As Jacqueline Simmons explains, IU operates in a complex legal, regulatory, & contractual environment, with responsibilities to comply with applicable legal, regulatory, & contractual requirements regarding safeguards over information and information assets. Doing so protects the university's reputation & minimizes the risk of negative financial consequences associated with noncompliance.

Information systems are at the heart of many university processes. It is therefore important that these systems be acquired, designed, implemented, and maintained with information protection in mind. UITS' Jim Thomas enumerates various places throughout the lives of systems where security and privacy standards should be considered.

A robust and flexible identity and access control infrastructure is key to implementing appropriate information security and privacy. Identity controls must exist to establish a level of assurance that the individual us