Body
The Application Administration standard documents the minimum responsibilities, security controls, and operational expectations for personnel responsible for administering enterprise and departmental applications at Oakland University. This article outlines the ownership, access management, security controls, documentation, and lifecycle expectations for university applications.
Overview
The purpose of this standard is to ensure that the university applications are administered securely, reliably, and consistently, regardless of their hosting environment or organizational ownership, while supporting institutional operations, protecting university information, and maintaining compliance with applicable policies and regulatory requirements.
This standard documents the minimum responsibilities, security controls, and operational expectations for personnel responsible for administering enterprise and departmental applications at Oakland University. It defines the roles and responsibilities of Application Administrators, Business Owners, Functional Owners, University Technology Services (UTS), and third party providers and establishes consistent requirements for application ownership, access management, application configuration, operational support, security coordination, documentation, and lifecycle management.
Scope
This standard applies to all personnel who own, administer, manage, configure, support, or oversee enterprise applications that store, process, transmit, or provide access to organizational data or services.
The standard applies equally to all Information Resources such as:
- Vendor-hosted, cloud based, Software-as-a-Service (SaaS) applications
- On-premises enterprise or departmental systems/applications
- Applications and administrative interfaces used to manage Internet of Things (IoT) and Operational Technology (OT) equipment
- Applications supporting integrations, automated processes, and system-to-system communications
Standard
Application Administrators play a critical role in ensuring the secure and effective operation of university applications. Their responsibilities include managing application functionality, implementing approved configuration and access controls, supporting business processes, maintaining documentation, and coordinating security and operational activities.
Applications may be hosted internally, delivered through Software-as-a-Service (SaaS), or supported by third-party providers. Administrative responsibilities often exist within a shared responsibility model among Business Owners, Functional Owners, Application Administrators, University Technology Services, and service providers.
Application Administrators shall perform their responsibilities in accordance with approved University policies, security requirements, contractual obligations, and documented operational procedures.
Business units and application owners may establish additional requirements where justified by the sensitivity, criticality, or regulatory obligations of the application.
Application Ownership and Inventory
Each university application must have a designated Business Owner, Functional Owner, and Application Administrator (Note: A single individual may hold both the Business Owner and Functional Owner roles).
The responsible organizational unit shall ensure that the application is documented in the University's approved application inventory, including, at a minimum:
- Application name and business purpose
- Business Owner and Functional Owner
- Primary Application Administrator and backup administrative contact, as appropriate
- Hosting environment and service provider
- Data classification and business criticality
- Key integrations and technical dependencies
- Applicable regulatory and compliance requirements
- Vendor and technical support contacts
Application ownership and administrative assignments shall be reviewed and updated when significant organizational, personnel, or operational changes occur.
Applications supporting critical University functions shall have documented administrative coverage and escalation procedures appropriate to their criticality.
Identity and Access Management
Application Administrators shall coordinate with UTS to implement and maintain access controls consistent with University Identity and Access Management policies and standards including:
- Implementing approved role-based access and least-privilege principles.
- Ensuring user access is authorized by the appropriate Business or Functional Owner.
- Coordinating provisioning, modification, and deprovisioning of user access.
- Implementing University-approved centralized authentication and Multi-Factor Authentication (MFA).
- Restricting privileged administrative access to authorized personnel.
- Coordinating periodic reviews of user and privileged access with the appropriate Business or Functional Owner.
- Ensuring service accounts, application credentials, API tokens, and other non-human identities are appropriately secured and managed.
- Maintaining documentation of application-specific access roles, permissions, and administrative privileges.
Access shall be removed or modified promptly when individuals separate from the University, change responsibilities, or no longer require access.
Where an application cannot support required identity and access controls, the limitation shall be documented and addressed through the University's established exception process.
Application Security and Data Protection
Application Administrators shall coordinate with UTS, and the appropriate Business Owners or Data Stewards to ensure that application security controls align with University requirements including:
- Maintaining secure application configurations.
- Implementing available security controls appropriate to the application's risk and data classification.
- Supporting encryption requirements for data in transit and at rest, as applicable.
