Weber State University Information Technology Division. Policy Guide

Weber State University Information Technology Division Policy Guide Updated: April 25, 2012

Table of Contents Using This Guide... 4 What is Policy?... 4 Why is Policy Created?... 4 University Policy vs. Division Policy... 5 Policy vs. Standard vs. Guidelines vs. Procedure... 5 Policy... 5 Standard... 6 Guidelines... 6 Procedures... 6 Policy Relationships... 6 Characteristics of a Good Policy Document... 7 Preparation and Research... 8 Policy Templates... 8 Policy Numbering Convention... 9 Policy Document Elements... 10 Policy Document... 10 Standards and Guidelines... 10 Procedures... 11 Policy Coordination... 11 Policy Approval... 11 Publishing Policy... 12 Writing Tips... 12 Process for Creating Policy... 12 Policy Review Process... 14 Approval and Coordination Documentation... 14 Minor Changes... 15 Policy Development Participants Responsibilities... 15 Questions and Comments... 16 Appendix A: Policy Template... 17 Appendix B: Standards and Guidelines Template... 18 Appendix C: Procedures Template... 19 Appendix D: Iterative Coordination Illustration... 20 Updated: April 25, 2012

Appendix E: Policy Creation Process... 21 Appendix F: New Policy Request Form... 22 Appendix G: Policy Review Process... 23 Appendix H: Policy Coordination and Approval Form... 24 Updated: April 25, 2012

Using This Guide This guide is designed to help policy developers in the information Technology Division of Weber State University with the process of researching, writing and maintaining policies that affect either the Division or the University. This guide should be used as a resource by anyone who develops or updates campus wide or Division policies for the unit. The reader should understand that the word Policy is used in this document as an all-inclusive term to include policy, standards, guidelines and procedures. The processes for performing creation and review functions on policy documents is the same regardless of whether it is the policy, standards and guidelines, or procedure. What is Policy? Policy is defined as a high-level overall plan embracing the general goals and acceptable procedures especially of a governmental body. At Weber State University, we define policy as broad management directives with the goal of achieving University or Division goals and objectives. These goals may be preplanned and found in strategic plans or any number of other planning documents. They may also be ad hoc goals that attempt to solve recurring problems, define a process, etc. The following paragraphs and illustrations attempt to refine this definition. Why is Policy Created? Policy is created for a variety of reasons. The important thing to understand is that policy should only be created for reasons that the author can clearly articulate and support. The intent is not to create policies for every eventuality that we face on a daily basis. Rather, the intent is to create policy only for those situations that truly warrant it. The following are some examples of reasons why we would create policy: Mitigate risk Establish uniformity in processes Demonstrate fair and equitable treatment Conform to regulatory/contractual requirements Clearly articulate roles and responsibilities Communicate acceptable employee behaviors Resolve recurring problems Operational efficiency Public image Minimize confusion It should also be noted that just because policy seems to fit nicely into one of these categories, that still does not automatically mean that we should create policy. The writer must perform Updated: April 25, 2012 P a g e 4

careful and thorough research to determine that policy is what is necessary to achieve the end goal. University Policy vs. Division Policy Early in the policy writing process, the policy developer will need to determine to what level of scope the policy will need to be written: University or Division. Depending on the answer to this question, there will be differences in the process that will need to be followed to achieve coordination and approval. The main criteria for determining which audience you are writing for is whether the policy only affects the people and processes of the IT Division or whether it affects users across the entire university. If it is determined that it affects the entire university, then the completed policy will need to be included in the University PPM which will require approval from the President s Council and Board of Trustees as well as coordination from a broader range of participants. Policies within the division will be approved by the VP for Information Technology and may or may not require coordination outside of the Division. It is important that the developer determine the scope early so that all of the coordinating bodies can be identified and scheduled accordingly. Policy vs. Standard vs. Guidelines vs. Procedure Figure 1 below illustrates the policy hierarchy. As illustrated, policy is the overarching management statement that declares in broad terms the intent of the management direction (what). It is supported by standards (what I must do to comply with policy), guidelines (recommendations/best practices) and procedures (how I accomplish the standards). Policy must at least contain standards and may contain guidelines and procedures, as well. The policy itself can be thought of as a framework within which management must operate. Definitions of each of these elements and their characteristics are given below. Figure 1: Policy Hierarchy Policy Statements, either expressed or implied, of those principles and rules that are set up by executive leadership as guides and constraints for the organization s thought and action. Updated: April 25, 2012 P a g e 5

