Project: Information Security Investment Plan (ISIP)

Project requirements

The UC cybersecurity mandate requires that all UC Santa Cruz employees, including faculty, staff, and student employees, meet six cybersecurity requirements by May 2025:

1. Cybersecurity awareness training
   • “Ensure cybersecurity awareness training for 100 percent of location employees.”
2. Cyber incident escalation response
   • “Ensure timely cyber escalation of incidents in alignment with UC Incident response and cybersecurity escalation standards.”
3. Computing device identification and management
   • “Ensure identification, tracking and vulnerability management of all computing devices connected to university networks.”
4. Endpoint detection and response (EDR)
   • “Deploy and manage UC-approved endpoint detection and recovery (EDR) software on 100 percent of assets defined by UC EDR deployment standards.”
5. Multi-factor Authentication (MFA)
   • “Deploy, enable, and configure multi-factor authentication (MFA) on 100 percent of campus and health email systems in conformance with established UC MFA configuration standards.”
6. Data Loss Prevention (DLP) for Health Email Systems
   • “Deploy and configure a robust data loss prevention (DLP) solution for all health email systems to mitigate unauthorized data exfiltration.”