University Information Security Requirements for Systems, Applications, and Data (601.27)

U-M's Information Security policy (SPG 601.27) and the U-M IT security standards apply to all U-M units, faculty, staff, affiliates, and vendors with access to U-M institutional data. Federal or state regulations and contractual agreements may require additional actions that exceed those included in U-M's policies and standards.

Requirements are organized by standard:

• Access, Authentication, and Authorization Management
• Awareness, Training, and Education
• Disaster Recovery Planning and Data Backup for Information Systems and Services
• Electronic Data Disposal and Media Sanitization
• Encryption
• Information Security Risk Management
• Network Security
• Physical Security
• Secure Coding and Application Security
• Security Log Collection, Analysis, and Retention
• Security of Enterprise Application Integration
• Third Party Vendor Security and Compliance
• Vulnerability Management

Ross School of Business – 601.27 Alignment

Below is the measure of Ross IT’s work toward compliance with the 601.27 SPG.  

Each standard that is listed below has a series of security elements that need to be met to maintain and achieve compliance. The score for each standard represents the level of alignment and compliance for that standard.

Last Updated on May 10, 2025