Information Security Policy

Overview and Purpose

The University of Oklahoma Foundation, Inc. (the Foundation) possesses certain sensitive information. This policy details and governs the manner in which the Foundation protects the confidentiality and integrity of this data and ensures it is available for appropriate use.

Scope

This policy applies to all information created, received, owned, managed, processed, transmitted, stored, or disposed of by the Foundation, regardless of format (electronic or physical), and to all individuals and entities granted access to the Foundation’s information systems or data, including employees, contractors, volunteers, and third-party service providers.

Governance

This Information Security Policy establishes the governing authority for the Foundation’s information security program. The detailed implementation of this policy is defined through formally approved supporting documents, including but not limited to:

• Information Classification Definitions
  Defines the Foundation’s official information classification categories and provides guidance and examples for classifying data based on sensitivity and risk.
• Information Security Framework
  Describes the operational and technical processes used to implement, manage, and maintain information security controls in support of this policy.

Compliance with these supporting documents is mandatory for all individuals and entities within the scope of this policy whenever the documents apply to their responsibilities or activities.

Roles and Responsibilities

Senior Leadership
Senior Leadership is defined as the current members of the biweekly Senior Leadership Team meeting conducted by the CEO. They provide executive sponsorship for the information security program, approve this policy, allocate appropriate resources, and support enforcement throughout the Foundation.

All Users
Responsible for complying with this policy and associated supporting documents, for the purpose of safeguarding Foundation information to which they are granted access and for reporting any observed security weakness or incident.

Data Stewards and Data Owners
Responsible for ensuring information under their authority is classified appropriately and handled in accordance with Foundation requirements.

Data Custodians (IT Department)
Responsible for implementing and maintaining security controls, standards, and procedures that support this policy.

Compliance

Compliance with this policy and its supporting documents is mandatory. Foundation IT, in coordination with Human Resources, Legal Counsel, or executive leadership, as appropriate, will investigate suspected violations. Violations may also lead to legal consequences in the case of negligence or intentional misuse. Employees are required to report any suspected violations of this policy to their supervisor or appropriate leadership and the Foundation’s IT Department.

Amendments

This policy may be amended from time to time. Any amendments to this policy will be communicated to employees as soon as practical.

Review Change

This policy will be reviewed on as needed basis to be determined by the Senior AVP, Chief Information Officer. The Chief Operating Officer and/or the Senior AVP, Chief Information Officer should review policy changes with the President and Chief Executive Officer and if approved, present any proposed changes to the Board for subsequent approval.

Last updated: 7/6/26