POLICY
.100 POLICY STATEMENT
The policy sets forth policy guidelines for the use of electronic commerce. It applies to all financial transactions performed using an electronic medium which involve use of System facilities, personnel, or other resources.
.110 POLICY RATIONALE
The Oregon State Board of Higher Education (Board) views electronic commerce as a natural extension of the business processes already conducted by the Board and its seven universities (System). The Board encourages System universities to utilize electronic commerce to improve service to its students, faculty, staff and the public, and to reduce the cost of providing these services. For purposes of this policy, electronic commerce includes all business transactions accomplished using an electronic medium. In all endeavors of this type, the System shall protect the assets of the State, the integrity of the data, the financial and confidential information about the customer, and preserve the trust and confidence in using electronic commerce. This requires an appropriate combination of System and institutional management oversight, and includes sound policies, procedures, technologies, and internal controls.
.120 AUTHORITY
.130 APPROVAL AND EFFECTIVE DATE OF POLICY
Approved by the Oregon State Board of Higher Education on 6/16/00, with an effective date of 7/1/00.
.140 KNOWLEDGE OF THIS POLICY
All Chancellor's Office and institutional personnel with electronic commerce-related responsibilities should be knowledgeable of this policy.
.150 DEFINITIONS
Core Application: An activity which is closely integrated with already deployed student information systems, financial information systems, and/or human resources information systems. It is central to the institution's mission and revenue stream, and is directly and substantially related to students. A core application is usually:
- high dollar volume (hundreds/thousands of dollars);
- high transaction frequency (thousands of transactions);
- broad scope (activity is institution-wide);
- high degree of integration with existing systems (uses existing dedicated computing systems).
Examples of core applications would include tuition payments, housing payments, and fee payments.
Electronic Commerce: A broad term used to describe business transactions conducted using an electronic medium.
Electronic Medium: Mechanism for transferring, storing, and manipulating electronic data using facilities and devices such as telephone, lease lines, the Internet, compact disc, magnetic tape, diskettes, and fiber lines.
In-house Application: System owned or licensed software running on System controlled hardware.
Limited Access System: A server with a dedicated purpose allowing access only to individuals with system critical needs.
Peripheral Application: An activity which is not closely integrated with already deployed student information systems, financial information systems, and/or human resources information systems. It is occasional and incidental to the institution's mission and revenue stream. A peripheral application is usually:
- low dollar volume (tens of dollars);
- low transaction frequency (tens of transactions);
- limited scope (activity is unique to a particular department);
- low degree of integration with existing systems (no existing dedicated computing systems).
An example of a peripheral application would be the sale of a technical report by an academic department.
Security/Secure: Authorization and verification of users, assuring integrity of transaction, and encryption (the conversion of data into a proprietary code or accepted open source standard for security purposes.)
.160 RESPONSIBILITIES
A. CHANCELLOR'S OFFICE
The Vice Chancellor for Finance and Administration or designee shall have oversight responsibility for System provisions as set forth in this policy, and for provisions relative to Chancellor's Office electronic commerce activities.
B. INSTITUTION
Each university Vice President for Finance and Administration or designee shall have oversight responsibility on their campus for institutional provisions set forth in this policy.
.170 STANDARDS
The Board affirms the need for consistency across all institutions in certain electronic commerce business activities and also recognizes the need for flexibility in others. In furtherance of these objectives, the Board establishes the following standards:
[1] Each Campus shall develop a privacy statement in accordance with the Federal Family Educational Rights and Privacy Act of 1974 (FFERPA) and complimentary to the DAS privacy statement.
[2] Accounting practices for electronic commerce transactions shall adhere to appropriate accounting standards as established by the Vice Chancellor for Finance and Administration.
[3] Financial information transmitted electronically shall be sent using an appropriate level of security. The security technologies used shall, at a minimum, be consistent with standards established by the Oregon State Treasury and meet or exceed common industry standards.
[4] Credit card authentication shall be performed through a verification service approved by the Oregon State Treasury.
[5] Sensitive data, including social security numbers, credit card numbers, passwords, and any other similar data whose compromise would have a material negative impact, shall be stored in a secure format unless otherwise approved by the institution's Vice President for Finance and Administration or designee.
[6] All transactions shall be uniquely serialized and fully journaled to provide a conclusive audit trail.
[7] All goods and services provided and received shall be routinely reconciled with the accounting records.
[8] All applications shall comply with all current Board and pertinent State of Oregon public procurement statutes, rules, and regulations. Outsourced core applications shall meet the standards specified by the Vice Chancellor for Finance and Administration or designee. Outsourced peripheral applications shall meet the standards specified by the institution's Vice President for Finance and Administration or designee.
[9] In-house applications shall occur on limited access systems rather than on general purpose systems (which may be used for miscellaneous other purposes such as e-mail, web hosting, etc.).
[10] Any non-System advertising connected with electronic commerce shall be approved in accordance with institutional policies.
[11] Electronic commerce systems shall be fully and securely archived.
[12] Any effort to divert electronic commerce revenues or compromise systems associated with electronic commerce activities shall be subject to prosecution under Oregon Revised Statues pertaining to theft, alteration of public records, or other applicable laws.
[13] The System shall periodically review this policy for consistency with DAS policies.
.690 CONTACT INFORMATION
Direct questions about this policy to the following offices:
| Subject |
Contact |
| General questions from institutional personnel |
Institution Office of Business Affairs |
| General questions from institutional central administration and Chancellor's Office personnel |
Chancellor's Office Controller's Division |
.695 HISTORY
10/15/03 - Reformatted
6/16/00 - Approved
Policy Last Updated: 10/15/03
APPENDIX
None.
Appendix Last Updated: 10/15/03