TL;DR — Key Takeaways
- The ITSC is CMC's cross-campus governance body for reviewing technology through a security, privacy, and accessibility lens — from purchase and renewal through retirement.
- Its work covers four areas: procurement and renewal review, business cases for new systems and solutions, data classification review, and governance of platforms and procedures.
- The committee meets monthly on a regular cadence, at a standing time to be determined by the committee. Membership is being finalized.
Purpose & Role
The IT Steering Committee (ITSC) is CMC's primary governance body for the security, privacy, and accessibility of the technology the College buys and operates. Established to ensure that ITS decisions reflect the needs and priorities of the entire campus community, the ITSC bridges the gap between technology operations and institutional leadership.
Every item that comes before the committee is examined through the same lens: what data does this system hold, who can reach it, what obligations does it create, and can everyone at CMC actually use it. That applies to a new platform, a routine contract renewal, a change in how existing data is classified, and the procedures that govern the platforms already in place.
"Governing technology through a security, privacy, and accessibility lens is not a bureaucratic exercise — it is how the campus community protects what it has built together." — Carlos De La Rosa, CIO & ITSC Chair
Membership
The ITSC draws its membership from across the CMC community so that security, privacy, and accessibility decisions are informed by the people they affect. The specific seats and representatives are being finalized.
Membership roster
The committee roster is being confirmed with campus leadership and will be published here once appointments are complete. In the meantime, questions about representation for your area can go to the CIO.
Responsibilities
The committee's responsibilities all sit within one frame: protecting CMC's data, the privacy of the people it describes, and the ability of every member of the community to use the tools the College provides. Its work is organized into four areas.
Procurement & Renewal Review
- Review proposed technology purchases before the College commits, covering vendor security posture (HECVAT or equivalent), contractual data-handling and privacy terms, and accessibility conformance claims (VPAT or ACR)
- Review contract renewals against current standards rather than carrying forward the assumptions in place when the platform was first bought
- Confirm that any security, privacy, or accessibility gaps identified in review carry a documented remediation commitment or an approved exception
Business Cases for New Systems & Solutions
- Evaluate business cases for new systems and solutions with regard to security, privacy, and accessibility — not as a final gate, but early enough to shape the proposal
- Establish what institutional data the system would hold, who would have access to it, and where that data would live
- Identify duplication with platforms CMC already governs, since every additional system widens the surface that has to be secured and supported
- Determine what must be true at launch, including accessibility remediation and privacy notices, versus what can follow on a committed timeline
Data Classification Review
- Review data classification assignments for institutional systems against the College's Data Classification Standard
- Advise on ambiguous or contested classifications, and on new or changed data flows between systems
- Review requests to store, process, or transmit restricted data in a platform not previously approved for it
Platform & Procedure Governance
- Govern additions, retirements, and material changes to major enterprise platforms, including what happens to the data a retired system leaves behind
- Review the procedures that surround those platforms — access provisioning and deprovisioning, administrative rights, exception requests, and vendor integrations
- Review ITS's annual security posture report and risk assessment findings, and advise on the priorities they surface
- Advise on disaster recovery and business continuity planning for the platforms the campus depends on
- Provide community feedback on proposed changes to security, privacy, and accessibility policy
Meetings
The ITSC meets monthly on a regular cadence, so that procurement reviews, business cases, and classification questions are never waiting long for a decision.
Monthly Meetings — Time To Be Determined
The committee convenes once a month. The standing day and time will be set by the committee itself at its first meeting, and published here once confirmed. Meetings follow a standard agenda: security, privacy, and accessibility updates from the CIO; procurement and renewal items awaiting review; business cases for new systems and solutions; data classification questions; and open discussion. Meeting notes are distributed to all members within five business days.
Between monthly meetings, the CIO communicates significant developments to the full committee via email and may convene ad-hoc sessions for time-sensitive decisions — a security incident with governance implications, or a procurement deadline that cannot wait for the next cycle. Standing sub-committees may be formed to address specific topics such as AI governance, data classification, or accessibility compliance.
Strategic Alignment
The ITSC plays a critical role in ensuring ITS strategy remains connected to CMC's institutional direction at the highest levels. The committee serves as the formal bridge between ITS operations and the President's vision for CMC's future, as well as the Board of Trustees' expectations for technology stewardship.
On an annual basis, the CIO presents a technology strategy review to the Board of Trustees informed by the ITSC's collective guidance. This gives the board documented assurance that the College's technology is procured, classified, and governed against consistent security, privacy, and accessibility standards, and that ITS priorities reflect the community's needs.
For more on ITS strategic direction, see the ITS Strategic Vision document.