Regulation on Information Technology Governance, Electronic Records

Management, and Strategic IT Procurement

I. Purpose. This regulation is issued pursuant to Section 1400.1 of the UNC Policy Manual, Information Technology. Its purpose is to establish a comprehensive framework for information technology (IT) governance including Information Security, the lifecycle management of Electronic Records, and the strategic procurement of IT resources at constituent institutions of the University of North Carolina. Strategic and coordinated governance of information technology is essential to the mission of the University of North Carolina. This regulation ensures that IT resources are aligned with institutional strategic objectives, managed effectively, secured appropriately, that Electronic Records are maintained and disposed of in accordance with North Carolina law, and that technology investments are procured efficiently and evaluated transparently.

II. Scope. This regulation applies to all Information Resources, Electronic Records, and information technology procurements created, received, maintained, processed, stored, or transmitted by constituent institutions, regardless of the technology, platform, or medium used.

III. Definitions. The following definitions apply to this regulation:

Cost Allocation. The methodology used to equitably distribute the cost of shared IT resources among participating constituent institutions.

Electronic Records. Records made or received in connection with the transaction of public business that are in electronic form.

Information Resources. All information owned by or entrusted to the University, regardless of its form or location, and the technology infrastructure used to create, store, process, and transmit it.

Information Security. The protection of Information Resources from unauthorized access, use, disclosure, disruption, modification, or destruction to provide confidentiality, integrity, and availability.

Information Technology (IT) Governance. The framework of leadership, structures, and processes that ensure the University's IT sustains and extends its strategies and objectives.

IT Assets. Hardware, software, or infrastructure components purchased, leased, or otherwise procured to support institutional technology operations.

Shared Solutions. IT Assets, services, platforms, or products procured for use by multiple institutions within the UNC System. Shared Solutions may be procured by one entity (e.g. the UNC System or an individual constituent institution) for use by multiple constituent institutions through appropriate written agreements or procured directly with providers through negotiated convenience or similar contracts.

Strategic IT Resources. IT services, platforms, or products designated by the president or designee as critical or high value for Systemwide use.

Total Cost of Ownership (TCO). The comprehensive assessment of all direct and indirect costs associated with acquiring, deploying, maintaining, supporting, and disposing of an IT Asset throughout its lifecycle.

Transitory Data. A record that has little or no documentary or evidential value and that need not be set aside for future use. A transitory record is a record whose information is no longer useful to the end user and holds no administrative, legal, fiscal, or historical value that would necessitate its longer-term retention under the applicable UNC Records Retention and Disposition Schedule.

IV. Information Technology Governance. Each constituent institution shall establish and maintain a formal Information Technology Governance plan, including related policies, pursuant to Section 1400.1 of the UNC Policy Manual. IT program principles shall include, but are not limited to, strategic alignment and investment prioritization, value delivery, resource management, risk management, and performance measurement and auditing. Constituent institutions retain primary decision-making authority for constituent institution-specific technology selection, architecture, and the prioritization of constituent institution IT resources.

V. Establishment of an Information Security Program. Each constituent institution shall develop, implement, and maintain a risk-based Information Security Program designed to protect the confidentiality, integrity, and availability of Information Resources and Electronic Records. Information Security Programs shall align with nationally recognized cybersecurity frameworks such as the National Institute of Standards and Technology (NIST), the Center for Internet Security (CIS), the International Organization for Standardization (ISO), or other comparable standards approved by institutional leadership.

VI. Minimum Institutional Requirements for Electronic Records Management. Each constituent institution shall adopt policies and procedures that address, at a minimum, the following:

Records Classification and Retention. Each constituent institution shall implement a process to classify Electronic Records according to the applicable record series in the UNC Records Retention and Disposition Schedule and to apply the corresponding retention periods. Constituent institutions should use appropriate enterprise systems or repository applications to maintain their Electronic Records. Individual e-mail mailboxes and e-mail archives should not be used as the official or permanent storage location for university records. Constituent institution policies should provide for the automatic permanent deletion of an employee’s e-mail account and all associated back-up or archived e-mails upon a reasonable time following the e-mail being archived or deleted by the end user or an account being deactivated.

Transitory Records Management. Electronic Records in systems or applications designated for short-term or transitory use should not be retained beyond their useful life. If an Electronic Record is created in such a system or application and meets the definition of a record under the applicable UNC Records Retention and Disposition Schedule, the record should be transferred to an approved enterprise system or repository application designated for record retention and long-term preservation. Transitory systems should not be used as the official or permanent storage location for university records. Constituent institution policies should provide for timely automatic permanent disposition of Transitory Data and of Electronic Records.

Disposition. Each constituent institution shall establish a documented process for the secure and timely disposition of Electronic Records that have satisfied their applicable retention period, consistent with the UNC Records Retention and Disposition Schedule and G.S. § 132 et seq.

