Purpose

To ensure accountable operation of HWCOE websites by defining hosting requirements.

Scope

Applies to all websites used to conduct University business created, maintained, or managed within the HWCOE, its departments, centers, institutes, and other organizational units.

Standard

In addition to being compliant with applicable University of Florida information security policies and standards, HWCOE websites must follow these hosting requirements:

1. UFIT service offerings for website hosting must be used whenever possible
2. Unit infrastructure will not be used for website hosting unless:
   1. UFIT service offerings do not provide the required functionality
   2. A UF risk assessment is completed per the UF Integrated Risk Management (IRM) framework
   3. The unit infrastructure is located within an approved HWCOE server room
3. Third-party, external services will not be used for website hosting unless:
   1. UFIT service offerings do not provide the required functionality
   2. A UF risk assessment is completed per the UF Integrated Risk Management (IRM) framework

Responsibilities

1. The College IT Director will coordinate with UFIT regarding features of service offerings needed for website hosting.
2. Unit ISMs, in conjunction with the College ISM, will assist in the evaluation of what qualifies as websites “used to conduct University business.”
3. Unit ISMs, in conjunction with the College ISM, will assist in the evaluation of UFIT service offerings when considering local infrastructure and 3rd party hosting.
4. Unit ISMs will initiate UF risk assessments when required for local infrastructure or 3rd party hosting.
5. Unit ISMs will insure websites within their unit follow this IT administrative procedure.

References

• Appendix: Identifying Websites”used to conduct University business”
• Domain Name Policy – https://it.ufl.edu/it-policies/web-related/domain-name-policy/
• Risk Management Policy – https://it.ufl.edu/it-policies/information-security/risk-management-policy/
• System Security Plans Standard – https://it.ufl.edu/it-policies/information-security/related-standards-and-documents/system-security-plans-standard/

---