians are responsible for ensuring compliance with University Property Management policies, including inventory verification, transfers, surplus processing, and record accuracy.

Hardware Retirement and Disposal

All university-owned technology equipment must be disposed of in accordance with University Property Management procedures and University Information Technology data security standards. Before disposal, transfer, surplus, or recycling, DSA IT Services ensures that storage devices are sanitized using approved data destruction methods consistent with university information security requirements. Technology assets are removed from inventory records following proper disposal or transfer. Electronic waste is recycled whenever possible through the approved university surplus or recycling program.

Overview

DSA IT Services requests that employees and supported student organizations consult with DSA IT Services before connecting new university-owned devices or specialized technology to the UH network through wired, wireless, or tunneled (VPN) connections. This is particularly important for equipment that may require network configuration, registration, specialized access, or integration with university systems.

For standard wireless connectivity, employees should use UHSecure. UIT identifies UHSecure as the secure wireless network for UH students, faculty, and staff. It provides secure communications and access to campus resources and requires a CougarNet account. Devices that cannot use standard secure wireless connectivity may require registration or another UIT-supported network option. Employees should not independently configure specialized network equipment, wireless access points, servers, or similar infrastructure without consultation with DSA IT Services and, when appropriate, UIT.

Devices connected to the university network are subject to applicable university information security requirements. DSA IT Services and the Division Information Security Officer (ISO) may coordinate with UIT Security when a device poses a potential security, network, or data integrity risk. UIT may restrict or disconnect devices when necessary to protect university technology resources.

Connection Guidance: UH Wi-Fi Networks / UHSecure | UHSecure FAQ

Overview

DSA employees are responsible for storing university business information in University of Houston-approved storage locations and systems appropriate for the sensitivity, business purpose, collaboration requirements, and records-retention requirements of the information. Employees should not rely solely on the local storage of a desktop, laptop, external drive, or other endpoint device for university records or other important business information. When appropriate, employees should use university-supported services such as Microsoft OneDrive, SharePoint, Teams, approved departmental file shares, and other storage solutions provided or approved by DSA IT Services and UIT.

Microsoft 365 is the 91视频's official cloud storage, communication, collaboration, and productivity platform. UIT identifies OneDrive as personal storage for faculty, staff, and students and SharePoint as organizational storage for divisions, departments, and colleges. Employees should use OneDrive for active individual work files and SharePoint or other approved departmental repositories for information requiring organizational ownership, shared access, or longer-term departmental availability. UIT guidance recommends using OneDrive for backup rather than long-term archiving and moving long-term storage files to SharePoint.

DSA IT Services will work with departments and UIT to determine appropriate storage and backup solutions based on business requirements, data classification, security, access, collaboration, continuity, and retention needs. The existence of a backup or cloud copy does not replace an employee's responsibility to manage university records properly.

University records must be retained, protected, transferred, and disposed of in accordance with applicable 91视频 and 91视频 System records-retention requirements. Employees should periodically review stored information and remove unnecessary duplicate, temporary, and outdated files when permitted by applicable records-retention requirements. Access permissions for shared information should also be reviewed regularly.

Storage resources: Microsoft 365 | OneDrive | SharePoint / OneDrive | OneDrive & SharePoint Best Practices

Overview

DSA IT Services promotes continuous technology education for employees throughout the Division of Student Affairs. DSA IT Services may provide or coordinate training based on departmental needs, technology implementations, emerging risks, and changes to university-supported systems.

Employees are encouraged to take advantage of technology training and professional development resources provided through University Information Technology. Available learning opportunities include Microsoft 365 applications, information security, artificial intelligence, Microsoft Copilot, collaboration tools, and other university-supported technologies.

Overview

The UH AI Learning Hub is the university's centralized resource for artificial intelligence training and guidance for students, faculty, and staff. Resources include the self-guided AI Foundations course, practical video training, AI events, Microsoft Copilot training, and curated LinkedIn Learning courses. LinkedIn Learning AI courses are available to UH employees at no cost.

AI training: UH AI Learning Hub | UH AI Solutions | UH AI Tools Hub

UH IT Training and Employee Resources

The following links provide employees with direct access to UH technology training, guidance, and self-service resources.

