University of Oregon Policy Library

1. Recognition of a Foundation

1.1.The University of Oregon (University) president (President) may award recognition as an institution foundation (Foundation) to an entity that meets and maintains the requirements of these rules.

1.2. Only one entity may have recognition as the Foundation. All private support of the institution not provided directly to the University shall be through the Foundation, or affiliated or associated organizations.

1.3. To be eligible for recognition and to maintain continued recognition, the Foundation must:

a. Be created and operated with the primary purpose of support of the University;

b.Have as its purpose the solicitation, management and/or investment of private support for the benefit of the University; and

c. Be organized and operated in a manner to permit compliance with this policy.

1.4. An entity seeking recognition as the Foundation shall submit to the president for review its:

a. Articles of incorporation;

b.Bylaws;

c. Any other of its organic or enabling documents; and

d.All subsequent amendments.

1.5. The President shall notify the governing body of the Foundation in writing of recognition and that compliance with these rules is a condition of continued recognition.

2. Privileges and Responsibilities of Recognition

2.1.Privileges of recognition by the President may include:

a. License to use the institution name, logos, informal seals, symbols and marks; and

b. Other privileges and responsibilities as agreed upon in a Memorandum of Agreement.

2.2. No individual, group or entity not awarded recognition under this policy shall use any of the privileges described in this policy or otherwise make use of the University name except as expressly approved by the University by license or contract.

2.3. The Foundation's governing body promptly shall provide to the President a resolution of acceptance of the condition expressed in this policy and such resolution of acceptance, in the form of a Memorandum of Agreement, shall be reaffirmed annually.

3. University Foundation Organization, Affiliates, Relationships

3.1. The Foundation shall be organized and operated pursuant to the Oregon nonprofit corporation law.

3.2.The Foundation shall obtain and maintain status as a tax-exempt entity pursuant to Section 501(C)(3) of the federal Internal Revenue Code and other similar Oregon statutes.

3.3. The Foundation's articles of incorporation or other governing documents shall require that, upon its dissolution or withdrawal of recognition, the Foundation's net assets shall, within the limitations imposed by legal and fiduciary rights and responsibilities, be distributed to the University that awarded recognition, or another entity that has been awarded recognition by the University.

3.4. The Foundation may include as part of its organization one or more affiliates that support a particular unit or activity of the University but that are not separately incorporated.

a. An affiliate may have an advisory board that reports to and is advisory to the Foundation governing body. University employees may serve on an affiliate's advisory board so long as they do not comprise a majority of the advisory board membership nor a majority of any quorum of such body. University employees may provide staff support for an advisory board.

b.The Foundation shall not delegate to an advisory board of an affiliate its authority to hire personnel or to enter into contracts.

c. A member of each advisory board of an affiliate should serve on the Foundation governing body whenever possible.

d. No entity shall become an affiliate of the Foundation until the affiliation is approved in writing by the President.

3.5. The Foundation may establish or associate with another entity interested in the University, provided:

a. The President in writing approves of such relationship prior to any operations;

b. Such relationship does not impair or circumvent the requirements for Foundation independence; and

c. All for-profit activities are approved by the President.

4.Foundation Independence from the University

4.1. The Foundation shall be independent of the University.

4.2. To assure independence, the Foundation's governing body, employees, and agents:

a. Shall not be subject to control by the University or a University employee;

b. Shall not give the appearance that the University or any of its officers or employees control the Foundation or its property, including investment of gifts and endowments made to the Foundation.

c. No University employee may be a voting member of a governing body of the Foundation.

5.President's Responsibilities, Additional Rules

5.1. The President or designee shall be, and other University employees may be, ex officio, nonvoting members of the Foundation's governing body and of any executive or similar committee empowered to act for the governing body.

5.2.The President shall monitor Foundation activities and Foundation relationships to ensure compliance with this policy.

5.3. The President may establish additional written policies and guidelines applicable to the Foundation consistent with this policy.

6. Foundation and University Operational Procedures

6.1. A University employee may encourage gifts to the institution directly as well as through the Foundation.

6.2. In accepting gifts of any kinds, the Foundation shall:

a.Obtain University approval of any restrictive terms and conditions, and advise donors that a restricted gift for the benefit of the University may not be accepted without University approval; and

b. Coordinate with the University’s development office or other appropriate University officer regarding funding goals, programs or campaigns proposed by the University.

6.3. The Foundation shall report gifts to the Foundation and to the University as a result of Foundation activities. Such reports shall be made annually to the president.

6.4. Revenue received from a University activity, other than through normal development activities, shall not be deposited in a Foundation account.

6.5.The University and the Foundation shall develop and implement guidelines regarding the identification of funds so that the intended donee, whether University or Foundation, actually receives the funds, subject to the following:

a. If the Foundation is the intended recipient of funds made payable to the University, the funds shall first be deposited in a state account and then transferred to the Foundation.

b. Funds payable or gifts made to the University shall not be transferred to the Foundation unless accompanying documents demonstrate that the Foundation is the intended recipient.

c.If the Foundation deposits funds in its accounts or receives other gifts intended for the University, the Foundation shall transfer those funds or gifts to the University.

6.6.Salaries, consulting fees, loans, perquisites or other benefits provided to or on behalf of a University employee, other than a student employee, by the Foundation shall be:

a. Approved by the Board of Trustees when paid to the President or other employee appointed directly by the Board of Trustees.

b. Approved by the President in writing.

c.Paid by the Foundation to the University, which in turn will make payments to the employee in accordance with normal University practice.

d. This subsection is not applicable to reimbursements for actual and necessary travel and other expenses incurred for authorized University or Foundation purposes that are reported by the Foundation to the President annually.