Means or routes to achieving University/Division objectives Long term decision standing answer to recurring problems Function of all managers in an organization Management decision boundaries stated in broad terms Restrictive and permissive in nature Restrict actions that can be taken Permit freedom to operate within specified constraints Expression of intentions of top management Standard An agreed upon, repeatable way of complying with policy Mandatory compliance Uniform method to support policy Directive in nature (will, shall, etc.) Guidelines Suggested actions to take in the absence of standards Compliance not mandatory Acceptable measures supplemental to policy requirements Provide a framework for management to work within Suggestive in nature (should, could, etc.) Procedures Specific steps outlining how to comply with standards Mandatory compliance Specifically address standards Process driven Policy Relationships Figure 2 illustrates the relationships between policies, standards, guidelines and procedures. As the diagram indicates, Policy is the overarching management direction supported by standards and guidelines. The how-to for accomplishing standards and guidelines are contained in the procedure. A review process encompasses all of these pieces and allows for changes to be made when the policy either does not achieve its desired affect or its time in the review schedule has come about. Updated: April 25, 2012 P a g e 6

Figure 2: Policy Relationships Characteristics of a Good Policy Document The policy manuals for both the IT Division and the University are intended to be practical, administrative guides with both style and content determined by user needs. The only way this can be the case if each and every policy and procedure document is developed, written and updated with the user in mind. Good policy and procedure documents: Are reviewed regularly and updated as needed to provide appropriate direction to the campus. Are written using simple, clear and concise language Avoid jargon and overly technical descriptions Are written assuming basic knowledge of the campus, but novice knowledge of the specific policy and procedure being described Clearly differentiate different headings within the document Consider why the user will need the information and what the user will likely be doing when looking for information Provide accurate contact information for users who have questions or situations that fall outside of the normal situation Remember that policy documents are not marketing documents or creative writing pieces. The goal of a well written policy is to clearly explain how to accomplish a specific process at Weber State with minimal problem, aggravation or risk of non-compliance. Updated: April 25, 2012 P a g e 7

Preparation and Research Before you start writing any policy, it is important to gather the information you need to develop an accurate document. To effectively focus your preparation, be sure you are clear on the point of the policy you are about to develop. Is the policy being developed in response to a problem encountered on campus, in response to a new policy issued by the University or State or Federal Regulation, or for some other reason? You need to determine what you are trying to accomplish and make sure the point of the policy will be clear to the campus community. The first place to look for information is the University PPM and/or the Division Policy Website for related policies and information. When you are developing a new policy document, check to be sure you are not duplicating existing information. There may be a section from either one or both of these sources that can be expanded to include the information you are developing or there may be related policy documents that will help inform the policy you are developing. By gathering this information in advance, you will know where you can cross-reference rather than repeat information and you can be sure the policy document you develop corresponds with existing policies and procedures. It may also be helpful to look at any policy document issued at other universities regarding the topic you plan to address. Other campuses may have found new or creative ways of addressing issues with which your unit has been struggling. Since we often deal with similar issues, reviewing other universities policies can sometimes help focus your policy development and give you a good starting point for your policy. Keep in mind that all division policies must be in compliance with University policies. They can be more restrictive but they can never be more relaxed. It is important to consult with primary stakeholders in the policy to determine existing processes and problem areas and to ensure that the policy document you develop will not impede the ability of other units to conduct business. It is not necessary for you to conduct a broad review at this point, but you should consult with those units who play a role in the policy you are developing and those whose regular business may be dramatically affected by the developing policy. Finally, consult with the Division Policy Administrator regularly during policy development. This person is responsible for providing guidance and oversight for Division policy development and should be included early in all policy development activity. Policy Templates The Division Policy Administrator has developed standard templates for use when creating policy documents. The templates are available on the Division Policy website at Updated: April 25, 2012 P a g e 8

