What We Do

Collaborate with various committees across Barry University, such as the Faculty Senate, Clinical Research Electronic Data Committee, HIPAA Steering Committee, Health Information Integrity Committee, Information Technology Leadership Council, Compliance and Risk Managers Council, PCI Steering Committee, and the Academic Computing Advisory Committee. Publish an annual Strategic Security Plan, guiding strategic planning and budgeting based on risk assessments. 

Conduct security reviews and risk assessments for IT-related purchases, projects, vendors, and contracts, coordinating with the procurement process. This includes HIPAA/MU risk assessments and year-end financial audits, producing an annual security assurance audit plan to evaluate controls and procedures protecting critical IT systems and assets. 

Ensure adherence to FERPA, GLBA, PCI-DSS, FISMA, HIPAA, and Red Flag regulations. Collaborate with departments to develop system security plans and monitor compliance with policies and procedures. 

Work with stakeholders to define, document, publish, and raise awareness of Barry University's IT policies, procedures, and work practices. Manage policy exceptions, verify compliance, and adhere to update cycles and approval workflows. 

Deliver targeted information security knowledge to raise awareness of risks and influence behavior. Methods include computer-based learning modules, CISO messages, IT newsletter articles, departmental and one-on-one in-service training, webinars, and videos. 

Ensure a secure IAM program, recognizing it as critical for preventing unauthorized access and safeguarding Barry University’s data and information assets. Manage user identity data and authentication systems, govern exception processes, and prioritize identity-related projects. The CISO represents Barry University in external identity management initiatives. 

Identify, assess, and track the resolution of security weaknesses through regular vulnerability scanning, penetration testing, SIEM log analysis, risk assessments, and targeted IT security assurance audits. We are responsible for remediating identified vulnerabilities.

Implement continuous monitoring through SIEM log analysis, vulnerability scanning, and penetration testing to detect and assess potential security threats and weaknesses promptly.

Oversee the incident response program, coordinating from incident declaration through resolution and post-incident review. Identifiy incident handlers, coordinates necessary resources, guides best practice responses, and conduct post-incident reviews to identify root causes, evaluate response quality, and determine remedial actions. Coordinate incident response training to develop appropriate skills across the university.

Ensure all BC/DR plans are documented and periodically tested. Monitor and remediate any failures during tests and regularly updates the Business Impact Analysis report. In actual incidents, execution of BC/DR plans is the responsibility of respective operating units within the university. Ensure these plans are aligned with recovery point objective (RPO) and recovery time objective (RTO) for critical applications and services.