6.7. University Contract with Foundation:

a. The University may provide pursuant to a written contract limited and reasonable support to the Foundation, including but not limited to the cost of utilities and janitorial services and all or part of the salary and related personnel costs of staff support, from funds otherwise available to the University. As used in this policy, staff support is assistance by any personnel whose responsibilities and activities exclude policy making and other functions that would nullify the independence of the Foundation from the University.

b.The University shall contract with the Foundation regarding the terms and conditions for support and may contract for other purposes consistent with this policy. Any such contract and amendments thereto shall:

A.Accurately and fully describe the extent of such use and support and the consideration therefor;

B. Be approved by the President or their respective designees.

C. Funds received by the University because of a contract with the Foundation shall be placed in a current restricted account that is not a depository for donated or gift money.

7.Foundation Activities

7.1. Financial and other activities of the Foundation shall be administered and reported in accordance with law, prudent business practices and generally accepted accounting principles.

7.2. Audits and Financial Reports of the Foundation:

a. The Foundation shall be audited annually by a certified public accountant. The audit report shall be provided promptly to the President. The audit report shall be accompanied by a current list of Foundation officers, directors, trustees, managers and legal counsel and the officers of any group or entity described in Section 3.4 and 3.5 of this policy.

b. The Foundation shall permit the President, using University internal auditors, to inspect and audit all Foundation books and records at reasonable times. The Foundation shall provide such reports of and information on its financial status and operations as required by the President in order to assure conformance by the University and the Foundation with this policy.

8. Revocation of Recognition

8.1. The President may revoke recognition as provided therein, if the President finds that a Foundation or its operation conflict with this policy or the mission of the institution.

8.2. Prior to ordering revocation of recognition, the President shall notify the Foundation's governing body of the reasons that could form the bases for revocation of recognition. Within 30 days of receipt of the President's notification, the Foundation may in writing propose actions to remedy the deficiencies described by the President.

8.3. If the President approves the proposed actions, the Foundation's governing body shall implement the proposals within a time specified by the President.

8.4.If the President rejects the Foundation's proposed actions or finds that they are not adequately implemented, the President may revoke recognition by a written order to the Foundation's governing body specifying the reasons for revocation.

8.5.An order revoking recognition may be appealed to the Board of Trustees if filed with the University Secretary within 30 days of the date the President issues the order revoking recognition. The Board of Trustees shall review the President's decision but shall not reverse that decision unless the Board finds the President acted arbitrarily or capriciously.

8.6. An order revoking recognition shall terminate the Memorandum of Agreement and the privileges of recognition.

Download Policy

This policy grants authority to the University of Oregon Information Security Office, a unit within Information Services, to implement an Information Security Program to mitigate risk regarding information security. Responsibilities of the Information Security Program include, but are not limited to:

• Develop policies, procedures, and guidelines for securing University systems, networks, and data based on applicable laws, regulations, and best practices
• Consult with campus users and departments to investigate information security issues, perform risk assessments, and propose products and processes to mitigate risk discovered
• Monitor the University networks to identify malicious activity
• Provide incident response for information security incidents
• Increase campus awareness of information security through training and communication
• Use frameworks to ensure that information security is built into current and new systems. Identify risks to the security of information, systems, and users in order to mitigate these risks to levels acceptable by University Administration.

The University of Oregon Information Security Office will have information security responsibilities over all University data, computers, and networks. Each member of the University community has a role in protecting the security of information including faculty, staff, students, vendors, and contractors. The University of Oregon Information Security Office will implement an Information Security Program to mitigate risk regarding information security. There will be a number of duties performed by the University of Oregon Information Security Office to carry out the responsibilities of the Information Security Program. The Program will include, but is not limited to, the following activities:

1. Development of Policies, Procedures, and Guidelines

The University of Oregon Information Security Office will draft policies, procedures, and guidelines related to information security. These may be overarching policies such as data classification polices or specific technical guidelines such as how to encrypt hard drives. The policies, procedures, and guidelines will be developed in conjunction with Campus IT Leadership to ensure that they will be effective in mitigating risk in the many diverse Campus units. Additional identified groups will also be included in the review to gather input. The policies, procedures, and guidelines will be developed based on state and federal laws and regulations by which the University is bound as well as best practices in the information security community. Changes in policy will be reviewed by the Policy Advisory Council. Changes in procedures will be reviewed by Campus IT Leadership.

2. Perform Risk Assessments

The University of Oregon Information Security Office will perform risk assessments of central systems to determine gaps where additional security controls are needed. If gaps are discovered, recommendations will be made to mitigate potential risk. The University of Oregon Information Security Office will also work with Campus units who request a risk assessment of their systems. Occasional Campus-wide security assessments will be performed in conjunction with Campus IT Leadership.

3. Operate Security Systems

The University of Oregon Information Security Office will operate systems that monitor the security of UO computers and networks. Examples of these types of systems include the campus-provided antivirus solution and our malware detection system

4. Perform Network Monitoring

The University of Oregon Information Security Office will monitor the University networks for malicious activity. These can include, but are not limited to, the presence of viruses and malware, users transmitting or receiving larger than normal amounts of data, violations of the Acceptable Use Policy , systems being used to relay spam, and internal or external individuals attempting to break into University systems. The University of Oregon Information Security Office will use these network monitoring capabilities to notify individuals and University units of systems where problems are detected. By default the Information Security Office will not investigate monitored data at the level of an individual user, but will investigate at the individual level when an appropriate triggering event occurs on its Security Systems (such as the antivirus system). Authorized investigators include Information Security Office staff and also IT Professionals in the units where an event is triggered."

