Effective cybersecurity in Higher Education depends on governance, accountability and leadership as much as it does on technology. Joshua Copeland, Adjunct Professor of Information Technology at Tulane University’s School of Professional Advancement in Louisiana, tells us why universities must stop treating cybersecurity as solely an IT responsibility and instead embed clear ownership, governance and risk management across the entire institution to strengthen resilience and protect their core mission.
For years, Higher Education has characterised cybersecurity as an IT problem.
This perspective is not only outdated; it also poses significant risks.
The IT department operates the network, manages endpoints, maintains identity systems and responds to alerts. It does not decide which cloud platforms faculty adopt, what data researchers collect, how quickly terminated employees lose access, which vendors receive student information, whether a department bypasses procurement or how much institutional risk leadership will accept. Those decisions belong to different parts of the institution.
These decisions occur throughout the institution and, consequently, cyber-risk is distributed institution-wide.
A university is not a single enterprise under one clear chain of command. It is closer to a small city. It may include academic departments, research laboratories, medical clinics, athletic programmes, residence halls, public safety, financial services, fundraising operations, student organisations and thousands of personal devices. Faculty members are expected to experiment. Researchers need openness and collaboration. Students connect from everywhere. Departments often have their own budgets, applications, vendors and local administrators.
This environment represents one of Higher Education’s greatest strengths. However, it also demonstrates why cybersecurity cannot be delegated solely to a technical department and considered resolved.
Cybersecurity must align with the institution’s mission.
Every major institutional function now depends on technology. As a result, admissions depend on online applications and identity verification. Finance depends on payment systems and banking relationships. Teaching depends on learning platforms, video services and cloud applications. Research depends on specialised systems, external collaborators, grant requirements and valuable intellectual property. Student services manage some of the most sensitive information an institution holds.
When these systems fail, the damage extends beyond IT. Classes may be suspended, payroll delayed, research interrupted, student services disrupted, personal information exposed and institutional trust diminished.
The US Department of Education warns that breaches of educational data are common and can lead not only to FERPA concerns but also to identity theft, fraud and extortion. Higher Education institutions may also have obligations involving financial records under the Gramm-Leach-Bliley Act, while campus clinics, research programmes, payment environments and government-funded projects can introduce additional regulatory and contractual requirements. The Federal Trade Commission’s Safeguards Rule itself requires administrative, technical and physical safeguards. That language matters. Cybersecurity was never intended to be a technology-only activity.
The threat landscape reinforces this point. Verizon’s 2026 Data Breach Investigations Report found exploitation of vulnerabilities is the leading initial breach vector, accounting for 31 percent of breaches. This creates work for technical teams, but the response depends on institutional decisions. Who owns the vulnerable system? Who funds its replacement? Who can accept downtime? Who can force a vendor to act? Who has the authority to stop using a platform a department considers mission-critical?
IT departments can identify risks, but they cannot unilaterally resolve every underlying condition that contributes to those risks.
Assigning sole responsibility for cybersecurity to IT is like holding campus police accountable for every unsafe decision on campus. While IT can establish controls, investigate incidents and respond to issues, it cannot oversee every decision or compensate for departments that disregard protocols.
The myth of the security department as owner
Many institutions assert that cybersecurity is a shared responsibility. While this is conceptually accurate, without clearly defined decision-making authority, such an approach often lacks operational effectiveness.
When responsibility is shared without clear decision authority, the predictable result is delay. The security team identifies a high-risk vendor, but procurement owns the contract. IT discovers excessive access, but human resources owns employment status. A researcher wants to move restricted data into a new Artificial Intelligence platform, but no one is sure whether the dean, legal counsel, research administration, privacy or the Chief Information Security Officer owns the decision.
Although all stakeholders are involved, no individual or group is clearly empowered to make definitive decisions.
Shared responsibility cannot mean shared ambiguity.
The cybersecurity function should own security standards, risk analysis, technical guidance, monitoring and incident co-ordination. It should have the authority to establish minimum safeguards and escalate unacceptable conditions. But it cannot own every business process that produces cyber-risk.
