Admin Guide Chapter 6 & IT Security Standards Updates

The Information Security Office (ISO) is updating Chapter 6 of the Stanford Administrative Guide to create a consolidated policy framework that establishes clear definitions, promotes uniform standards, and strengthens Stanford's overall security posture.

The current security content within the Admin Guide is outdated, fragmented, and inconsistent across schools and departments, failing to reflect modern practices, emerging threats, and the latest technologies. Terms, such as standards, policies, procedures, and guidelines, are often used interchangeably, adding to confusion and risk. These gaps increase the potential for data breaches, legal liabilities, and reputational harm. 

The revised Admin Guide will provide a comprehensive, cohesive approach to information security, safeguarding university data assets and promoting a culture of security awareness and compliance.

Goals:

1. Update out-of-date or non-existent policies

2. Establish clear security standards across campus
3. Introduce policies, standards, guidelines, & procedures
4. Align with industry standards & ensure regulatory compliance

• Oct 2025
   

  Phase 1: Assessment & Planning

  • Conduct a thorough assessment
  • Engage stakeholders
• July 2026
   

  Phase 2: Development & Feedback Gathering

  • Draft/update Admin Guide & Standards
  • Solicit feedback
• Dec 2026
   

  Phase 3: Communication & Education

  • Develop a communication plan
  • Implement an education program 
• April 2028
   

  Phase 4: Implementation

  • Roll out the updated Admin Guide & Standards
  • Provide support resources 
• May 2028-ongoing
   

  Phase 5: Monitoring & Continuous Improvement

  • Establish routine audits
  • Gather continuous feedback 

Admin Guide

• Privacy and Information Security
• Information Security Incident Response
• Data Retention & Disposition (NEW by UPO)
• Digital Accessibility (DONE by SODA)
• Responsible Use of IT Resources
• IT Services
• Administrative Computing Systems
• Cloud Computing (NEW)
• Mobile Device Services
• Telecommunication Services

Security Standards

• Identity & User Credentials
• Application Development
• Authentication & Access Control Payment
• Card Industry Security
• Minimum Security
• Vulnerability Management
• Stanford Computer Security
• IT Logging and Management
• Stanford Password
• Security Awareness Training
• Third Party Tools
• IT Security Incident Response
• Data Disposition - Removal and Sanitization
• Data Retention

Compliance-Related Standards

• PCI-DSS
• HIPAA
• NIST 800-171

Research Policy Handbook

Updating 1.10: Information Security page