Resource Management Data Integrity and the Computing Environment

Resource Management, Data Integrity, and the Computing Environment Doug Drury Jim Corkill Business & Financial Services Administrative Services Information Technology October 25, 2012

Agenda Computing Environment l Resource Management l Data Integrity l

Computing Environment Maintaining a reliable computing environment: l Why is this important?

Computing Environment Physical Security l Equipment is properly secured l Equipment is maintained

Computing Environment Systems Development l IS-10 – UC Policy l Establish a plan l Well trained technical professionals l Identify projects l Define scope, benefits, risks, priorities, timing, and implementation method

Computing Environment Systems Development l What is ‘System Development’? l Impact of the project l Determine staffing, equipment, and other needs l Funding requirements and sources l Documentation of system l UC Policy – IS-2, IS-3, IS-10, IS-11 http: //www. ucop. edu/ucophome/policies/bfbis. html

Computing Environment Other Things to Think About: l Systems Management l Password Maintenance l Disaster Recovery l Separating Employees

Electronic Personal Information: What Is It? ● SB 1386 designed to address identity theft – – – · • took effect July 1 st, 2003 added § 1798. 29, § 1798. 82 to State Civil Code (Information Practices Act) created disclosure requirements upon a security breach of systems containing “unencrypted” personal information An individual’s first name or initial and last name in combination with one or more of the following: - Social Security Number - Driver’s License Number - Financial account or credit card number in combination with any password that would permit access to the individual's account See http: //www. oit. ucsb. edu/committees/itpg/sb 1386. asp for more information

Electronic Personal Information UCSB Campus Roles l Data Proprietor - A personal information data store proprietor is the department director or senior manager who is the functional owner of the application that is the primary source of the personal information. It is the responsibility of the data store proprietor to ensure that the inventory of personal information data stores is kept current for the data stores for which the proprietor is responsible.

Electronic Personal Information UCSB Campus Roles l l Data Custodian - A personal information data store custodian is an individual or organization that is responsible for providing technical or system administration support for the data store. It is the responsibility of the personal information data store custodian to ensure that the implementation and administration of the personal information data store conforms to IS-3 requirements, as a minimum, and to campus and industry best practices for system security where appropriate. Campus Sensitive Data Incident Coordinators Doug Drury doug. drury@asit. ucsb. edu

Electronic Personal Information Policy & Guidelines l UC Policy IS-3 and IS-11 define policy regarding management of Electronic Personal Information (as well as other information system issues) http: //www. ucop. edu/ucophome/policies/bfbis. html l UCSB Guideline provides process for handling exposure of personal information http: //www. oit. ucsb. edu/committees/ITPG/sb 1386. asp

Electronic Personal Information Best Practices l l Don’t Store It Unless Absolutely Necessary If You Do Store It l l l Follow IS-3 Policy Retain contact information for stored individuals Submit Inventory Data To Campus Coordinators (doug. drury@asit. ucsb. edu) Follow Industry Best Practices For System Security UC Electronic Communication Policy allows UC campuses to encrypt personal information data stores – ENCRYPT IF POSSIBLE http: //www. ucop. edu/ucophome/policies/ec/

Electronic Personal Information Incident Process l Incident Detection l l Requires active monitoring of data store Requires extensive analysis to determine if a breach as occurred UCSB Guideline provides assessment guidance http: //www. oit. ucsb. edu/committees/ITPG/sb 1386. asp Incident Handling Process l l Follow the UCSB Guideline closely Allow appointed UCSB/UC officials to handle any communication

Electronic Personal Information Sources l UC Policy: http: //www. ucop. edu/ucophome/policies/bfb/is 3. pdf l UCSB Guideline: http: //www. oit. ucsb. edu/committees/ITPG/sb 1386. asp l California Law: http: //www. oit. ucsb. edu/committees/itpg/sb 1386. asp l Finally – The UC/UCSB definition of Personal Data is evolving. You will be kept up to date if the definition changes

Resource Management Financial Data l Value of Budgets l Analyze Costs, Benefits, and Risks l Asset Management l

Resource Management: Financial Data Verify data is accurate and complete l Compare GLO 60 to any Shadow System l Review significant deviations l Document corrective action l

Resource Management: Value of Budgets Represents your financial plan for future periods l Decisions based on data l Proper use of resources l Valuable control l Evaluate resource opportunities l

Resource Management: Value of Budgets Budget for: l Departmental Operations l Events l Projects

Resource Management and SAS 112 Department Key Controls l GL Reconciliation l Review of Budget Reports l Equipment Inventory

Scenario #1 Your department is hosting an international conference. The expected number of participants is 250. Pre-registration is required. The PI, who is the host, believes $500 is the going rate for conferences. In Groups: List the steps you would take to develop the budget and track expenditures for the conference.

