University Policies and Procedures Manual (previously Business Policies and Procedures Manual)

UPPM 87.17

For more information contact:
   Information Technology Services

---

1.0    Overview and Purpose

1.1    Information Assurance Policies Generally

The purposes of the information assurance policies in UPPM Chapter 87: Information Technology and Security are to:

• Set requirements to ensure the privacy, confidentiality, integrity, and availability of Washington State University (WSU) data;
• Support institutional goals and strategies with appropriate methods for administratively, technically, and operationally protecting data; and
• Define the criteria WSU follows to meet requirements for protecting data, which are determined by Information Owners.

The policies in this chapter comply with Federal Information Processing Standards (FIPS 199), which are intended to help organizations achieve a common level of quality and interoperability in information technology (IT) by requiring categorization of systems as low-impact, moderate-impact, or high-impact for the stated security objectives of confidentiality, integrity, and availability.

To determine the potential consequence of a loss event, the Federal Information Processing Standards:

• Define WSU Information Owners’ impact categorization rating (Low, Moderate, or High);
• Dictate which security controls are mandatory based upon the categorization level;
• Define the strength, frequency, and formalization of those controls; and
• Influence audit burden and continuous monitoring rigor.

See UPPM 87.01 for definitions, general information, and violations related to this policy, as well as additional information regarding roles and responsibilities.

1.2    Specific Policy Overview and Purpose

Establishing uniform requirements for identifying, assessing, and remediating vulnerabilities within WSU’s information systems helps reduce security risks and protects institutional data. This policy supports WSU’s overall information assurance program by defining expectations for vulnerability scanning, reporting, and coordinated remediation efforts across the University.

2.0    Applicability

This policy applies to all WSU system users who have contact with, or potentially may have contact with, WSU data, applications, and computing resources.

Security control exceptions to policy statements in UPPM Chapter 87 are managed and maintained in accordance with UPPM 87.23.

3.0   Roles and Responsibilities

3.1    Chief Information Officer

The Chief Information Officer (CIO) of WSU, or designee, is responsible for administering this policy and reviewing it on an annual basis.

3.2    Information System Owners

Information System Owners, or their delegates, are responsible and accountable for developing appropriate Standard Operating Procedures (SOPs) for this policy’s implementation. 

3.3    Office of Information Security and Assurance (OISA)

WSU’s Office of Information Security and Assurance (OISA) shall maintain the standard (PDF) associated with this policy and provide guidance for the associated procedures for the implementation of this policy (see examples (PDF)).

Note: While all units are required to adhere to the standard established by OISA (NIST SP 800-53), procedural examples for implementation are optional.

4.0    Requirements

WSU must maintain a vulnerability management system based on Security Content Automation Protocol (SCAP) to identify potential information system weaknesses with a public reporting capability to receive reports of vulnerabilities in WSU system components. 

Primary vulnerability management tools that can readily update their databases with new vulnerabilities are to be operated within WSU so that scans are performed with the latest vulnerability signatures. 

WSU’s vulnerability management system must scan information systems for coding and configuration-based weaknesses. The scan must utilize both the Common Vulnerability Scoring System (CVSS) and Common Configuration Scoring System (CCSS) as a part of the SCAP protocol to report weaknesses identified on information systems.

WSU must scan regulated and confidential network segments as required to identify weaknesses and changes in those systems. If changes are detected, an alert is to be generated and logged in accordance with UPPM 87.50.

WSU must maintain application-specific vulnerability scanners for web and compiled code-based applications, tailored to the respective programming languages. Applications are to be scanned to identify weaknesses and changes in those systems.

WSU must maintain database-specific vulnerability scanners to identify database-specific vulnerabilities in WSU systems. All databases are to be scanned to identify weaknesses and changes in those systems.

Only authorized individuals are permitted to perform vulnerability scans and analyze scan reports. Internal vulnerability scans must be performed in authenticated mode with privileged access to system components.  Service accounts for vulnerability scanning activities are to be created and maintained in accordance with UPPM 87.05.

WSU’s vulnerability management scanners must be secured in accordance with UPPM 87.40.

WSU Information Owners, or their delegates, must be provided with reports to enable visibility into the vulnerabilities identified on the systems that store, transmit, process, or otherwise use information under their care.

Where possible, vulnerability monitoring is to include scanning for patch levels in accordance with UPPM 87.40.

Vulnerabilities are to be remediated in accordance with WSU’s risk tolerance and UPPM 87.25.

WSU must use the results of the vulnerability scans to determine WSU’s remediation efforts and understand the risk in accordance with UPPM 87.25.

Non-remediated critical vulnerabilities must be immediately reported to the OISA.

5.0     Training

See UPPM 87.21 for training requirements related to UPPM Chapter 87.

In addition to the requirements in UPPM 87.21, Information System Owners are responsible for ensuring that users receive appropriate information security and privacy training commensurate with their roles, responsibilities, and authorized access to information systems under the Information System Owner’s authority.

_______________________
Revisions:  March 2026 (NEW – Rev. 654).