5. Data Retention Limits

Data (construed to include all personally-identifiable information in addition to other forms of retained data) from security systems and network monitoring systems will be maintained for a maximum of one year unless otherwise required by law. The need for data retention up to this maximum limit will be reviewed on a periodic basis to determine if data can be retained for a shorter period of time. Any retention of data beyond the maximum of one year will require a revision to policy per the regular policy press.

6. Lead Security Incident Response

The University of Oregon Information Security Office will provide security incident response in the event of breaches on University systems. This will include forming a Security Incident Response Team, performing forensics to gather relevant data, and providing a report on whether and how the system was compromised, what type of data was resident on the system, and if the data appears to have been viewed or exfiltrated by an unauthorized individual.

7. Provide Security Awareness, Training, and Communication

The University of Oregon Information Security Office will raise the awareness of information security through awareness materials, website presence, and awareness talks at University meetings. The University of Oregon Information Security Office will also provide training for technical and non-technical Faculty, Staff, Students, Vendors, and Contractors on security tools that can be used to mitigate security risk. Finally, the University of Oregon Information Security Office will provide communications to Campus IT Leadership on how to remediate security vulnerabilities when they are discovered.

8. Use Security Frameworks to Provide a Consistent Security Posture

The University of Oregon Information Security Office will use the Framework for Improving Critical Infrastructure Cybersecurity developed by the National Institute of Standards and Technology to address the security posture of the University. By standardizing on one framework the University of Oregon Information Security Office will be able to provide for consistent and repeatable security assessments and recommendations across all University systems, data, and networks.

The University of Oregon is committed to compliance with all applicable state and federal and laws and regulations relating to the compromise of Sensitive Data (as detailed in the University of Oregon Data Classification Policy).

Data Exposure Investigation: In the event that paper or electronic records containing sensitive data are subject to an unauthorized release or access to unauthorized persons, The University of Oregon Data Security Incident Response Procedure must be used to determine whether any sensitive data have in fact been exposed, what specific data were exposed, the impact of the exposure, and what actions are required for legal compliance related to the exposure.

Notification: The decision on notification will be made by the Office of the General Counsel based on applicable Federal and State law.

Security Incident Reports Annual Summary: On an annual basis a summary of Security Incident Reports will be produced by the CISO that will detail the number of Reports issued and how many of the Reports required notification (upon the decision of the Office of the General Counsel). Given the nature of these investigations, these summary reports cannot risk further exposure of sensitive information, and so can be expected to be minimal in their level of detail beyond the two requirements stipulated herein (namely, a summary accounting of the number of Reports issued and how many of the Reports required notification).

Scope of Duty to Report: Any University of Oregon faculty, staff, student, vendor or contractor who has a reasonable cause to believe that sensitive data has been exposed to unauthorized persons must immediately notify the UO Information Security Office. Individuals can either send an email to security@ithelp.uoregon.edu or call (541) 346-5837. Employees who identify themselves and make a good faith report of suspected fraud, waste, or abuse are protected from retaliation, in accordance with Oregon law. UO will maintain confidentiality for employees reporting suspected irregularities, misconduct, safety issues, or other concerns to the extent possible under the law.

Summary

The purpose of this policy is to outline the acceptable approach for classifying university information assets into risk levels to facilitate determination of access authorization and appropriate security control. The requirement to safeguard information assets must be balanced with the need to support the pursuit of university objectives. The value of data as an institutional resource increases through its widespread and appropriate use; its value diminishes through misuse, misinterpretation, or unnecessary restrictions to its access.

Definitions

Data Availability refers to methods for ensuring that required data is always accessible when needed, in accordance with University retention policy.

Data Confidentiality refers to methods for ensuring that access to sensitive data is limited to authorized individuals.

Data Integrity refers to methods for ensuring that data is complete, accurate, consistent, and safeguarded from unauthorized modification.

University Data refers to data owned by or in the custody of the University.

Roles and Responsibilities

Chief Information Security Officer
The Chief Information Security Officer develops policies and procedures to secure University information assets and comply with state, federal, and international laws and regulations applicable to the University of Oregon.

Data Trustee
The Data Trustee for all University Data is the Provost or their designees who have planning, policy-level, and management responsibility for data within their designated functional area(s). Data Trustees’ responsibilities include:

• Assigning and overseeing Data Stewards
• Overseeing the establishment of UO information asset policies.
• Determining statutory, regulatory and other University requirements for UO information assets.
• Promoting data quality and appropriate use.

Data Stewards
Data Stewards are University officials having direct operational-level responsibility for the management of one or more types of data. Data Stewards must be authorized by the appropriate Data Trustee and are generally associate deans, associate vice presidents, directors or above, or research principle investigators within the scope of work of a research project. Data Stewards’ responsibilities include:

• Assigning and overseeing Data Custodians.
• The application of this and related policies and procedures to the systems, data, and other information resources under their care or control.
• Assigning data classification levels in accordance with this policy and associated procedures.
• Collaborating with the CISO in identifying and implementing appropriate administrative and technical safeguards outlined in the UO Minimum Information Security Conrols Standard, for protecting information assets (see Related Resources, below).
• Communicating and providing education on the required safeguards for data to authorized users and Data Custodians.
• Authorizing access, both logical and physical, only to authorized individuals who have a business need – as defined by law and university policies - to access specific data or other information assets.
• Authorizing remote access to information assets to only authorized individuals who have a business need – as defined by law and university policies - to access through a secured system approved by the Chief Information Security Officer.

In cases where multiple Data Stewards collect and maintain the same data elements, the Data Stewards must work together, in collaboration with the CISO, to apply the UO Minimum Information Security Controls.

