Information Management and Technology IM14 - Assessments

Accessed:	2026-07-17
Purpose of series:	Records documenting the process and completion of assessments related to risk, security and privacy of programs, projects, activities, and systems (used or owned by the institution) related to information collected, used, managed and stored by the institution.
Scope and contents:	Includes (but is not limited to): Privacy Impact Assessments (PIA), security assessments, risk assessments, consultations, related correspondence, and supporting documentation.
Cross reference:	License and service level agreements or contracts, see: Finance - Procurement (FN50); Privacy incidents or breaches, see: Information Management and Technology - Privacy Incidents (IM13)
Exceptions:	Audits, see: Governance - ____ (GV## Coming soon); Risk management strategies, see: Governance - ____ (GV## - Coming soon)

Primary offices:	Unit Responsible
Primary office retention trigger:	Superseded / Obsolete
Primary office disposition:	Transfer to University Archives
Primary office retention period:	5 years
Primary office retention instructions:	S/O = Date approved, updated, revised, or terminated. Once assessment updated, revised, or program, project, activity, or system terminated, retain for 5 additional years, then transfer to the University Archives for selective retention.

Secondary offices:	Units
Secondary office retention trigger:	Superseded / Obsolete
Secondary office disposition:	Secure Destruction
Secondary office retention period:	1 year
Secondary office retention instructions:	S/O = Date assessment completed. Once assessment completed retain for 1 additional year then securely destroy.

Retention rationale:

Expected operation use, privacy and security standards

Vital records	Electronic systems	Personal information	Official media
No	NAS, SharePoint, Legal Files	No	Paper, Electronic

Approval date:	Last updated:	Edited by:	Security classification:
2023-01-27	2023-02-07 13:02:09		Internal

Notes:

Primary Office Responsible = Unit Responsible. 'Unit Responsible' (within IM14) is defined as the unit that initiated or completed assessment, or unit deemed as oversite manager of system.