Integrity and Accessibility. Constituent institutions shall employ reasonable measures to manage Electronic Records in a manner that preserves their integrity, authenticity, and accessibility for the duration of the applicable retention period. When technology or file formats become obsolete while records are within their required retention period, constituent institutions should take reasonable steps to migrate or convert records to ensure continued accessibility.

Security. Constituent institutions shall implement appropriate technical and administrative safeguards to protect Electronic Records from unauthorized access, disclosure, alteration, or destruction, consistent with the constituent institution's Information Security Program established pursuant to this regulation.

Public Records Requests. Each constituent institution shall maintain processes for responding to public records requests in accordance with G.S. § 132 et seq. Constituent institution policies should provide that constituent institutions charge a special service charge if a public records request is such as to require extensive use of information technology resources or extensive clerical or supervisory assistance by personnel, or if producing the record in the medium requested results in a significant use of information technology resources.[1] The special service charge should be charged if more than four personnel hours is required to respond to a request. The constituent institution should charge an hourly fee for each additional hour after the first four hours at a rate of not less than $25.00 per hour. Multiple requests within a short period of time from the same individual or entity may be considered a single request for purposes of determining whether to charge a special service charge. Constituent institutions should require requestors whose request will reasonably result in a special service charge to pay a 50 percent deposit of the estimated charge prior to undertaking any effort to respond to the request. Failure of the requestor to pay the deposit within 30 days should render the request automatically withdrawn and cancelled.

VII. Strategic Procurement and Evaluation of Technology Costs.

Strategic Procurement Process. Section 1400.1 of the UNC Policy Manual provides that the president shall implement an information technology strategic procurement process governing the selection, use, and oversight of designated Strategic IT Resources.

The president, or designee, shall identify Strategic IT Resources that are subject to this regulation, which shall be updated from time-to-time with reasonable notice to the constituent institutions and affiliates. The president, or designee, may procure Strategic IT Resources by and for the UNC System and its constituent institutions and affiliates when the president, or designee, determines that doing so promotes efficiency, cost effectiveness, consistent high-quality services, or otherwise serves the best interests of the University of North Carolina.

Constituent Institutions or affiliates may not procure any Strategic IT Resources without approval from the president or designee.

Constituent institutions shall use vendors, contracts, or products designated as Strategic IT Resources unless granted an exception by the president, or designee, in accordance with paragraph VII.C of this regulation. Costs associated with these Strategic IT Resources may be reasonably allocated to participating constituent institutions and affiliates at the discretion of the president or designee. Cost Allocation methodologies should be documented and shared with the relevant constituent institutions and affiliates.

Constituent institutions may perform supplemental security assessments of Strategic IT Resources to address institution-specific implementation requirements; however, such assessments shall not be used for the purpose of causing delay, avoidance, or otherwise to circumvent the use of Strategic IT Resources procured pursuant to paragraph VII.A of this regulation.

Evaluation of Technology Costs. Pursuant to Section 1400.1 of the UNC Policy Manual and criteria set forth in G.S. §143-135.9, constituent institutions shall evaluate technology investments using TCO analysis as part of any procurement leveraging the IT Request for Proposal authority established in G.S. §143-129.8.

At a minimum, the evaluation shall consider:

The long-term cost of ownership, including acquisition, operation, maintenance, and end-of-life costs.

Any flexibility for innovation over the life of the investment.

Any anticipated resale or salvage value at the end of the target lifecycle.

Constituent institutions shall maintain documented TCO estimates and be prepared to demonstrate how TCO and lifecycle planning were applied in relevant purchasing decisions.

C. Exception Process. Exceptions to Systemwide strategic procurement requirements may be requested from the UNC System Office's chief financial officer and/or chief operating officer and must include a written justification and a proposed alternative.

VIII. Roles and Responsibilities.

Each chancellor shall be responsible for ensuring institutional compliance with this regulation. They may designate a responsible office or individual to develop, implement, and oversee their institution's IT Governance, Information Security, Electronic Records management, and IT strategic procurement programs.

Each constituent institution shall ensure that institutional procurement offices coordinate with designated IT and finance personnel to implement the strategic procurement requirements of this regulation.

Each constituent institution should support training and awareness activities to ensure that personnel understand their obligations under this regulation.

The UNC System Office shall provide strategic oversight, maintain the list of designated Strategic IT Resources, and facilitate shared procurement arrangements in coordination with constituent institutions.

IX. Other Matters.

Effective Date. The requirements of this regulation shall be effective on September 1, 2026.

B. Relation to State Laws. The foregoing regulations as adopted by the president are meant to supplement, and do not purport to supplant or modify, applicable state law or administrative regulations.

Page 1 of 5