Data Custodians
Data Custodians are university personnel or designated third-party agents responsible for the operation and management of information systems which collect, manage, process, or provide access to University Data. Data Custodians must be authorized by the appropriate Data Stewards following procedures outlined in the UO Minimum Information Security Controls Standard (see Related Resources, below). Data Custodians’ responsibilities include:

• Applying the UO Minimum Information Security Controls appropriate to the classification level of the data and other information assets in their custody
• Complying with applicable University acceptable use and computer security policies, standards, and procedures.
• Managing Data Consumer access as authorized by appropriate Data Stewards
• Following data handling and protection policies and procedures established by Data Stewards and the CISO.

Data Consumers
Data Consumers are the individual University community members or third-party agents who have been granted access to University Data (wherever it is stored) in order to perform assigned duties or in fulfillment of assigned roles or functions for the University. This access is granted solely for legitimate University purposes. Data Consumers’ responsibilities include:

• Following the policies and procedures established by the appropriate Data Stewards, Data Custodians, and the CISO.
• Complying with University policies and federal, international, and state laws and regulations associated with the University Data and information system use.
• Implementing safeguards for protecting data as prescribed by appropriate Data Stewards and the CISO.
• Reporting any unauthorized access or data misuse to the Information Security Office, the appropriate Data Trustee, Steward, or Custodian, for remediation.

A current list of UO Data Trustees, Data Stewards, and Data Custodians is available in the UO Data Security Classification Table found below in Related Resources.

Data Classification
Data Stewards must classify all University data – digital or printed - into risk levels to provide the basis for understanding and applying the appropriate level of security controls. These classification levels consider the state and federal legal protections, contractual agreements, ethical considerations, or strategic or proprietary worth. Data can also be classified as a result of the application of “prudent stewardship,” where the reason to protect the data is to reduce the possibility of harm to individuals or to the institution.

Data Classification Levels

The classification level assigned to data will guide Data Trustees, Data Stewards, Data Custodians, functional and technical project teams, and any others who may create, obtain, process, transmit or store data, in the security protections and access authorization mechanisms appropriate for that data. Data Stewards must classify University Data as one of the following risk levels:

• Low Risk (or Green)
  Data is classified as Low Risk if the loss of confidentiality, integrity, or availability of the data would have minimal strategic, compliance, operational, financial, or reputational risk to the University. The integrity of Low Risk data is of primary importance and must be protected. The appropriate Data Trustee or Steward must authorize release of Low Risk data. Refer to the UO Data Security Classification Table (see Related Resources, below) for examples of Low Risk data.
• Moderate Risk (or Amber)Data is classified as Moderate Risk if the loss of confidentiality, integrity, or availability of the data would have moderate strategic, compliance, operational, financial, or reputational risk to the University. Integrity and availability of Moderate Risk data are of primary importance and must be protected; privacy and confidentiality should be protected as appropriate. Access to Moderate Risk data must be authorized by the Data Trustee or Steward who is responsible for the data, as needed. Data access authorization may be provided to individuals as part of their job roles or responsibilities. Refer to the Data Security Classification Table (see Related Resources, below) for examples of Moderate Risk data.
• High Risk (or Red)
  Data is classified as High Risk (the most sensitive/critical classification) if the loss of confidentiality, integrity, or availability of the data would have high strategic, compliance, operational, financial, or reputational risk to the University. Privacy, confidentiality, integrity, and availability are important and must be protected. Access to High Risk data must be controlled from creation to destruction, and shall be granted only to those persons affiliated with the University who require such access in order to perform their job, or to those individuals permitted by state or federal law. The confidentiality of data is of primary importance, although the integrity of the data must also be ensured. Access to High Risk data must be requested from, and authorized by, the Data Trustee or Steward who is responsible for the data.

High Risk data includes information protected by law. Note: some data that is not regulated may be classified as High Risk by the Data Trustees or Stewards due to proprietary, ethical, or privacy considerations. Refer to the Data Security Classification Table (see Related Resources, below) for examples of High Risk data.

Classification of Information Systems and Technology Components

Information systems and technology components, including computing and storage devices, mobile devices, network components, and applications, adopt the highest classification of the data that they process, store, or transmit. For example, a system that processes, stores, or transmits High Risk data is classified as a High Risk system; whereas a system that processes Moderate Risk data as the highest data classification level is classified as a Moderate Risk system.

In addition to data-specific risks, information systems components may also affect the safety of the UO community, through interference with operational technology (OT) such as building and industrial automated control systems and automation and supervisory control and data acquisition (SCADA) systems. An information system component is also classified as High, Moderate, or Low Risk if unauthorized access or modification or the loss of availability would have a high, moderate, or low safety risk respectively, to the UO community.

Data Security Requirements for the Classification Levels
The Chief Information Security Officer shall create and maintain security procedures for the various types of data use by the University. These requirements are outlined in the UO In addition, the CISO will create and maintain additional guidelines and procedures for appropriate handling of data including the Minimum Security Procedures for Handling Physical University Data (see Related Resources, below).

Preamble

As provided in ORS 352.025, the Legislative Assembly has found that the State of Oregon will benefit from having public universities with governing boards that provide transparency, public accountability and support for the university and act in the best interests of both the university and the State of Oregon as a whole.

As provided in ORS 352.029, the Board of Trustees manages the affairs of the university by exercising and carrying out all of the powers, rights and duties that are expressly conferred upon the board by law, or that are implied by law or are incident to such powers, rights and duties.

As provided in ORS 352.087, the Board of Trustees may perform any other acts that in the judgment of the Board are required, necessary or appropriate to accomplish the rights and responsibilities granted to the board and the university by law.

As provided in ORS 352.096, the president of the university is the president of the faculty. The president is also the executive and governing officer of the university, except as otherwise provided by statute or action of the governing board. Subject to the supervision of the governing board, the president of the university has authority to direct the affairs of the university.

