Policy to ensure that information security risks are managed effectively and treated proportionately according to a risk tolerance. This policy applies to any individual who has access to university systems and services and anyone who uses or manages data in any format in the course of university business.