Kean University – Enterprise Risk Management
Table of Contents
- 1. About
- 2. Scope
- 3. Authority & Governance
- 4. Definitions
- 5. Policy Statements
- 6. Roles & Responsibilities
- 7. Compliance Mapping
- 8. Enforcement
- 9. Exceptions
- 10. Related Documents
- 11. Review & Maintenance
- 12. Version History
1. About
The Enterprise Risk Management (ERM) Policy establishes Kean University’s institution‑wide methodology for identifying, assessing, treating, monitoring, and reporting risks across academic, administrative, financial, operational, digital, cybersecurity, research, and compliance domains.
This Policy aligns with the university’s policy hierarchy. Where conflicts exist, the most stringent requirement supersedes this Policy.
2. Scope
This Policy applies to all Kean University personnel—including faculty, staff, researchers, student workers, vendors, and contractors—and governs all risk domains, systems, data, and modalities across on‑premises, cloud, hybrid, and third‑party environments.
3. Authority & Governance
Authority flows from the President to the CIO and CISO through Kean IT, under Board and Presidential delegations. Oversight is exercised through the Risk Management Committee (RMC), Executive Leadership Team (ELT), and the Board of Trustees.
4. Definitions
Definitions include Asset, Control, Data Classification, Digital Risk, Enterprise Risk Management, Impact, Likelihood, Residual Risk, Risk Appetite, Risk Tolerance, Risk Register, and Third‑Party Risk. All terms follow the Kean Cybersecurity Glossary unless otherwise specified.
5. Policy Statements
5.1 Risk Lifecycle (KU SEC 02.1)
Kean University maintains a standardized lifecycle that includes risk identification, assessment, response selection, monitoring, and reporting.
5.2 Centralized Risk Register (KU SEC 02.2)
A single authoritative University‑wide Risk Register shall be maintained with required fields including risk ID, category, scoring, owner, treatment strategy, due dates, and status.
5.3 Strategic Integration (KU SEC 02.3)
Risk evaluations must be incorporated into budgeting cycles, strategic planning, procurement, and project approvals.
5.4 Training (KU SEC 02.4)
Annual risk training is required for all responsible personnel and reinforced through onboarding and refresher communications.
5.5 Documentation & Recordkeeping (KU SEC 02.5)
Risk assessments, evidence, escalations, and decisions must be retained for at least seven years and stored in approved repositories.
6. Roles & Responsibilities
Expand Roles & Responsibilities
Board of Trustees
Approves major risk decisions and holds ultimate governance authority.
President
Maintains executive accountability for risk management across the institution.
Chief Risk Officer (CRO)
Owns the ERM program, chairs the RMC, and ensures compliance with risk practices.
Chief Information Officer (CIO)
Ensures alignment of digital and technology‑related risks with university strategy.
Chief Information Security Officer (CISO)
Oversees cybersecurity and supplier‑related risks and ensures alignment with the Information Security Program.
Risk Management Committee (RMC)
Provides oversight, prioritizes risks, reviews thresholds, and escalates systemic risks.
Internal Audit
Offers independent assurance on processes and validates accuracy of the Risk Register.
Compliance / GRC
Ensures alignment with regulatory and legal obligations.
Risk Owners
Identify, assess, mitigate, and maintain accurate risk register entries.
All Staff
Maintain risk awareness and report potential risks proactively.
7. Compliance Mapping
NIST CSF 2.0 Alignment
This Policy aligns to governance and risk management elements of NIST CSF 2.0, including governance, risk assessment, and risk treatment categories.
Regulatory Mapping
This Policy supports compliance obligations across FERPA, HIPAA, GLBA, state regulations, and grant or research requirements.
8. Enforcement
Noncompliance may result in remediation directives, access restrictions, HR disciplinary actions, student conduct actions, vendor enforcement steps, or required regulatory reporting. Significant violations escalate to senior leadership bodies.
9. Exceptions
Exceptions must follow KU SEC 05: Exception Management Policy and require a formal request, risk assessment, compensating controls, limited duration, and appropriate approvals.
10. Related Documents
- RC01: Regulatory Compliance Policy
- KU SEC 10: Policy Precedence & Governance Policy
- KU SEC 01: Information Security Policy
- KU SEC 05: Exception Management Policy
- Data Governance & Classification Policy
- Cybersecurity Incident Response Plan (CSIRP)
- Supplier Risk Management Policy
11. Review & Maintenance
This Policy must be reviewed annually, following major regulatory or technological changes, or after significant incidents. Updates require CRO and CISO initiation and approval by the RMC and University Policy Committee.
12. Version History
Version 1.0 — Effective 02/13/2026 — Initial Release.