As provided in ORS 352.146, the president and professors constitute the faculty and as such have the immediate government and discipline of a university with a governing board and the students therein, except as otherwise provided by law or action of the Board of Trustees. The faculty may, subject to the supervision of the Board and ORS 352.089 prescribe the course of study to be pursued in the university and the textbooks used.

Nothing in this Policy affects any collective bargaining agreement entered into prior to the adoption of this Policy.

1.0         Authority of the Board of Trustees; Appointment of the President of the University

1.1         Board Authority. The Board of Trustees is the final University authority and has full control of the University and its property of various kinds. The Board may take any and all Board actions as it determines necessary or appropriate to the extent permitted by law. Board actions have precedence over other policies, standards, directives and other actions of the University and its constituent parts. Any policies, standards, directives and other actions of the University and its constituent parts shall be consistent with Board actions. To the extent permitted by law, the Board may review and intervene in any and all aspects of the University; modify any policy, standard, or directive; amend or rescind any existing policy, standard or directive; and enact and issue such policies, standards and directives as it deems proper for the University. The Board shall adopt a mission statement for the University in consultation with the faculty, students and staff members.

1.2         Appointment of the President of the University.  As provided in ORS 352.096, in consultation with the Governor, or the Governor’s designee, the Board shall appoint and employ a President of the University. Except in the case of an interim or acting president, the hiring committee for the president of the University shall include representatives of the university community and at least one other president of a public university based in Oregon. The President reports exclusively to the Board, and the Board supervises the President. The Board shall prescribe the President’s compensation and terms and conditions of employment and is responsible for the reappointment or removal of the President. The President shall perform such duties as are assigned by the Board. Except as otherwise provided by law or Board action, the President is the executive and governing officer of the University and President of the faculty. The President shall, periodically, report to the Board all significant matters within the President's knowledge related to the affairs of the University.

1.3         University Budget.  The Board shall adopt the budget of the University.

1.4         Tuition and Fees.

1.4.1     The Board shall determine tuition and mandatory enrollment fees in accordance with ORS 352.102, ORS 352.103, ORS 352.105, and other applicable law.

1.4.2     The President determines all other fees, fines and charges, after providing notice to the Board. In arriving at a determination of fees, fines and charges, the President shall consult with employees and students as the President deems appropriate.

1.5         Student Conduct. The Board has the authority to establish written standards of student conduct in consultation with the President, faculty and students.

1.6         Business and Administrative Affairs. The Board retains authority for the following:

1.6.1     The approval of the naming of university buildings or outdoor areas in recognition of individuals or organizations.

1.6.2     The approval of the execution of instruments relating to real property where the anticipated cost or value to the University exceeds $8,500,000. However, a quarterly report to the Board is required for each execution of instruments relating to real property where the anticipated cost or value to the University exceeds $5,000,000 but is less than $8,500,000.

1.6.3     The approval of the appointment of external auditors.

1.6.4     The approval of a capital project budget that is anticipated to exceed $8,500,000, including for architects, construction managers, engineers, and other professional consultants; and approval of any increase to a board-approved capital project budget that causes the total of all increases to the capital project budget to exceed $8,500,000 or fifteen percent (15%) of the approved budget, whichever is greater. However, a quarterly report to the Board is required for each capital project that exceeds $5,000,000 but is less than $8,500,000.

1.6.5     The approval of the execution of instruments relating to any borrowing or debt finance transactions which are or may be in excess of $5,000,000, singularly or in the aggregate.

1.6.6     The approval of the execution of instruments relating to any shares, stock or other equity or interests in or obligations of any entity other than the University in excess of $5,000,000, unless the shares, stock or other equity or interests in or obligations of the entity are publicly traded or provided through the State Treasurer, University of Oregon Foundation or a brokerage firm, investment bank, depository or other licensed firm.

1.6.7     The approval of the execution of any other instruments, including but not limited to instruments related to the acquisition, disposal or provision of goods and services, where the anticipated cost or value to the University exceeds $5,000,000; and approval of any increase or decrease in cost or value that causes the total of all increases or decreases in cost or value to exceed $5,000,000. When the ultimate aggregate cost to the University is not known in advance for instruments relating to the acquisition, disposal or provision of goods or services on a continuing or intermittent basis (e.g. rental, service, or supply contracts), the amounts set forth in this paragraph shall be calculated on an annual basis.

1.6.8     The approval of the execution of any instrument that the President, Treasurer, Chair of the Board of Trustees, or a majority of the Trustees deems appropriate for consideration by the Board or a Board committee, so long as the instrument has not been executed.

1.7         Academic Programs; Degrees; Admissions. 

1.7.1     The Board has the authority to establish, eliminate, control, or substantially reorganize academic programs and units of operation. Any significant change in the University’s academic programs as defined by the Higher Education Coordinating Commission must be approved by the Board prior to submission to the Commission.

1.7.2     The Board confers academic degrees, certificates, and other forms of recognition upon the recommendation of the faculty. Such academic degrees, certificates and other forms of recognition are granted in the name of the Board of Trustees of the University of Oregon and are executed by the Board Chair and the University President. The Board reserves the right to review and approve the granting of any degree, certificate or recognition. The Board shall have the exclusive authority to approve honorary degrees.

1.7.3     Except as provided by Board action, the President of the University has the authority to establish standards, qualifications, policies, and practices relating to admission to study at the University and the curriculum, grading, credits, scholarships, and academic standards of the University. Except as set forth in law or Board action, the faculty (the "president and professors") has the immediate government and discipline of the university and the students therein and the authority to prescribe the course of study to be pursued in the University and the textbooks to be used.  The faculty shall have primary authority over choice of method of instruction; subject matter to be taught; academic standards for admitting students; and standards of student competence in a discipline.