http://www.weber.edu/itdivision/itdivisionforms.html. These templates use standard styles that allow for clean transition from the Word document to the Web. It is important to use the templates and styles properly to help streamline the review and approval process. It is also important in that it provides a professional and uniform look and feel across all of the policies and procedures in the Division. To become familiar with the policy document templates, see Appendix A, Appendix B, and Appendix C. Policy Numbering Convention All policy, standards and guidelines, and procedure documents will adhere to a standard numbering convention. The following table outlines the convention: Division Document Convention Policy [Year]-IT-PO-[Number] Standard and Guideline [Year]-IT-SG-[Number] Procedure [Year]-IT-PR-[Number] University Policy PPM, 10-[Number] Standards And Guidelines [Year]-IT-PO-[PPM Number] Procedure [Year]-IT-PO-[PPM Number] Number For Division documents this will be a sequential number equal to the largest number of already published policy documents plus one. For University policy this will be the largest number of already published policy documents in the PPM plus one. Year The current year in which the document was created. IT Denotes an IT policy document. PO Denotes the policy document. SG Denotes Standards and Guidelines. PR Denotes Procedures. For Standards and Guidelines and Procedures that are being maintained in the Division but support University policy, the PPM number will be the same as the PPM number of the parent policy. This will make it easy to identify which policy it supports. Updated: April 25, 2012 P a g e 9

Policy Document Elements Policy will consist of at a minimum two and possibly three separate documents : Policy, Standards & Guidelines and Procedure. For those policies that will be approved at the Board of Directors level and published in the University PPM, the Standards & Guidelines and Procedures documents will be maintained within the IT Division Policy Website. This allows the flexibility of being able to make minor changes to the latter two documents without having to go through the entire formal University review and approval process. Changes to the policy itself, however, will require approval at the Board of Directors. The following details the headings that make up each of the policy documents. Policy Document Header The header contains general document information such as policy title, policy number, date approved, revision date and policy authors. Purpose This section is used to communicate the reason the policy was created. The information should be factual and contain a clear statement of intent. References This section lists any other policies, regulatory documents or other documents that contain information that either expounds on the information in the policy, is supplementary to the policy or that the policy supports. At a minimum, the Standards and Guidelines document should be referenced and, if written, the Procedure document. Definitions This section is used to define any terms that are not common knowledge to the user. As mentioned earlier, assume your audience is a complete novice on the subject and define any terms that they might not be familiar with. Policy This is the heart of the policy document. This should be a succinct and straightforward statement of the administration s policy. It should be broad in nature and written such that it will be long lasting requiring little, if any, future revision. The goal of this section is to communicate, in broad terms, the behavior or activities the administration wishes to solicit through this policy. Change History The change history will summarize any changes made to the document and the date the changes were made. Standards and Guidelines Header The header contains general document information such as standards and guidelines title, standards and guidelines number, date approved, revision date and authors. Definitions This section is used to define any terms that are not common knowledge to the user. As mentioned earlier, assume your audience is a complete novice on the subject and define any terms that they may not be familiar with. Updated: April 25, 2012 P a g e 10

Standards This section contains the items that the user must mandatorily comply with in order to be in compliance with the policy. Guidelines This section contains items that are recommendations or best practices for the user to consider. They are not mandatory. Change History The change history will summarize any changes made to the document and the date the changes were made. Procedures Header The header contains general information such as procedure title, procedure number, date approved, revision date and authors. Definitions This section is used to define any terms that are not common knowledge to the user. As mentioned earlier, assume your audience is a complete novice on the subject and define any terms that they may not be familiar with. Procedure This is a step-by-step set of directions on how to accomplish functions necessary to comply with standards. Roles and Responsibilities This is an easy reference listing of the roles and responsibilities of anyone involved in the procedure. Change History The change history will summarize any changes made to the document and the date the changes were made. Policy Coordination Regardless of the scope of the policy you are creating, there will be much coordination to be accomplished. Remember that as your scope increases, the approval authorities you will be seeking approval from later will be looking for increased levels of coordination. While it is not necessary to gain 100% approval from everyone who coordinates on your policy, it is important to gain as broad of a consensus as possible. This is where the iterative nature of this process is most apparent and can be seen in Appendix D. It is possible that you may have to modify your document multiple times to gain the consensus you need for approval. Policy Approval Here again, this is another iterative part of the process and is illustrated in Appendix D. Much like the coordination phase, you will need to satisfy the approval authorities for your policy that you have performed the necessary coordination to bring all of the affected entities to some sort of consensus. It is entirely possible, although not always necessary, that you may have to make changes to your already coordinated draft and move back into the coordination phase to regain your consensus. Also, depending on the scope of your policy, you will have different approval Updated: April 25, 2012 P a g e 11