Resource Management: Analyze Costs, Benefits, and Risks Something sounds like a good idea, but is it?

Resource Management: Analyze Costs, Benefits, and Risks Components of Analysis l Statement of Purpose l Statement of Benefits l Assumptions l Impact on administrative support

Resource Management: Analyze Costs, Benefits, and Risks Components of Analysis l Quantify costs (one time vs. on-going), space needs, and capital outlay l Funding sources l Potential risks/problems

Resource Management: Analyze Costs, Benefits, and Risks Components of Analysis l Performance follow-up l Did cost projections come in on target? l Did the benefits outweigh the costs? l Did the results meet expectations?

Resource Management: Asset Management Cash l Receivables l University Resources/Equipment l People l

Resource Management: Asset Management Cash l Proper receiving and storing l Proper depositing and recording l Reconcile the deposits

Resource Management: Asset Management Cash Management: Short Term Investment Pool (STIP) l Depository bank accounts l Disbursement bank accounts l Vendor l Payroll l Balances are invested in STIP daily

Resource Management: Asset Management Cash Management: Short Term Investment Pool (STIP) l Earnings are credited back to the funds which generated the interest l The interest for “campus owned” funds is distributed back to the campus

Resource Management: Asset Management Receivables l Do you have any? l Collections l Monitor status l Collection l Write l Agencies Off If you have receivables, you should be using the BA/RC process

Discussion Item #1 Do you have any cash management issues?

Resource Management: Asset Management University Resources l Use of the University Seal l Use of the University Name/Logo

Resource Management: Asset Management l Use of the University Name/Logo l Policy 5010: “Use of the University’s Name” l Use of the University Seal l Policy 5015: “Use of the Unofficial Seal”

Resource Management: Asset Management l Campus designees to authorize use of the seal/name/logo are: l Meta Clow l Mark Beisecker (for commercial products)

Resource Management: Asset Management Equipment l Proper purchasing l Proper tracking l Physical assets are compared to recorded assets and discrepancies are resolved l Proper disposing

Resource Management: Asset Management People - This is our most important asset! l Proper training l Formal delegations l Current job descriptions l Timely evaluations l Consistent and fair treatment

Data Integrity Why do we care? What could go wrong?

Data Integrity How do you maintain data integrity? l Separation of duties l Small departments might need to partner with other departments Adequate documentation and description l Well trained employees l

Data Integrity How do you maintain data integrity? l Compliance with policies and procedures l Coding Transactions Correctly l Reconcile departmental reports to the GLO 60 l Reconcile the GLO 60 on a timely basis l Record retention

Data Integrity Coding Transactions Correctly Types of Costs l l l Direct Indirect Unallowable Function of Cost l l l Teaching Research Public Service Purpose of Costs l Travel l l Office Supplies Services Consistency in treatment of costs is a critical policy for the federal government.

Discussion Item #2 You are given a list of transactions for today’s activity. Identify the correct coding for each transaction.

Data Integrity: Record Retention Why is this important? l The institution needs to consistently apply a records management program l If your practice is to keep everything, you will be expected to produce what is requested l If you can show that you consistently follow the record management program, the court will accept your inability to produce the record

Data Integrity: Record Retention How long do we have to keep records? l The UC Records Disposition Schedules Manual specifies the length of time records must be maintained by the office of record and others: http: //www. policies. uci. edu/adm/records/721 -11 a. html

Data Integrity: Record Retention Who is the office of record? l The office of record is the office responsible for retaining the original record, and for producing a requested record

Data Integrity: Record Retention Who do you call if you have questions? l Meta Clow, the Campus Policy and Records Management Coordinator: l x 4212 l meta. clow@vcadmin. ucsb. edu

Questions?