Resource	Purpose	Link
UIT Home / Quick Start & Help	Central starting point for UIT services, staff quick-start resources, software, support, and the Knowledge Base.	Open resource
UH AI Learning Hub	AI Foundations, practical videos, webinars/events, Microsoft Copilot training, and curated LinkedIn Learning pathways.	Open resource
UH AI Tools Hub	UH-approved AI tools, use cases, data-classification guidance, and responsible-use information.	Open resource
Microsoft 365	University-supported Microsoft 365 services and quick-start resources for collaboration and productivity.	Open resource
OneDrive	Guidance for storing, syncing, sharing, and collaborating on individual work files.	Open resource
SharePoint / OneDrive	Organizational and personal storage guidance for departments and employees.	Open resource
OneDrive & SharePoint Best Practices	Practical guidance for sharing, permissions, version history, backup, and long-term storage.	Open resource
UIT Security Awareness Training	Mandatory employee security awareness training and customized security workshops.	Open resource
UH Wi-Fi Networks / UHSecure	Instructions for connecting employees and devices to UH wireless networks.	Open resource

DSA IT Services Professional Development

DSA IT Services employees are expected to maintain and continuously develop the knowledge and skills necessary to support the division's technology environment. Professional development may include UIT-sponsored training, Technology Partner activities, vendor and Microsoft training, LinkedIn Learning, cybersecurity and AI education, professional certifications, workshops, and local, regional, or national technology conferences.

Professional development should emphasize cybersecurity, responsible AI use, automation, data management, business process improvement, emerging technologies, customer service, and the effective use of existing university technology platforms.

Overview

Information security is a shared responsibility. All DSA employees who access university technology resources or institutional information are responsible for following university information security requirements and completing required security awareness training.

UIT provides security awareness communications, employee security awareness training, incident guidance, and security resources. Employees should remain attentive to phishing, suspicious email, compromised credentials, malware, inappropriate data sharing, and other potential security threats.

Employees should promptly report suspected information security incidents through established university procedures and should contact DSA IT Services when assistance is needed. DSA IT Services will coordinate with UIT Security when an incident requires university-level investigation, containment, or response.

Security training and guidance: UIT Security Awareness | UIT Security | UIT Help

Overview

Access to DSA information resources must be based on business need, university role, data classification, and the principle of least privilege. DSA information may be stored in approved departmental file shares, Microsoft SharePoint, Microsoft Teams, OneDrive, enterprise applications, and other University-approved systems as appropriate.

Employees are responsible for protecting the university information they create, access, store, or transmit. Sensitive or regulated information must be handled in accordance with the University's data classification and protection requirements. Employees should contact DSA IT Services when uncertain whether a storage location, application, sharing method, or technology is appropriate.

The former reliance on Identity Finder scans as the primary control for locating sensitive data is replaced by current university security, endpoint management, data classification, and approved storage practices. University-owned devices may be managed using centrally supported tools such as Microsoft Intune for Windows and Jamf Pro for Apple devices.

DSA servers and applicable infrastructure hosted within the UH data-center environment are administered and monitored in partnership with UIT under established service arrangements. UIT provides backup services for applicable university servers.

Information protection resources: Device Management | Microsoft Intune | UIT Backup Services

Overview

DSA IT Services assigns technology responsibilities across appropriate functional roles to reduce unnecessary concentration of administrative privileges and provide continuity of operations. Responsibilities for user support, endpoint administration, applications and systems, information security coordination, technology management, and university infrastructure services should be separated when practical.

Privileged access must be limited to authorized personnel with a legitimate business need. DSA IT Services will periodically review administrative and system access and coordinate with UIT when enterprise or centrally managed systems are involved. Changes in employment, job responsibilities, or departmental assignments should result in review and, when appropriate, modification or removal of access.

Operational responsibilities are determined through the DSA IT Services organizational structure, documented procedures, system ownership, and University governance rather than being permanently assigned to named individuals in policy.

Overview

All actual or suspected information security incidents involving DSA information resources, accounts, systems, devices, or university data must be reported promptly to DSA IT Services and the DSA ISO. Employees should follow University reporting procedures and should not independently investigate or contain a potentially significant security incident unless directed by authorized IT or security personnel.

The DSA ISO coordinates divisional information-security matters and works with the DSA IRM, UIT Security, and other appropriate university officials during incident assessment, reporting, containment, investigation, recovery, and follow-up.

The previous references to MAPP 10.03.03 and MAPP 10.05.02 are replaced with the University's current information-security policy framework. Current UIT policy listings identify SAM 07.A.11, Information Security Incident Reporting and Investigation, as the governing information-security incident policy.

Examples of reportable events include suspected phishing or credential compromise, unauthorized access to systems or data, malware, lost or stolen devices containing university information, accidental disclosure of protected information, suspicious account activity, and other events that may threaten the confidentiality, integrity, or availability of university resources.

Incident reporting resources: UIT Policies & Guidelines | UIT Security | UIT Help / Report Security Concerns