authorities. For policy that only affects the IT Division, the approval authority will be the VP for Information Technology. For policy that affects the University as a whole the approval authority will be the Board of Trustees. Publishing Policy After successfully gaining the approval from whichever approval authority your policy requires, it is now time to publish your policy. If the policy was approved at the Board of Trustees, it will be published in the University PPM. If it was approved by the VP for Information Technology it will be published in the IT Policy Website. Writing Tips When writing policy, keep in mind that you are an expert in the area on which you are writing, but that the users of your policy will not be. Many people referring to your policy may be new to their current position or new to the campus altogether. This means that you need to keep your standards, guidelines and procedures as simple and straightforward as possible. Provide enough information for users to understand the policy, but not so much that they become confused. Keep your language straightforward and write with attention to what the general campus population needs to know, not what a specialist in your own unit needs to know. Remember that you can always provide supplemental information on your own Web site and provide a crossreference in the policy for those users who may need more assistance. Do not confuse policy with standards, guidelines or procedures. The term policy refers to a very specific aspect of the document. That part should include only the governing principles that explain the reason why the remainder of the policy exists. It explains why we have certain standards, guidelines or procedures, but not how to accomplish tasks. Remember that policy is what that we want to achieve, standards are the things we must do to achieve the policy, guidelines are recommended actions to take and procedure is the how of accomplishing the standards. Your choice of words is very important in making sure your intent comes across clearly. Words like shall, will, or must indicate that something is mandatory. Works like should or could indicate that something is not mandatory and can be bypassed. Process for Creating Policy Researching and writing policy is only the beginning of the long road to actually getting a policy published. The key to effective policy is coordination and without proper coordination amongst all of the affected entities, the chances of gaining approval for the policy will be slim. There will be many people and groups to coordinate with before you have your finished product and what you end up with will very likely not resemble what you started with very closely. This is an Updated: April 25, 2012 P a g e 12

iterative process that will often require the author(s) to re-examine what has been written multiple times before approval can be obtained. Appendix E illustrates the policy creation process in a graphic format. 1. Identify policy need Recall in the section titled Why Create Policy we talked about the reasons why policy might be created. While that list is not all-inclusive, it is a good starting point for identifying a category in which to fit your policy. Policy may be necessary to address any or several of these reasons or it may just be that management has decided, for whatever reason, that policy needs to be created. 2. Notify PC of policy need This can be accomplished by filling out the New Policy Request form (Appendix F) located at this link and emailing it to the PC. Completing this form will require you to identify some key information that will be needed to begin the policy creation process. 3. The PC will contact the individual who identified the policy need and work with the them to ascertain the validity of the request and to research the PPM and other policies to make sure the need isn t covered somewhere else. 4. Once the request has been verified as valid and that no other policy addresses the issue, the PC will establish the policy creation team from subject matter experts in that area. 5. Initial Policy Creation Meeting a. PC provides policy creation guidance and reviews Policy Guide with team b. Timelines are established for completion based off of the teams availability, the urgency of the need and complexity. c. Goals for the policy are established. d. The appropriate level, University or Division, for the policy is established e. An owner is assigned. 6. The team meets as needed to research and write the policy draft. 7. The team submits the draft policy to the PC by agreed upon date from the Initial Policy Meeting. 8. The PC reviews the draft document for the correct template usage, goals, etc. 9. The PC establishes the Follow-up Policy Creation meeting. a. Address any issues with the draft with the team. b. Establish coordination needs 10. The team corrects any issues discussed during the meeting. 11. The team resubmits the draft document(s) to the PC. 12. The PC sets up coordination with different groups or individuals. 13. The PC facilitates coordination with assistance from the team. 14. The PC facilitates approval with assistance from the team. 15. The PC publishes the newly approved policy to the Policy Website. 16. The PC files the master copy. Updated: April 25, 2012 P a g e 13

