Purpose

The Regulated Workload Hosting Standard defines the minimum hosting requirements for regulated workloads deployed within University-managed technology environments.

This standard establishes a consistent hosting model for implementing applicable governance, security, identity, access, network, monitoring, data protection, resilience, operational, and compliance requirements.

Regulation-specific, contractual, legal, and institutional requirements must be implemented through approved architecture controls, standards, patterns, products, deployment capabilities, and operational procedures.

Scope

This standard applies to University-managed technology solutions classified as Regulated workloads, including:

• Applications
• Databases
• Data platforms and data products
• Integration services
• Cloud and infrastructure services
• Platform services
• Shared services handling regulated data
• Development, testing, production, recovery, and supporting environments containing regulated data

This standard applies regardless of whether requirements originate from law, regulation, contract, grant, agreement, industry standard, data classification, or institutional policy.

Core Principles

Requirements Follow the Workload and Data

Applicable requirements remain attached to workloads and data regardless of changes to applications, hosting platforms, storage services, integrations, or deployment technologies.

Governance by Design

Governance, security, compliance, operational, and evidentiary requirements must be incorporated into the hosting architecture before production deployment.

Risk-Based Controls

Controls must align with applicable obligations, workload classification, data sensitivity, business impact, threat exposure, and documented risk.

Standardized Implementation

Approved architecture patterns, platform capabilities, automation, and reusable services must be used whenever they satisfy business, technical, operational, and compliance requirements.

Continuous Accountability

Regulated workloads must maintain sufficient ownership, visibility, documentation, evidence, and operational processes to demonstrate that required controls remain implemented and effective.

Workload Classification Requirements

• Workloads subject to regulatory, legal, contractual, grant, industry, or institutional control requirements must be evaluated for classification as Regulated workloads.
• Workload classification must be established before production deployment.
• Applicable data classifications must be identified and documented.
• Applicable regulatory, legal, contractual, grant, industry, and institutional requirements must be identified and documented.
• When multiple requirements apply, the workload must satisfy all applicable obligations.
• Changes to workload purpose, data, integrations, ownership, or applicable obligations must trigger reevaluation of the workload classification and hosting requirements.

Hosting Environment Requirements

• Regulated workloads must operate within approved University-managed or University-authorized hosting environments.
• Hosting environments must support implementation of applicable governance, security, privacy, operational, resilience, and compliance requirements.
• Hosting platforms and services must be approved for the applicable workload and data classifications.
• Hosting environments must provide defined administrative, security, operational, and governance boundaries.
• Hosting architecture must identify which components store, process, transmit, expose, or provide access to regulated data.
• Development, testing, recovery, and supporting environments containing regulated data must satisfy applicable hosting requirements.
• Production use must not begin until required controls, ownership, monitoring, recovery, and operational capabilities have been implemented.

Governance Requirements

• Regulated workloads must have documented business, technical, operational, security, and data ownership.
• Workloads must inherit required controls through approved governance structures whenever practical.
• Governance controls must support policy enforcement, compliance visibility, accountability, oversight, and remediation.
• Required controls must be implemented through approved policies, standards, architecture controls, patterns, and automated governance mechanisms.
• Regulated workloads must maintain an inventory of applicable resources, services, integrations, data stores, identities, and external dependencies.
• Material architecture and configuration changes must follow approved review and change-management processes.
• Noncompliant configurations must be prevented, remediated, or managed through an approved exception.

Identity and Authentication Requirements

• Regulated workloads must use approved enterprise identity services whenever those services satisfy applicable requirements.
• Users, administrators, applications, services, devices, and automation must be uniquely identifiable when required for accountability.
• Authentication controls must align with workload classification, data sensitivity, access method, privilege level, and applicable obligations.
• Multifactor authentication must be implemented where required by policy, standard, risk, or applicable obligation.
• Independent or local identity systems must not be used when approved enterprise identity capabilities satisfy business and compliance requirements.
• Identity creation, modification, suspension, and removal must follow approved lifecycle processes.
• Authentication activities must support monitoring, investigation, and audit requirements.

Authorization and Access Management Requirements

• Access must be granted only for approved business purposes.
• Access must follow least-privilege and separation-of-duties principles.
• Role-based and group-based assignments must be used instead of direct individual assignments whenever practical.
• Privileged access must be separated from standard user access and governed through approved privileged-access processes.
• Access to regulated data and administrative capabilities must be approved, documented, and periodically reviewed.
• Access must be removed or modified when the approved business need changes or no longer exists.
• Emergency access requirements must be documented and implemented when required by the workload or applicable obligation.
• Authorization events and administrative changes must be auditable.

Network Security Requirements

• Regulated workloads must operate within approved network security boundaries.
• Connectivity must be limited to approved and necessary communication paths.
• Ingress, egress, administrative access, service-to-service communication, and external integrations must be identified and governed.
• Connectivity decisions must follow the approved Risk-Based Connectivity Model.
• Public exposure must be limited to documented business requirements and protected by appropriate access, security, monitoring, and governance controls.
• Private connectivity must be used when justified by workload risk, data sensitivity, applicable obligations, or architecture requirements.
• Network segmentation must align with workload boundaries, data flows, operational requirements, and documented risk.
• Network activity must support operational visibility, security monitoring, investigation, and audit requirements.

