A public, balanced scorecard of how the program is performing — one leading measure (effort) and one lagging measure (result) across each governance pillar. Figures are illustrative for this preview.
Each initiative has a public governance record. Sign in for staff-only artifacts — the catalog entries, access policies, quality rules, RACI charts, and compliance documentation behind each one.
Four standard requests cover almost everything. Each routes to the right steward and follows a defined turnaround.
See or use a dataset, report, or system you don't yet have rights to.
Flag inaccurate, missing, duplicated, or out-of-date data.
Request a new report, dashboard, integration, or dataset.
Ask for a time-bound exception to a policy when there's a real need.
If you suspect data has been exposed, lost, or accessed improperly, report it immediately to the Privacy Office and CISO — don't wait until you're sure. Handled under the institution's incident-response procedure (NIST SP 800-61), with notification per FERPA, GDPR, and state law.
Each domain still has Trustees, Stewards, and Custodians who know their data best — but they operate within standards set and enforced centrally, not independently. This is a centralized model, not a federated one.
Centralized doesn't mean the central office decides everything about everyone's data. The DGO is accountable for the governance program — the rules, the platform, the oversight. Domain Data Trustees remain accountable for their data — they make the calls, within the standards the DGO sets. The office owns the rules of the road; Trustees drive their own cars.
That the framework exists, is applied consistently across every domain, and is enforced. Owns the how — policy, classification scheme, the catalog platform, the access process, quality methodology, and tooling. Does not own the data or make domain data decisions.
Who may access their data, how it's used, how it's classified, and whether it's fit for purpose. Owns the what — the actual decisions about their domain's data. Makes those calls within the standards the DGO sets.
Every initiative and dataset on this portal carries one of four classification tiers. The tier sets who may see the data and how it must be handled. When in doubt, data is classified up.
The governance roles you'll see referenced across every initiative, plus the terms that carry specific meaning here.
Roles can be held by people or, increasingly, governed services — an AI agent acts as a Custodian under delegated authority while a human Trustee stays accountable.
Each policy has a named owner and a review cadence. Staff sign-in is required for the full text of internal procedures.
Initiatives are tagged with the laws that govern their data. Here's what each one means. This is orientation, not legal advice — the Privacy Office and Counsel determine what applies.
AI doesn't get a governance exception — it gets more scrutiny. A model is only as trustworthy as the governed data behind it, and a system that acts autonomously is held to the highest standard.
Worked example: see the Student Success Copilot in the initiative register. Note the EU AI Act can reach US institutions where AI output is used in the EU or serves EU learners, and treats admissions, assessment, and proctoring as high-risk — Counsel sets scope per system.
Submit a data access request with your purpose. The Trustee and Steward approve based on business need.
The Data Steward for that domain owns the definition — one agreed meaning, used everywhere.
Only staff with a legitimate educational interest, under FERPA. Access is role-based and logged.
Only governed, appropriately-classified data — and never Confidential or Restricted data in external AI services.
Check both draw from a governed source of truth. If definitions differ, raise it with the Steward.
Use "Report a data issue" on the initiatives page, or email the Privacy Office for a privacy concern.
{{ sel.purpose }}
{{ sel.compliance }}
Each of the five components has a governance artifact for this initiative. Public summaries are shown; the full artifacts are staff-only.