1-A. Purpose of IT Security Review:

Confirm Organizational Mission & Overall-Role of IT
Convene a Security Oversight and Planning Team
(See “Eight Questions A Superintendent Should Ask the CTO”)

• Team includes Administrators, Teachers, Technical Staff, and other stakeholders
• Objective: lay foundation for maintaining user support and keep security planning focused and useful

1-B. Scope of Inquiry:
Set Boundaries and Budgets

• Agree on which IT tools, data, and services will be reviewed
• Set a schedule
• Agree on an initial budget

1-C. Values to Guide Decision-Making:
Internal Expectations, External Requirements, National Guidelines

• Clarify user expectations for IT performance.
• Identify legal and regulatory requirements.
• Agree on criteria for judging importance of IT assets and how to prioritize discovered security risks. Reconcile conflicts between security goals and other objectives.