Monitoring and Audit Requirements

• Regulated workloads must generate operational, security, administrative, access, and audit telemetry appropriate to the workload and applicable obligations.
• Monitoring must provide visibility into workload health, resource health, service health, security-relevant activity, and administrative changes.
• Authentication, authorization, privileged access, configuration changes, data access, and other required events must be logged when supported and applicable.
• Logging and monitoring must integrate with approved enterprise monitoring capabilities whenever practical.
• Alerts must be configured for conditions requiring operational or security response.
• Monitoring data must be protected against unauthorized access, modification, and deletion.
• Log retention must align with applicable legal, regulatory, contractual, institutional, investigative, and operational requirements.
• Monitoring capabilities must support incident response, investigations, compliance reviews, audits, and operational troubleshooting.

Data Protection Requirements

• Regulated data must be protected throughout its creation, use, storage, transmission, sharing, backup, recovery, retention, archival, and disposition.
• Protection controls must support confidentiality, integrity, availability, accountability, and recoverability.
• Regulated data must be encrypted at rest and in transit when required by applicable obligations, approved standards, or documented risk.
• Encryption keys, secrets, certificates, and other sensitive credentials must be protected through approved management capabilities.
• Access to regulated data must be limited to approved identities performing approved functions.
• Data movement must occur through approved applications, services, integrations, and communication paths.
• Data retention and disposition must follow applicable legal, regulatory, contractual, records-management, and institutional requirements.
• Copies, replicas, exports, backups, and derived datasets must receive protections appropriate to their contents and use.

Resilience and Recovery Requirements

• Regulated workloads must implement resilience and recovery capabilities aligned with business impact, workload classification, data sensitivity, and applicable obligations.
• Recovery Time Objectives and Recovery Point Objectives must be established, documented, and approved.
• Backup, restoration, replication, redundancy, and continuity capabilities must be selected according to workload requirements and documented risk.
• Backup data and recovery services must receive protections appropriate to the data and workload they support.
• Recovery procedures must be documented and maintained.
• Backup and restoration capabilities must be periodically validated through approved operational processes.
• Recovery testing must verify that required data, applications, configurations, identities, dependencies, and services can be restored.
• Recovery results, deficiencies, and remediation activities must be documented.

Shared Service Requirements

• Regulated workloads may consume approved enterprise shared services.
• Shared service use must not weaken required workload isolation, governance, security, monitoring, data protection, or compliance controls.
• A shared service must be evaluated according to the data it stores, processes, transmits, exposes, or can access.
• Services directly handling regulated data must satisfy applicable regulated hosting requirements.
• Identity, monitoring, governance, management, networking, security, and automation services may be shared when approved controls and boundaries are maintained.
• Shared service responsibilities must be documented between service providers and workload owners.
• Shared services must support the monitoring, investigation, continuity, and evidence requirements of the regulated workloads they serve.

Deployment and Automation Requirements

• Regulated hosting environments must be deployed through approved automation whenever practical.
• Infrastructure as Code must be used as the approved deployment and configuration mechanism when supported by the target platform and architecture.
• Approved deployment artifacts must serve as the authoritative implementation source for managed infrastructure and platform configuration.
• Deployment artifacts and configuration changes must be version-controlled and reviewable.
• Automated deployments must implement required governance, identity, network, monitoring, data protection, and recovery integrations.
• Manual configuration must be minimized and reconciled with the authoritative deployment source.
• Deployment processes must support repeatable provisioning, validation, remediation, and lifecycle management.
• Secrets and sensitive configuration values must not be stored in deployment artifacts in an unprotected form.

Operational Requirements

• Regulated workloads must have documented operational ownership and support responsibilities.
• Operational procedures must address monitoring, alert response, incident response, access administration, vulnerability remediation, backup, recovery, change management, and service restoration.
• Workloads must use supported technologies and maintain required security and platform updates.
• Security vulnerabilities and unsupported components must be identified, assessed, and remediated through approved processes.
• Material incidents must be reported and managed through approved incident-response processes.
• Workload owners must periodically verify that required architecture, security, operational, and compliance controls remain implemented.
• Changes to hosting platforms, services, ownership, integrations, or data use must be evaluated for impact to applicable requirements.

Compliance Evidence Requirements

• Regulated workloads must produce and retain evidence sufficient to demonstrate implementation and operation of applicable controls.
• Evidence must be traceable to the applicable requirement, control, workload, service, and responsible owner.
• Evidence may include architecture records, approvals, configuration records, policy evaluations, access reviews, logs, alerts, test results, recovery results, incident records, and exception records.
• Evidence collection should be automated whenever practical.
• Evidence must be protected against unauthorized access, modification, and deletion.
• Evidence retention must align with applicable legal, regulatory, contractual, institutional, and audit requirements.
• Control deficiencies must be documented, assigned, tracked, and remediated through approved governance processes.

Exceptions

Exceptions to this standard must follow approved architecture governance and information security exception processes. Approved exceptions must be periodically reviewed and must not be treated as permanent architecture patterns.