1.8         Gifts.  The Board retains authority for the acceptance of the following gifts to the University:

1.8.1     Gifts that create obligations on the part of the University for which there is no established funding source.

1.8.2     Gifts with a value exceeding $5,000,000 which involve construction of facilities not previously approved, provided that gifts described in this subsection with a value between $1,000,000 and $5,000,000 will be reported to the Board of Trustees quarterly.

1.8.3     A gift requiring naming of a university building or outdoor area.

1.8.4     Any other gift that the President, Treasurer, or a majority of the Board of Trustees deems appropriate for Board consideration.

1.8.5     Gifts of real estate, interests in real estate, or gifts of debt instruments secured by real estate from other than the University of Oregon Foundation. The Treasurer shall determine in each such case, including when the gift is from the University of Oregon Foundation, whether a hazardous waste inquiry or other due diligence is required, and the scope and extent of such inquiry. The President and the Treasurer, in consultation with the Vice President for Advancement, shall establish further policies and procedures regarding evaluation of gifts of real estate, as may be necessary or desirable.

1.9         Gifts to the University of Oregon Foundation and the Alumni Association of the University of Oregon.  Gifts to the University of Oregon Foundation and the Alumni Association of the University of Oregon shall be accepted by the University of Oregon Foundation or Alumni Association of the University of Oregon, as appropriate, in accordance with then-current agreements between the University and the Foundation or the University and Association (as may be amended periodically).

2.0         Policies, Standards and Directives

2.1         Governing Documents. The University shall have the following governing documents:

2.1.1     Bylaws of the University of Oregon, policies, standards, directives and other actions approved by the Board of Trustees or a committee of the Board as appropriate ("Board actions").

2.1.2     Policies, standards and directives approved by the President of the University regarding matters within the authority of the President ("Presidential actions").

2.1.3     A University Constitution as described in this policy by which the President, professors and University constituencies shall exercise their shared governance roles.

2.2         Force of Law; Emergency and Temporary Actions. Board actions shall have the force of law to the extent set forth therein. Emergency and temporary Presidential actions may have the force of law to the extent set forth therein. Any Board action or Presidential action that is intended to have the force of law must include an opportunity for appeal.

2.3         Enforcement. Any Board action or Presidential action may be enforced by the University through internal procedures and in any court of competent jurisdiction. All Board actions and Presidential actions are binding on University employees, students, volunteers, contractors and members of the public, except as set forth therein.

3.0         Authority of the President of the University

3.1         Executive and Governing Officer; Delegation. The President of the University is the executive and governing officer of the University, except as otherwise provided by statute or Board actions. Subject to the supervision of the Board and Board action, the President shall direct the affairs of the University. The authorities and responsibilities of the President of the University include, but are not limited to, the authorities and responsibilities set forth in and modified by section 1.0 and this section 3.0, and the President may delegate any authorities and responsibilities, except as provided by Board actions. Any delegation must be consistent with Board actions. The President remains responsible for the proper functioning of the University, notwithstanding any delegation.

3.2         Policies, Standards and Directives; Consultation. The President of the University shall formulate, prescribe and issue Presidential actions regarding matters within the authority of the President when the Board or the President deems it necessary or appropriate. Any Presidential actions are subordinate to and must be consistent with Board actions. In carrying out these duties, the President shall consult with the faculty, other employees, and students as deemed appropriate by the President. Consultation shall not remove from the President the authority and the responsibility vested in the President by law and Board actions.

3.3         Emergency and Temporary Actions; Technical Corrections. The President of the University shall establish emergency and temporary policies, standards and directives when the Board or the President deems it necessary or appropriate. Such policies, standards and directives may have the scope and force of Board actions and must be reported to the Board expeditiously.

Pursuant to expedited procedures, the President of the University may amend Board actions and Presidential actions in order to correct typographical errors, make address or formatting changes, or clarify language without changing their effect. Such amendments must be reported to the Board quarterly. The President may make expedited repeals of Board actions (upon notice to the Board) and Presidential actions, provided that expedited repeals of Board actions must be ratified at the next Board or Executive Committee meeting.

3.4         Committees, Councils and Advisory Groups. The President of the University shall establish and define the charge of any and all University committees, councils, and advisory groups, except as provided in Board action. The establishment and charge of any and all University committees, councils and advisory groups shall be consistent with law and Board actions.  The recommendations and reports of all committees, councils and advisory groups shall be made to the President. The President shall inform the Executive Committee of the Board regarding significant recommendations and reports related to the affairs of the University. Upon request by the Chair of the Board or a majority of the Trustees, the President shall provide the Board with a recommendation or report of a University committee, council or advisory group.

3.5         Students. Subject to Board action, the President is responsible for development and administration of university policies and procedures governing the role of students and their conduct. In carrying out this responsibility, the President shall take into account the views of students, faculty, and others. The guidelines for student conduct which set forth prohibited conduct and provide for appropriate disciplinary hearings and sanctions for violations of institutional policies and procedures must be consistent with standards of procedural fairness. The Board recognizes and affirms the importance of active student involvement in the deliberative and decision-making processes.

3.6.        University Personnel.

3.6.1     The President of the University shall act for the Board of Trustees regarding all personnel and employment matters, including labor relations and approval of collective bargaining agreements. Subject to Board action, the President has the exclusive authority to and shall establish necessary or appropriate written policies, standards and directives covering all employees not represented by a collective bargaining organization and necessary or appropriate written policies, standards and directives covering employees represented by a collective bargaining organization, subject to any legal obligation to negotiate the terms and conditions of such policies, standards and directives with the exclusive representative of the relevant bargaining unit. Subject to ORS 352.076, upon request by the Chair of the Board or a majority of the Board, the President shall provide the Board with requested information regarding personnel and employment matters, including labor relations and collective bargaining.

