Governance Center
Accountability & Oversight
Board-to-operations governance model aligned with NIST CSF 2.0 Govern function.
Board of Trustees
Fiduciary oversight · annual review · breach briefing
President
IR activation · cabinet escalation · external communications
CISO
Program ownership · quarterly scorecard · vendor risk
IT Director
Operational security · containment · restoration
Operational Teams
Detection · day-to-day controls · helpdesk
Escalation Procedures
IT Director
Detection and initial containment
CISO
Confirmed incident, scorecard variances
President
IR activation, regulatory breach assessment
Board of Trustees
Critical incident, risk acceptance, annual review
Reporting & Risk Acceptance
Quarterly reporting: CISO presents cybersecurity scorecard to President's cabinet each quarter
Risk acceptance: CFO / Board (Accountable) with CISO recommendation and IT Director operational input
Annual review: Annual full strategy review each June; quarterly KPI scorecard to cabinet
- Any Critical-rated incident or confirmed FERPA breach
- Material change in Tier-1 vendor (Banner, Microsoft, Gecko)
- Regulatory change affecting FERPA, NY SHIELD, or SEVIS
Board Oversight Charter
- Annual review of cybersecurity strategy and budget allocation
- Designated trustee liaison for technology risk oversight
- Board briefing within 10 business days of any regulatory breach notification
- Standing annual board-level cybersecurity briefing as agenda item
- Quarterly cybersecurity scorecard presented to President's cabinet
RACI Matrix
| Activity | President | CFO/Board | CISO | IT Dir. | Legal | DSO |
|---|---|---|---|---|---|---|
| IR Activation | R | A | C | I | I | I |
| Security Budget Approval | C | A | R | I | I | C |
| Risk Acceptance | C | A | C | R | I | I |
| Policy Approval | C | A | R | C | I | I |
| Regulatory Breach Notification | R | A | C | I | C | I |
| Vendor Risk Approval | C | A | R | C | I | C |