.png){kind=logo}
Who Holds the Keys?
How an independent IT audit helped a public university weigh its distributed risk
​
Project Information
THE CHALLENGE
The university's internal audit function needed an independent technical assessment that would do three things:
01 Identify risks in network access controls across central IT and the separate environments that individual colleges and schools manage.
02
Assess the security of endpoints managed by central IT and by individual colleges and schools.
03
Analyze the risks created by administrative privileges held and managed outside central IT.
Internal audit already considered the distributed environment the institution's greatest risk. Making that case to academic units was hard. Those units had long operated with broad autonomy, and some viewed internal audit as aligned with central administration. To them, a push from internal audit to tighten oversight of college-managed IT could look like central administration reaching for control rather than a response to real risk.
THE CLIENT
A regional public research university with roughly 17,000 students, including about 2,000 graduate students, and nationally recognized programs in the health sciences, engineering, and the natural sciences. The university runs IT in house, but responsibility for it is distributed; many endpoints and administrative privileges sit within individual colleges and schools rather than central IT. At the time of the audit, the university's security program and monitoring tools were still maturing. The university selected Securance as its co-sourced IT audit provider through a competitive process, and internal audit has since called on Securance for additional audits. The audit profiled here focused on the university's distributed IT environment.
The university needed findings from a credible outside voice that couldn't be dismissed as internal politics.
THE SECURANCE SOLUTION
Assessed network access controls across centralized and distributed environments.
Evaluated endpoint security, including devices managed outside central IT.
Reviewed how administrative privileges are granted and managed within the individual colleges and schools.
Benchmarked the maturity of the university's security monitoring.
Presented findings to leadership alongside internal audit.
THE RESULTS
The assessment answered the university's central question: how much risk the distributed network and endpoint environment poses to the institution. The answer gave internal audit an evidence-based case to bring to senior leadership.
Just as important was who delivered it. Securance presented the findings alongside internal audit, adding the credibility of an experienced, independent IT auditor. That moved the conversation past questions of internal alignment and onto the risk itself. The decision on how to bring distributed IT administration under stronger governance now rests with the university's president and provost, who have a clear, independently validated picture of what's at stake.
Securance remains the university's co-sourced IT audit provider.