3.6.2     In a manner consistent with applicable state law and applicable collective bargaining agreements, the President may appoint any instructional, research, administrative, professional, trade, occupational and other personnel as are necessary or appropriate and establish their compensation and other terms and conditions of employment.

3.6.3     The President may appoint volunteers as necessary or appropriate and establish the terms and conditions of the activities of such appointed volunteers.

3.6.4     Subject to any collective bargaining agreements, the President has the authority to establish written codes of conduct for instructional, research, administrative, professional, trade, occupational and other personnel, including volunteers.

3.7         Research Grants and Contracts. The President of the University shall act for the Board of Trustees regarding grants and contracts for research, development, service, and training. However, a quarterly report to the Board is required for each initial contract or grant award that exceeds $5,000,000, and when any increase or decrease to a contract or grant award causes the total of all increases or decreases to the contract or grant award to exceed $5,000,000.

3.8         Execution and Administration of University Affairs. Except as provided by Board action, the President of the University shall act for the Board regarding the execution and administration of instruments and the affairs of the University.  Notwithstanding the dollar limits specified in section 1.0 above, the President shall act for the Board of Trustees regarding the execution and administration of all instruments, business affairs, and operations relating to:

3.8.1     Acquisition of electricity, natural gas, sewer, water, and all other utility services;

3.8.2     Subcontracts for collaborative research entered into in furtherance of sponsored research programs.

3.8.3     The acquisition of goods and services made by participating in contracts entered into by group purchasing organizations or pursuant to collaborative purchasing initiatives with public or non-profit entities.

3.8.4     The acquisition of fixtures, equipment and furnishings that are included in capital project budgets that have been authorized by the Board of Trustees.

3.8.5     The acquisition of goods and services for sponsored research programs when the source of the goods or services is directed by the sponsor, or the sponsor retains title to the goods acquired.

3.8.6     The settlement of claims or lawsuits brought against the University.

3.8.7     The acquisition of insurance or self-insurance.

3.8.8     Leases and licenses of real property and modifications thereto of up to 20 years.

3.8.9     The acceptance of current gifts of non-traditional investment assets, including but not limited to charitable lead trusts, bargain sale gifts of property, and partial interest gifts.

3.8.10   The acceptance of deferred gift assets.

3.8.11   Real property acquired through gift or devise from the University of Oregon Foundation.

3.8.12   The protection of the University's interests, property, and operations in an emergency.

3.8.13   Actions and execution of documents necessary to establish legal entities, controlled by the University, through which the University may conduct business.

3.8.14   The selection of depositories and investments.

3.8.15   Instruments from the Higher Education Coordinating Commission, including, but not limited to, grant or loan agreements, to convey funds or state appropriation to the University. 

3.8.16   The execution of instruments or the conduct of business affairs where approval by the Board or a Board committee is impractical due to time or other constraints. The President shall submit a report of any actions taken pursuant to this delegation to the Board of Trustees or its Executive Committee on or before the next regularly scheduled meeting.

3.9         Legal Action. The President of the University shall act for the Board of Trustees regarding all legal action necessary or appropriate to protect the interests of the University. However, no litigation shall be instituted against a public entity or official or in exercise of the power of eminent domain without approval by the Board of Trustees.

3.10       Gifts.  Subject to Board action, the President of the University shall act for the Board of Trustees regarding all current and deferred gifts to the University, including gifts to establish quasi-endowed or permanently endowed funds. Notwithstanding any delegation by the President, a gift with unusual terms or conditions affecting an academic program shall be accepted only with the concurrence of the President to the proposed terms or conditions. The proceeds of any gift, devise, bequest, or contribution received by the University shall be administered in accordance with the intention of the donor and any directions of the Board of Trustees in accepting the gift. Wherever possible, the University of Oregon Foundation shall manage gifts. The President of the University is authorized to act for the Board of Trustees regarding the disposition of gifts.

3.11       Fees, Fines and Charges.  Subject to Board action and applicable laws, the President of the University shall establish fees, fines, and charges after providing notice to the Board. In arriving at a determination of fees, fines and charges, the President shall consult with employees and students as the President deems appropriate. The President shall enforce the collection of tuition, mandatory enrollment fees, other fees, fines, charges, and all other amounts due to the University.

3.12       Transparency Practices. As described in ORS 352.076, the President shall conduct ongoing reviews of the practices and policies of the university relating to transparency and access. When conducting the reviews the President shall include faculty, nonfaculty staff and student representatives.

4.0         Authority of the Faculty

4.1         Role of the Faculty. As provided in ORS 352.146, the faculty, which consists of the President and the professors, has:

4.1.1     The immediate government and discipline of the university and the students therein, except as otherwise provided by law or action of the Board.

4.1.2     The authority, subject to the supervision of the Board, to prescribe the course of study to be pursued in the University and the textbooks to be used.

4.2         The President and the Professors. The President and the professors constitute the faculty. The President of the University is the president of the faculty. Shared governance, as a principle in American higher education, is embedded in longstanding practices, and reflects the regard for all stakeholders in the academic endeavors of the University.

4.3         Higher Education Coordinating Commission. Any significant change in the University’s academic programs as defined by the Higher Education Coordinating Commission must be approved by the Board committee responsible for academic affairs prior to submission to the Commission.

4.4         University Constitution. The faculty has adopted a University Constitution which was ratified by the President in 2011. A University Constitution, and any amendments to it, must be consistent with law and Board actions.