- Ensuring appropriate access restrictions for sensitive institutional information.
- Coordinating vulnerability assessments and remediation activities.
- Monitoring applicable vendor security advisories and coordinating corrective actions.
- Supporting University data classification, privacy, retention, and secure data handling requirements.
- Ensuring application-level security controls are documented and periodically reviewed.
Application Administrators shall not independently approve exceptions to University security requirements or accept institutional cybersecurity risks outside established risk governance processes.
Application Configuration and Change Management
Application Administrators are responsible for maintaining approved application configurations and coordinating changes in accordance with established University change management processes including:
- Maintaining documentation of significant application configurations and settings.
- Coordinating application upgrades, patches, and maintenance activities.
- Evaluating the operational and security impact of proposed changes.
- Coordinating testing and validation with Functional Owners and affected stakeholders.
- Obtaining required approvals before implementing changes.
- Maintaining appropriate rollback or recovery procedures for significant changes.
- Communicating planned maintenance and service impacts to affected stakeholders.
- Coordinating with UTS and vendors when changes affect integrations, infrastructure, identity services, or other enterprise systems.
Changes shall be managed in a manner that minimizes disruption, maintains security, and protects the integrity of University information and services.
Logging, Monitoring, and Incident Response
Application Administrators shall enable and maintain application-level logging and monitoring capabilities in accordance with University security and logging standards including:
- Enabling applicable authentication, administrative activity, access, and security event logging.
- Coordinating log retention requirements in accordance with University policies.
- Supporting integration with University-approved centralized logging and security monitoring platforms where required and feasible.
- Reviewing or facilitating the review of relevant application alerts and security events.
- Immediately reporting suspected security incidents, unauthorized access, data exposure, or vendor security breaches through the University's established IT Incident Reporting process.
- Supporting investigation, containment, remediation, and recovery activities in coordination with Information Security and UTS.
Where applications or vendors cannot provide required logging capabilities, the limitations and alternative monitoring arrangements shall be documented and reviewed through the appropriate security governance process.
Application Documentation and Integration Management
Application Administrators shall maintain current documentation sufficient to support secure administration, operational continuity, troubleshooting, and institutional knowledge transfer. Documentation shall include, as applicable:
- Application purpose, functionality, and administrative procedures.
- System architecture and hosting arrangements.
- Application configurations and security settings.
- Data flows, integrations, and dependencies.
- Data sets exchanged with other systems.
- API connections, service accounts, and non-human identities.
- Network communication and connectivity requirements.
- Authentication and authorization configurations.
- Vendor and technical support contacts.
- Maintenance, troubleshooting, and escalation procedures.
- Backup, recovery, and business continuity dependencies.
Documentation shall be maintained in University-approved repositories and made accessible to authorized personnel with a legitimate operational need. Sensitive technical information, including credentials and secrets, shall be maintained in approved secure systems rather than general documentation repositories.
Business Continuity and Disaster Recovery
Application Administrators shall coordinate with Business Owners, UTS, and service providers to support business continuity and disaster recovery requirements appropriate to the application's criticality including:
- Documenting critical application dependencies and recovery procedures.
- Identifying available backup, restoration, and recovery capabilities.
- Coordinating recovery planning with responsible infrastructure teams and vendors.
- Supporting periodic recovery testing and validation, as required.
- Documenting recovery limitations and dependencies.
- Supporting communication and restoration activities during application outages or disruptions.
Business Owners are responsible for establishing business continuity expectations, including Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), where applicable. UTS, Application Administrators, and service providers shall coordinate to assess whether available technical capabilities support those requirements. Identified gaps shall be documented and escalated through established institutional risk management processes.
Vendor and Third-Party Coordination
Application Administrators shall coordinate with Business Owners, UTS, Procurement, Information Security, and service providers to support appropriate oversight of externally hosted or vendor-supported applications including:
- Maintaining current vendor support and escalation information.
- Coordinating vendor maintenance, upgrades, and service disruptions.
- Supporting review of applicable vendor security and compliance documentation.
- Monitoring and communicating application service issues.
- Coordinating vendor-reported vulnerabilities and security incidents.
