6.20 SYSTEM DOCUMENTATION
Effective: August 15, 2024
Purpose: Documentation is a critical part of any information technology system to assist in implementation, management and recovery efforts. Critical information allows the Information Technology (IT) team to properly plan their management activities.
The purpose of this policy is to ensure that the requested information is in place so that anyone with the proper credentials can gather information about a given system without having to search through that system.
Scope: This policy applies to all technology related infrastructure devices including but not limited to servers, routing and switching devices, and telephone systems.
The Information Security Officer (ISO) is responsible for monitoring and reporting compliance with this policy. In all cases, information will be disclosed as required by controlling law.
Responsible Office: Information Technology
Policy Statement: IT Support Personnel or Unit Support Personnel are responsible to maintain system information.
The ISO is responsible for monitoring and reporting compliance with this policy and for reviewing this policy on an annual basis.
The IT Support Personnel or Unit Support Personnel must maintain information for each infrastructure device. This information must include but is not limited to:
- Description and use
- Original justification
- Date placed in service
- Contact and general configuration information
- Classification levels of data managed by this device
- Security measures in place to protect that data
- How this device interacts with other devices
- Change log
It will also contain system specific information for business continuity efforts and incident response.
The President or designee must approve any exceptions to this policy.
Definitions: All words and phrases shall be interpreted utilizing their plain meanings unless otherwise defined in another University or Board of Regents policy or by statute or regulation.
Procedures: All procedures linked and related to the policies above shall have the full force and effect of policy if said procedures have first been properly approved by the University’s administrator in charge of Information Technology.
[Information Technology procedures - coming soon]
Related Policy Information: [coming soon]