Policy Review Process All policies and procedures undergo a review process to ensure the information in them is still relevant. The policies and procedures either contained within or owned by the IT Division will undergo a formal review every six months at a minimum. Due to the technical nature of many of our policies, it is possible that a review will be performed out of cycle if a technological, process, regulatory or other change makes this necessary. Owners assigned to the policies will be responsible for carrying out the reviews. Appendix F illustrates the Policy Review Process. 1. Policy Review Notification The Policy Coordinator will notify the policy owner that a review is necessary either because the required time has elapsed from the last review or the PC has been notified of a change that will require a policy review. Conversely, the policy owner can initiate a review due to information received that warrants a policy change. 2. The policy owner reviews the policy 3. The policy owner notifies the PC of the completed review at or before 30 days from the notification of review 4. If the policy owner reports that no changes are necessary: a. The PC updates the review date on the Website and master copy. b. The PC files the review results with the policy. 5. If needed changes are identified: a. The policy owner retrieves a copy of the master from the policy catalog b. The policy owner makes the required changes to the revision copy. c. The policy owner submits the revision copy to the PC. d. The PC reviews the revision copy for readability and other considerations. e. The PC establishes a Policy Review meeting. i. Go over any issues found during review with the policy owner ii. Determine coordination needs f. The policy owner corrects any issues discussed during the Policy Review Meeting g. The policy owner resubmits the revision draft to the PC h. The PC sets up coordination with different groups or individuals i. The PC facilitates coordination with assistance from the policy owner j. The PC facilitates approval with assistance from the policy owner k. The PC publishes the changes and updates the review date l. The PC updates the master copy, moves former master to history, and files the revision documents with the revision copy. Approval and Coordination Documentation Once you get to the point where it is time to seek coordination and approval for created or revised policy it will be necessary to provide documentation of your coordination efforts to the approval authority. Documented proof of coordination shows the approval authority that careful Updated: April 25, 2012 P a g e 14

thought has been applied to your efforts and that all of the affected entities have had an opportunity to contribute to the process. A Coordination and Approval Form that provides for coordination signatures and comments has been provided at Appendix G. It can be downloaded from this link and must be included with any policy document going forward for approval. Minor Changes From time to time, policies and procedures will need minor changes that do not affect the intent or scope of the document (i.e. office name changes due to reorg, grammar or spelling changes, etc.). These types of changes will be coordinated by the Policy Coordinator and will not require a formal review. The Policy Coordinator will determine the urgency of the modification and either coordinates an immediate change to the policy document or collect modifications until they can be included in the formal review process. Policy Development Participants Responsibilities Many people are involved in the policy creation and review and it is necessary that everyone understand their responsibilities in these processes. Policy Coordinator Facilitate the Policy Creation Process Facilitate the Policy Review Process Lead policy coordination efforts Lead policy approval efforts Maintain IT Division Policy Website Maintain policy templates Aid in policy research Maintain storage for master and revision copies and history Facilitate coordination with coordination entities to gain consensus Facilitate coordination with approval authorities to gain approval or new direction Policy Owner Responsible for the content of the assigned policy documents Assist Policy Coordinator with expert knowledge during review Attend all policy review meetings as requested Monitor policies in your area for necessary changes and notify Policy Coordinator when changes are needed Research as necessary for policy creation or review and revision Participate in coordination and approval processes Conduct regular reviews per the Policy Creation and Review Policy Updated: April 25, 2012 P a g e 15

Policy Creation Team Participate in policy writing process at request of PC Research as necessary for accurate and thorough policy writing Create draft policy Assist PC with coordination and approval process Coordinating Bodies Provide constructive feedback on newly created policy and policy under review Work with Policy coordinator to reach consensus Approval Authorities Provide constructive feedback on newly created policy and policy under review Provide direction to the Policy Coordinator that leads to policy approval Questions and Comments Questions, comments and suggestions regarding this document may be sent to the Plans, Policies and Assessments Administrator at vernmorgan@weber.edu. Updated: April 25, 2012 P a g e 16

Appendix A: Policy Template Updated: April 25, 2012 P a g e 17

Appendix B: Standards and Guidelines Template Updated: April 25, 2012 P a g e 18

Appendix C: Procedures Template Updated: April 25, 2012 P a g e 19

Appendix D: Iterative Coordination Illustration Updated: April 25, 2012 P a g e 20

Appendix E: Policy Creation Process Updated: April 25, 2012 P a g e 21

Appendix F: New Policy Request Form Updated: April 25, 2012 P a g e 22

Appendix G: Policy Review Process Updated: April 25, 2012 P a g e 23

Appendix H: Policy Coordination and Approval Form Updated: April 25, 2012 P a g e 24