15.40 – Data Governance

PART 1: PURPOSE

Consistent with direction from the NMSU Board of Regents and applicable laws and regulations, this rule is adopted:

1. To modify the framework of the university’s Data Governance Program, and facilitate timely access to accurate Data by NMSU users;
2. To clarify the roles, responsibilities and accountability required of the Data Governance Committee, Data Trustees, Data Stewards, Data Custodians, and Data Users;
3. To authorize the Data Stewards to establish, publish and implement Data Governance standards and associated implementing standards of operation (SOP’s) for their particular areas of operation, consistent with policy, law and best practices.
4. To augment the university’s compliance with applicable laws and regulations; and
5. To emphasize the importance of, and to require, effective Data audit capability.

PART 2: DEFINITIONS

Defined terms are capitalized to denote that the term is defined for purposes of this rule.

1. Access: The ability to read, write, copy, query, download, delete or transmit Institutional Data.
2. Data Custodian: An employee who has operational responsibility for the management of any of the systems that serve as sources of Institutional Data.
3. Data Governance: Regulation and protection of Institutional Data through its full life cycle, from creation or acquisition, access and use, to final disposition. A data governance program includes:
   1. protection of sensitive data;
   2. vulnerability assessment and risk management;
   3. enforcement of legal, regulatory, contractual, and architectural compliance requirements;
   4. stakeholder identification with defined roles and responsibilities;
   5. access management; and
   6. data inventory, classification and definition
4. Data Governance Committee: A university board (RPM 2.30) established by the president consisting of the university’s Data Trustees and other senior administrative officials assigned the responsibility to modify, formalize, and implement the university’s Data Governance Program in accordance with regents policies, applicable laws and regulations and this rule.
5. Data Steward: An employee, typically a supervisor, designated by the relevant Data Trustee to oversee access and management of a particular subset of Institutional Data.
6. Data Trustee: A senior administrator with significant responsibility for a major operational area, who utilizes systems and applications serving as authoritative sources of Data. (See Appendix ARP 15.40 – A for list of major operational areas).
7. Data User: NMSU employees or agents whose job duties require access to Institutional Data.
8. Institutional Data/Data: Institutional Data (or “Data”) refers to the university’s information resources and administrative records in any form, including but not limited to print, electronic, or audio-visual. Examples include:
   1. Data created, acquired and/or maintained by university employees through official job duties;
   2. Data created or updated via use of a university computer system;
   3. Data relevant to research, planning, managing, operating, or auditing;
   4. Data included in official university administrative reports and records;
   5. Data within the university’s purview, including records that the university may not own but that are governed by laws and regulations to which the university is held accountable; and
   6. Data that pertains to, or supports, the administration and mission of the university.

PART 3: ROLES, RESPONSIBILITIES AND ACCOUNTABILITY

The Data Governance Committee and other data officials listed below are collectively and individually responsible for implementing the NMSU Data Governance Program.