- Supporting service-level monitoring and resolution of operational concerns.
- Identifying changes in vendor services that may affect University operations, security, integrations, or data protection.
Contractual, procurement, and vendor risk management responsibilities shall remain with the designated University offices and accountable Business Owners.
Application Lifecycle Management
Application Administrators shall participate in application lifecycle activities, including implementation, operation, modernization, replacement, and retirement including:
- Supporting required architecture, security, integration, and technology reviews before application implementation.
- Participating in periodic application assessments.
- Identifying unsupported software, obsolete functionality, or significant operational risks.
- Coordinating application upgrades and modernization activities.
- Supporting secure data migration, retention, and disposal during application replacement or retirement.
- Ensuring access, integrations, credentials, and dependencies are appropriately removed or transitioned when applications are decommissioned.
- Updating application inventory and documentation throughout the lifecycle.
New applications and significant changes to existing applications shall follow applicable University technology review, procurement, and governance processes.
Compliance and Periodic Review
Application Administrators shall support institutional audits, risk assessments, compliance reviews, and security evaluations associated with assigned applications including:
- Maintaining documentation demonstrating compliance with applicable standards.
- Providing evidence of access reviews, configuration changes, security controls, and operational procedures.
- Supporting remediation of identified findings.
- Reporting significant unresolved risks to the appropriate Business Owner, UTS, and Information Security.
- Participating in periodic reviews based on application criticality, data sensitivity, and institutional requirements.
Application Administrators are responsible for implementing controls within their assigned authority. Business Owners retain accountability for business decisions, while Information Security provides oversight of institutional cybersecurity requirements.
Roles and Responsibilities
Chief Information Officer (CIO)
The Chief Information Officer is responsible for:
- Approving this standard.
- Providing executive oversight of institutional technology governance.
- Ensuring appropriate institutional accountability for application administration.
- Supporting enforcement and escalation through established governance processes.
Chief Information Security Officer (CISO)
The Chief Information Security Officer, or designated Information Security authority, is responsible for:
- Providing authoritative interpretation of application security requirements.
- Establishing and maintaining applicable cybersecurity control requirements.
- Monitoring compliance with University information security policies and standards.
- Coordinating application security assessments and risk evaluations.
- Providing oversight of cybersecurity incident response.
- Reviewing security exceptions and escalating material risks through established institutional governance processes.
University Technology Services (UTS)
UTS Leadership is responsible for maintaining this standard and ensuring that UTS-managed services support applicable application administration requirements.
UTS provides or coordinates services within its assigned operational responsibilities, including:
Infrastructure and security services
- Enterprise identity, authentication, and SSO services.
- Network connectivity and core infrastructure services.
- DNS, DHCP, and other foundational technology services.
- Security monitoring and incident response coordination.
- Operating system maintenance, patching, and troubleshooting for UTS-managed infrastructure.
- Enterprise infrastructure and platform support.
Enterprise application and business support
- Integration with centrally managed systems, including Banner and other enterprise platforms.
- Enterprise architecture and technical consultation.
- Coordination of testing and validation for changes affecting shared systems.
- Assistance with service-level monitoring and vendor coordination.
- Support for application onboarding, modernization, and retirement.
- Guidance on technology standards, documentation, and operational procedures.
Business Owner
The Business Owner is accountable for the application's business purpose, funding, operational requirements, and alignment with University objectives. Responsibilities include:
- Ensuring the application supports approved institutional and business objectives.
- Designating appropriate Functional Owners and Application Administrators.
- Defining or approving business access requirements.
- Approving significant business process changes.
- Establishing business continuity, availability, and recovery requirements.
- Ensuring appropriate funding and resources for application operations.
- Coordinating compliance with applicable business and regulatory requirements.
- Participating in application risk assessments and remediation decisions.
- Escalating risks requiring formal institutional acceptance.
- Approving major application lifecycle decisions, including replacement and retirement, within established governance authority.
Functional Owner
The Functional Owner is responsible for the day-to-day business functionality and operational use of the application. Responsibilities include:
- Serving as the primary subject matter expert for supported business processes.