4.5         Modification. A University Constitution is subject to modification as set forth therein or by the Board of Trustees in consultation with the President and the professors consistent with applicable law.

5.0         Channel of Authority

The faculty and officers and employees of the University shall, through appropriate channels, be responsible to the President of the University and through the President to the Board of Trustees, except that the Treasurer, General Counsel and Secretary are responsible to the Board in relation to the business of the Board.

That Oregon University System institutions* will:

1. Help all students who borrow federal student loans to understand their rights and responsibilities regarding their student loan borrowing, debt, and repayment throughout the students’ time at the institution;

2. Develop and maintain an early warning system to identify and intervene with students who are most at-risk of incurring higher-than-average student loan debt, and provide a targeted strategy of education and outreach beyond federally mandated Entrance and Exit Counseling. This includes students in one or more of the following categories: considered “low-income” by definition of federal and State of Oregon financial aid criteria; studying in degree fields that typically make lower than average salaries (such as social work, arts); studying in degree fields with higher than average borrowing based on program cost (such as law, medicine, certain healthcare fields) and in which graduates may not earn salaries comparable with debt incurred; and students on academic probation who are at-risk of dropping out before earning a degree.

3. Adopt and use the Federal Financial Aid Shopping Sheet or its successor document, by October 1, 2013, in order to provide clear, transparent information to student loan borrowers about gross and net costs and aid options at the institution, as well as the graduation rate, loan default rate, and median borrowing specific to that institution, and information on loan repayment choices; and provide easy web or other access to and information about net price calculators, and students’ current and cumulative debt incurred to-date through available links to federal databases and other resources.

4. Incorporate financial literacy into new student orientation programs, academic success classes, residence hall programming, and other similar orientation and outreach programs.

5. Provide student loan borrowing and management information on institutions’ respective web sites, providing guidance before, during, and after college on ways to manage and repay student loans.

6. Track and report on an annual basis to the Oregon State Board of Higher Education data that demonstrates the types of debt counseling and management efforts taking place at the university and reports on indicators of progress and of reaching the most at-risk students with effective outreach efforts.

* Includes Eastern Oregon University, Oregon Institute of Technology, Oregon State University, Portland State University, Southern Oregon University, University of Oregon, and Western Oregon University; and branch, satellite and other campus centers of these campuses.

1. Legal Review
   1. The following agreements or documents must be drafted or reviewed by an attorney in the UO’s Office of the General Counsel. The attorneys providing these legal services are reviewing or drafting the following agreements in order to evaluate legal risk and to confirm compliance with applicable federal and state laws, including constitutional provisions, statutes, administrative rules, and UO policies.
      1. Any agreement for the purchase or sale of real property or the purchase or sale of improvements to real property;
      2. Employment agreements or notices of appointments for the President, Vice Presidents, Provost, Vice Provosts, Athletic Director, Head Coaches, or any other employee with an annual salary in excess of $300,000;
      3. Employment agreements with other than tenured faculty for a term of three years or longer;
      4. Any agreement with a value in excess of $250,000:
         1. which includes the development of software or acquisition of software not “off-the-shelf”; or
         2. which includes a foreign entity, public or private, or an Indian tribe as a party; or
         3. under which UO provides services; or
         4. under which UO provides tangible or intangible property or the right to use tangible or intangible property.
      5. Any agreement under which UO takes equity in a company in which UO provides services, tangible or intangible property, or the right to use tangible or intangible property;
      6. Any settlement agreement or release of claims;
      7. Any faculty or student exchange agreement under which UO will pay or receive money or property;
      8. Any docket materials from UO on a matter submitted to the UO Board for action;
      9. Any non-utility easement; and
      10. Any solicitation documents for a competitive procurement that will result in a contract or agreement subject to this Policy.
   2. The legal review required by this Policy may be accomplished, for applicable transactions, by form or template agreements drafted or reviewed by a UO General Counsel attorney and made available to the relevant department or personnel at UO.
   3. In conjunction with the General Counsel’s Office, UO units may develop an internal process in order to exempt categories or sub-categories included in this Policy from legal review or to add categories or sub-categories to the list for legal review, as appropriate. The process should identify how legal risk, notwithstanding an exemption, will be reasonably managed. A category or sub-category may not be exempted or added to the list in Section A(1) until the process document is on file with and approved by the Vice President for Finance and Administration or designee. Once a process document is filed with and approved by the Vice President for Finance and Administration or designee, the exemptions or additions will be added to the list above in Section A(1).
   4. Internal process developed to exempt or add categories or sub-categories to the list in Section A(1) may include “catch-all” provisions to the extent appropriate based on the expertise and personnel in particular UO unit.
   5. Any agreement or document subject to legal review under this Policy must include evidence of such review, such as the attorney’s signature or communication from the attorney attached to the agreement or document. For instances in which a unit is using a form or template agreement as contemplated by Section (A)(2) of this Policy, notation or reference to the form or template drafted by the attorney is sufficient for this section.
   6. Nothing in this Policy removes or alters other requirements for the proper execution of an agreement or document, such as signature by an authorized contracting authority or compliance with procurement rules, policies or procedures, or other UO policies and requirements.
   7. Notwithstanding the list of agreements and documents included in this Policy, employees are encouraged to approach agreements and documents from a risk-conscious perspective and seek out legal review and advice proactively. Nothing in this Policy prevents or should discourage legal review of agreements or documents not included in Section (A)(1)(a)-(j).

2. Review
   1. This Policy may be reviewed annually by the Vice President for Finance and Administration and other relevant stakeholders for amendment or revision, with specific care to consider how risk is managed by the inclusion, or exclusion, of particular categories or sub-categories.