Purpose

To establish authority and process for drafting, maintaining, and approving Information Technology Standards and Practices at the University of Tennessee Health Science Center, and grant and control exceptions for unusual operational, technical, or administrative circumstances. University of Tennessee Health Science Center Information Technology Standards and Practices are developed, revised, and issued in response to new guidelines and changes in UT-wide Standards and Practices, internal Standard as well as state and federal laws, regulations, and statutory requirements.

Scope

This standard applies to the development of all UTHSC Information Technology (IT) Standards and Practices.

Standard

1. Development
   1. The UTHSC Office of the Vice Chancellor for Information Technology/CIO (CIO) has the responsibility for developing UTHSC Information Technology Standards, Practices, Procedures, and Guidance specific to UTHSC campuses, colleges, or institutes conformant with UT-wide IT Policies and Standards to accompany and supplement individual information technology Standards and Practices.
   2. The UTHSC Office of Cybersecurity and the Chief Information Security Officer (CISO) has the responsibility for developing Standards, Practices, Procedures and Guidance specific to security related topics conformant with UT-wide Security Policies and Standards.
   3. The Office of the CIO and/or CISO coordinates the IT Standard development function for UTHSC, with responsibility for development, and maintenance; The Office of the CIO and/or CISO maintains a complete repository of UTHSC IT Standards, Practices, Procedures, and Guidelines.
   4. The process for Standard and Practice development will be as outlined in ITS-GP-001.01 – Framework for developing UTHSC IT Standards and Practices.
   5. UTHSC Standards and Practices must align with UT-Wide IT policies and standards and can only be more restrictive than applicable UT-Wide policies and standards.
2. Exceptions
   1. The Office of the CIO, CISO, or designee is authorized to grant exceptions to UT IT Policies and UTHSC IT Standards and Practices.
   2. Exceptions shall be granted in accordance with GP-001.02 – Security exceptions and Exemptions to ITS Standards Practices & Controls.
   3. No exceptions to Federal or State laws or regulations will be granted.

References

1. ITS-GP-001.01-Framework for developing UTHSC IT Standards and Practices
2. GP-001.02-Security Exceptions and Exemptions to ITS Standards Practices & Controls
3. University of Tennessee Policies