- Defining functional requirements and business workflows.
- Establishing and validating application access roles and permissions.
- Reviewing and approving access requests within delegated authority.
- Participating in periodic user access reviews.
- Validating application configurations and business process changes.
- Coordinating user acceptance testing.
- Supporting user training, adoption, and process improvement.
- Identifying functional issues and coordinating their resolution with Application Administrators and vendors.
Application Administrator
The Application Administrator is responsible for the configuration, administration, and operational support of assigned applications within the documented support model. Responsibilities include:
- Maintaining approved application configurations and functionality.
- Implementing and supporting approved identity and access controls.
- Coordinating user provisioning, modification, and deprovisioning.
- Maintaining application security settings, logging, and monitoring capabilities.
- Coordinating application upgrades, patches, and maintenance.
- Maintaining current application documentation, integrations, and dependencies.
- Supporting application change management and testing.
- Coordinating with UTS, Information Security, Business Owners, Functional Owners, and vendors.
- Reporting suspected security incidents and operational risks.
- Supporting business continuity and disaster recovery activities.
- Participating in audits, compliance assessments, and remediation activities.
- Supporting application lifecycle management, including onboarding and retirement.
Vendor or Service Provider
Vendors and service providers are responsible for products, services, infrastructure, and security controls under their contractual responsibility. Responsibilities may include:
- Maintaining contracted application availability and service performance.
- Performing applicable infrastructure and platform maintenance.
- Implementing security controls within the vendor-managed environment.
- Communicating planned maintenance, outages, and significant service changes.
- Reporting security incidents and vulnerabilities in accordance with contractual requirements.
- Supporting troubleshooting, recovery, and remediation activities.
- Providing security, compliance, and service documentation as contractually required.
Non-Compliance and Exceptions
All applications within the scope of this standard shall comply with applicable requirements. Where compliance cannot be achieved due to technical, operational, contractual, or business constraints, a formal exception request shall be submitted through the University's established information security exception process.
Exception requests shall include:
- The requirement that cannot be met.
- The reason compliance is not feasible.
- The associated operational or security risks.
- Proposed compensating controls.
- The responsible Business Owner.
- The requested exception duration and remediation plan, where applicable.
Exceptions shall be reviewed by appropriate Subject Matter Experts (SMEs) within UTS, Information Security and approved by the designated institutional authority in accordance with University risk management requirements. Approved exceptions shall be documented, time-bound where appropriate, and periodically reviewed.
Appendix A: Application Administration Control Checklist
This checklist supports implementation and periodic review of the minimum requirements established by this standard. Application Administrators shall complete the applicable sections in coordination with Business Owners, Functional Owners, UTS, and vendors / service providers.
A.1 Application Ownership and Inventory
- ☐ Application registered in the University-approved inventory.
- ☐ Business Owner identified.
- ☐ Functional Owner identified, where applicable.
- ☐ Primary Application Administrator identified.
- ☐ Backup administrative coverage established, where required.
- ☐ Data classification documented.
- ☐ Business criticality documented.
- ☐ Hosting environment and service provider documented.
A.2 Identity and Access Management
- ☐ University-approved authentication implemented.
- ☐ MFA enabled where required.
- ☐ Application access roles documented.
- ☐ Least-privilege access implemented.
- ☐ Privileged accounts identified and restricted.
- ☐ Access approval process documented.
- ☐ Provisioning and deprovisioning procedures documented.
- ☐ Periodic user access review process established.
- ☐ Service accounts and non-human identities inventoried.
- ☐ Administrative credentials securely stored.
A.3 Security Configuration and Data Protection
- ☐ Application security settings documented.
- ☐ Data protection requirements identified.
- ☐ Encryption controls reviewed and implemented as applicable.
- ☐ Vulnerability and vendor security advisory monitoring established.
- ☐ Patch and upgrade responsibilities documented.
- ☐ Security assessment completed where required.
- ☐ Applicable privacy and regulatory requirements identified.
- ☐ Data retention and disposal requirements documented.
A.4 Logging and Monitoring
- ☐ Required authentication and administrative activity logging enabled.
