DeVry's Cyber Program

DeVry University’s cybersecurity program is driven by appropriate security controls. These controls are present in the following security standards and frameworks:

Upon successful completion of a qualifying cyber security program at DeVry, students will receive a certificate of completion from the Center for Academic Excellence (CAE), signaling that the program has obtained approval and acknowledgement from the National Security Agency (NSA).

In addition to internal assessment of risk conducted periodically throughout the year, the University conducts an independent third-party risk assessment annually. This assessment casts a wide net in terms of the review. Findings from the assessment are rolled into the risk register for tracking, treatment and reporting. The results are reported through the Cyber Risk Management Committee, Executive Committee, Audit and Finance Committee and the Board.

To ensure that the controls implemented for the cybersecurity program are operating effectively, the University conducts an independent third-party Security Program Maturity Assessment annually. The assessment reviews the control implementation itself to ensure there are no gaps or failures; in addition, the control function is reviewed against the Capability Maturity Model Integration (CMMI) to further assess control, and hence program, maturity. Findings from the assessments are rolled into the risk register for treatment and tracking. Reports are shared with the Cyber Risk Management Committee, executive leadership, the Audit and Finance Committee and the Board.

Reporting on the Cybersecurity program is conducted both upstream and downstream at the University. Throughout the academic year. Reporting venues include:

DeVry University has implemented a formal and documented Information Security Policy, which has been approved by the University’s Cyber Risk Management Committee and has been published and acknowledged by University colleagues. The Policy is reviewed, updated and approved at least annually by the Committee.

In support of the Policy, the University has created a comprehensive set of standards, reviewed, updated and approved annually by the Office of the CISO, that provide more detailed guidance on cybersecurity for the University community. These standards include, but are not limited to:

The University has implemented rigorous processes and practices for cybersecurity risk management, resulting in the establishment of a Cyber Risk Management Committee, tasked with executive level functions such as the determination of risk tolerance and oversight of the cybersecurity risk management program. Program activities include:

DeVry University recognizes the potential risk introduced to the University from third parties. As such, it has created a formal and documented Third Party Risk Management program and standard. IT Security carries out the risk management process, in partnership with Contracts Management.

DeVry University is obligated to maintain compliance with legal and regulatory requirements affecting its students, colleagues and business operations. Compliance obligations for the University include, but are not limited to: 

The University understands that, from time to time due to a business justification or technical infeasibility, a business or IT requestor may request an exception to a policy, standard or control. A formal exception process has been implemented for this purpose.  

DeVry University acknowledges the need for resilient and sustainable business processes and technical platforms, as noted by Disaster Recovery Institute International (www.drii.org) and The Business Continuity Institute (www.thebci.org), along with ISO 22301. To promote the resilience of critical business processes and systems, formal Business Continuity and Disaster Recovery Plans have been implemented that include: 

An important part of the management of risk is the identification, treatment and tracking of vulnerabilities. This is particularly true for technical vulnerabilities, both in infrastructure and applications, as each may provide a potential path into an organization’s environment. DeVry University takes vulnerability management very seriously and has implemented a formal program for the identification, analysis, treatment and ongoing management of vulnerabilities, including the minimization of technical debt.

The design, development and ongoing maintenance of robust, secure code is a priority for DeVry University. This is achieved through the implementation of a Secure Software Development Lifecycle, appropriate security training for developers, adoption of a fit for purpose software assurance maturity model, identification and treatment of potential and existing vulnerabilities through both manual and automated means and ongoing monitoring of applications for health and security. The University is focused on delivering world-class, secure applications to its students, colleagues and third parties.

DeVry University has implemented and maintains an incident management capability that is informed by both the SANS/Foundstone and US CERT models for incident response and management. The University maintains a formal Incident Response Plan and corresponding process and technical procedures designed to bring the plan into action. Incident responders are diverse and represent the business, IT Security, executive leadership and third party partners. Communications are facilitated through the University’s Crisis Communications Plan and the Incident Management Standard.

DeVry University has implemented and maintains significant technical controls in its environment. These controls are preventive, detective and corrective in nature and are comprehensive in the protection of people, processes, data, technology and facilities. IT and Security are partners in the implementation and maintenance of these controls. Third parties are also employed for expertise and to enhance or expand the reach of the technical control environment. Control configuration and customization is informed by the Center for Internet Security, the National Institute of Standards and Technology, the Payment Card Industry Data Security Standard, DeVry University approved standards, third party recommendations and other sources, as appropriate.

Controls implemented and maintained in the DeVry University environment must be monitored to ensure that they are properly implemented and are operating effectively. In addition, monitoring of the University environment ensures that anomalous behavior does not go unnoticed with the potential to evolve into a disruption of critical departmental functions or an attack on the University. Logging and monitoring is performed on both a continuous and a tactical basis through the use of automation such as Security Information and Event Management tools, network and security monitoring and scanning tools and the input of highly experienced resources, both internal and third party.  

DeVry University is focused on the identification, treatment and management of vulnerabilities that may impact services to, or the security of, our students, colleagues and third parties. To that end, the University conducts both tactical assessment and continuous monitoring of its environment. Formal vulnerability assessments and penetration tests are conducted by both DeVry University and by third party providers periodically throughout the academic year. Tests include both external and internal scanning.  Findings from the assessments and penetration tests are rolled into the risk register for treatment and monitoring. Findings are also reported through IT leadership, the Cyber Risk Management Committee, the Executive Committee, the Audit and Finance Committee and the Board.