1. Data Governance Committee: The Data Governance Committee develops and implements the Data Governance Program for the NMSU system, including the development of data governance policies and rules, as well as general oversight for publication of Data Governance standards and other standards of operation (SOPs) applicable primarily to the work of the Data Stewards and Data Users. The Data Governance Committee may establish subcommittees or assign related tasks to university units or employees.
2. Data Trustee: Responsibilities of Data Trustees include:
   1. Serve on Data Governance Committee.
   2. Ensure access to and safeguard security, integrity and usefulness of their respective areas’ Institutional Data
   3. Identify the sensitivity and criticality of the Data.
   4. Ensure appropriate processes are in place to keep Data secure, maximize Data accuracy, and ensure responsible staff are trained regarding the Data Governance Program requirements.
   5. Oversee planning and governance to meet data needs of the institution and support Data- driven decision making. Work closely with members of the Data Trustee Council and members of the senior administration to ensure appropriate resources (staff, technical infrastructure, etc.) are dedicated to prioritizing Data needs and enforcing SOPs related to Data management and use.
   6. Implement Data Governance rules, as well as the standards and associated SOPs approved by the Data Governance Committee, for compliance with applicable laws and regulations.
   7. Serve as liaison to the president and/or Chancellor – NMSU System Community College for Data Governance issues.
   8. Designate and supervise Data Stewards within the Data Trustee’s major operational area.
3. Data Steward: Responsibilities of Data Stewards include:
   1. Establish Standard Operations. Subject to review by the Data Trustees, Data Stewards establish, publish at https://inside.nmsu.edu/datagovernance/, and implement Data Governance standards and associated SOP’s.
   2. Train Staff. Ensure that staff who maintain Data are trained to follow the Data Governance standards and SOP’s.
   3. Maintain Data quality. Work with technical and operational staff to create a process to identify data entry errors and correct the Data and data entry processes to meet Data Governance standards. Report to the Data Trustee any issues that may require modifications or enhancements of Data Governance structures or standards.
   4. Control and Facilitate Access to Data. Develop appropriate SOPs to control and facilitate access to Data by authorized users to serve the Data needs of the institution.
   5. Respond to Inquiries about Data. Receive and respond to any inquiries related to Data they oversee.
   6. Monitor System Account Access. Conduct and document regular system account access reviews to Data and systems to meet audit and other requirements.
4. Data Custodian: Responsibilities of Data Custodians include:
   1. Provide a secure infrastructure in support of the Data. This includes, but is not limited to, physical security, network security, system security, system logging, and secure transmission of the Data.
   2. Grant, modify, revoke and document authorization for, system access to Data Users based on established policies and rules, Data Governance standards and associated SOPs relating to access.
   3. Assist with implementation of university policies and rules, as well as Data Governance standards and associated SOPs relating to Data access.
   4. Ensure system availability and adequate response time. Monitor system availability, backup system Data and develop disaster recovery plans; install, configure, patch, and upgrade hardware and software used for Data management; make sure systems are maintained in accordance with policies and/or service level agreements.
   5. Participate in setting Data Governance priorities. Provide details on technical, systems, and staffing requirements related to Data Governance initiatives.
5. Data User: Responsibilities of Data Users include:
   1. Attend training and follow university policies and rules, standards and associated SOPs related to Data management and protection, including those relating to the security, integrity, quality, consistency, handling, and dissemination of Data.
   2. Identify areas of need relating to Data management and protection.
   3. Report concerns related to Data management and protection to the appropriate NMSU administrator, including any observations or concerns about weaknesses in Data protection; failure to follow Data management policies; or specific issues of quality or integrity of NMSU data.

PART 4: NMSU DATA GOVERNANCE STANDARDS

The Data Governance Committee will work collaboratively with university officials, including the Chief Privacy Officer, Chief Information Security Officer, and Chief Information Officer to ensure the establishment of uniform university Data Governance rules, standards and associated SOPs, including, but not limited to:

1. Data Inventory
2. Data Classification;
3. Data Safeguards;
4. Data Sharing and Usage;
5. Data Dictionary and Definitions;
6. Data Entry and Reporting
7. Identity and Access Management;
8. Data Security; and
9. Data Privacy and Regulatory Compliance.

PART 5: DATA GOVERNANCE TRAINING

1. NMSU will train its employees on the NMSU system’s Data Governance Program, including all policies and rules, as well as the Data Governance standards and SOPs that apply within their major operational area. Each Data Trustee is responsible to ensure that each new hire, incumbent employee, or other person granted access to Institutional Data within their major operational area receive the appropriate training in a timely manner. After initial training, updates will be provided on a periodic or as needed basis.
2. To ensure compliance with the data privacy regulatory training requirements, some NMSU employees will be required to participate in data privacy compliance training, which may be offered pursuant to Rule 3.19.25 – Mandatory Employee Training and Other Professional Development Opportunities.
3. Official training logs and certificates will be maintained in the institutional training system maintained by Human Resource Services’ Center for Training and Professional Development.