- ☐ Log retention requirements established.
- ☐ Logging aligned with University policies and standards.
- ☐ Centralized logging or SIEM integration implemented where required and supported.
- ☐ Application security alerts and monitoring responsibilities documented.
- ☐ Security incident reporting and escalation procedures established.
A.5 Architecture and Integration Documentation
- ☐ Application architecture documented.
- ☐ Data flows and integrations documented.
- ☐ API connections and service accounts documented.
- ☐ Network communication requirements identified.
- ☐ Dependencies on enterprise systems documented.
- ☐ Vendor and technical support contacts maintained.
- ☐ Administrative and troubleshooting procedures documented.
- ☐ Relevant security and compliance documentation maintained, including VPAT, SOC 2, HECVAT, or equivalent assessments.
A.6 Change and Configuration Management
- ☐ Application change management process established.
- ☐ Configuration changes documented.
- ☐ Testing and approval requirements established.
- ☐ Upgrade and maintenance procedures documented.
- ☐ Rollback or recovery procedures available where appropriate.
- ☐ Change communications and stakeholder coordination established.
A.7 Business Continuity and Disaster Recovery
- ☐ Business continuity requirements documented.
- ☐ RTO and RPO established where applicable.
- ☐ Backup and recovery responsibilities documented.
- ☐ Recovery procedures maintained.
- ☐ Application dependencies identified.
- ☐ Recovery testing performed according to applicable requirements.
- ☐ Recovery limitations and unresolved risks documented.
A.8 Vendor and Third-Party Management
- ☐ Vendor support and escalation contacts documented.
- ☐ Shared responsibility model identified.
- ☐ Vendor security documentation reviewed where required.
- ☐ Service-level requirements identified.
- ☐ Vendor incident notification procedures established.
- ☐ Maintenance and service disruption communication procedures documented.
A.9 Application Lifecycle and Compliance
- ☐ Required technology and security reviews completed.
- ☐ Application documentation reviewed and updated.
- ☐ Periodic application risk assessment completed where required.
- ☐ Audit and compliance evidence maintained.
- ☐ Identified risks and remediation actions tracked.
- ☐ Application retirement and data disposal procedures established.
- ☐ Approved exceptions documented and reviewed.
Appendix B: Application Administration Responsibility Matrix
| Activity |
Accountable / Decision Authority |
Primary Responsible Party |
| Business purpose and funding |
Business Owner |
Business Owner |
| Application inventory and ownership |
Business Owner |
Application Administrator |
| Business access requirements |
Business Owner |
Functional Owner |
| User provisioning and deprovisioning |
Business Owner |
Application Administrator / IAM Team |
| Access role configuration |
Business Owner |
Application Administrator |
| Periodic access certification |
Business Owner |
Functional Owner, supported by Application Administrator |
| Application configuration |
Business Owner |
Application Administrator |
| Application upgrades and maintenance |
Designated Service Owner |
Application Administrator / Vendor |
| Security control requirements |
CISO / Information Security |
Application Administrator / UTS / Vendor |
| Security risk acceptance |
Designated Institutional Authority |
Business Owner, with Information Security review |
| Application logging and monitoring |
Designated Service Owner |
Application Administrator / UTS / Vendor |
| Infrastructure operations |
Designated Infrastructure Service Owner |
UTS / Vendor |
| Business continuity requirements |
Business Owner |
Business Owner |
| Technical recovery implementation |
Designated Service Owner |
Application Administrator / UTS / Vendor |
| Vendor contract and service oversight |
Business Owner |
Business Owner / Procurement / UTS |
| Application retirement |
Business Owner |
Application Administrator / UTS / Vendor |
Definitions
Capitalized terms used herein without definition are defined in the UTS Standard: IT Terminology.
Related Documents, Forms, and Tools
Last Modified: 10/27/2026
Authority: Approved by University Technology Services (UTS) Chief Information Officer
Category: Security Standards
Status: Published
Additional Support
OU Technology Center
44 Oakland Center
Rochester, MI 48309-4479
(248) 370-4357
Office Hours: M-F 8:00am - 5:00pm