The registrar must have ownership of how student records are handled. Human resources must own timely changes in workforce status. Procurement must own enforcement of security requirements in purchasing. Legal and privacy teams must interpret obligations and acceptable use. Research leadership must govern the handling of sensitive research data. Facilities must account for connected building systems. Communications must be prepared to manage public messaging during an incident. Senior executives must decide when institutional risk is accepted rather than reduced.
These responsibilities extend beyond IT; they constitute institutional governance.
While organisational culture is important, effective governance is paramount.
Cybersecurity awareness training is necessary, but annual training will not fix broken authority, poor procurement practices or unclear accountability.
A faculty member cannot compensate for a system that allows sensitive data to be placed into an unreviewed application. An employee cannot make a good decision if the institution has not established clear rules for Artificial Intelligence tools and data sharing. Institutional culture is shaped by consistent signals about what is valued, funded, measured and enforced. Consequently, cybersecurity culture is influenced by these factors.
If institutional leaders describe cybersecurity as critical yet routinely approve exceptions without documented risk acceptance, the implicit message is that security is optional. When departments purchase technology outside established review processes, convenience is prioritised over governance. If executive engagement occurs only after incidents, cybersecurity is treated as a technical emergency rather than an enterprise risk discipline.
EDUCAUSE made ‘Collaborative Cybersecurity’ the number one issue in its 2026 Top 10, emphasising shared responsibility, awareness, training and access to security support. That prioritisation reflects a reality many institutions are finally confronting: cybersecurity maturity depends on relationships and institutional participation, not merely better tools.
Technical tools such as firewalls, endpoint protection, multifactor authentication, vulnerability management, logging and backups are essential. However, acquiring more security products will not fix deficiencies in decision-making. Technology alone cannot resolve governance issues that institutional leadership ignores.
What shared ownership should look like
Higher Education institutions do not require every department to act as a dedicated security office. Instead, each unit must understand and manage cybersecurity decisions within its purview.
Executive leadership should define risk tolerance and ensure the cybersecurity leader has a direct path for escalation. Governing boards should treat cyber-risk as part of institutional resilience, not a quarterly technical update. Deans and department heads should be accountable for technology and data practices in their areas. Procurement should prevent contracts from bypassing security and privacy review. Human resources should integrate access control into the full employee lifecycle. Faculty and researchers should have secure, usable pathways for innovation rather than just being told to stop experimenting.
Most importantly, institutions require clearly defined decision rights.
Who can disconnect a compromised system? Who can delay launch? Who can reject a vendor? Who accepts the risk when a legacy platform cannot be patched? Who decides whether operations will continue during an active incident?
These questions must be addressed proactively, not debated during a crisis.
Cybersecurity teams should be the watchers. They identify risk, define protective requirements, validate controls and co-ordinate response. Operational and academic owners must be the doers. They remediate conditions, change processes, fund replacements and make mission decisions within clearly established boundaries.
This division of responsibilities does not diminish the authority of cybersecurity functions; rather, it enhances their effectiveness.
The CISO does not need ownership of every institutional decision. The CISO needs clearly bounded authority over security conditions, including the ability to escalate unacceptable risk to the executive who must decide and be accountable.
The institutional mission is at risk; appropriate action is required.
Colleges and universities exist to educate, conduct research, serve communities and create knowledge. Cybersecurity supports that mission by protecting the trust, availability and integrity on which those activities depend.
Framing cybersecurity solely as an IT responsibility leads the rest of the institution to perceive cyber-risk as purely technical. This perspective should be reconsidered.
It is not.
IT can deploy multifactor authentication. It cannot make a department stop sharing passwords. Security can assess a vendor. It cannot force procurement to reject the contract without institutional backing. A CISO can warn leadership that a legacy system poses a risk. The CISO cannot manufacture funding, downtime or executive courage. Those choices must come from institutional leaders.
When an institution is hit by ransomware, the public will not blame the firewall. Students will not distinguish between an IT failure and a leadership failure. Researchers whose work is lost will not care which department owns the server. Regulators will not accept an organisational chart as evidence that protecting data was somebody else’s job.
Cybersecurity is an institutional responsibility because the risk is created, accepted and experienced across the institution.
The systems may be managed by IT. The consequences will not be.
