UW System Administrative Policy Guidance 1000
Guidance for SYS 1000: Information Security: General Terms and Definitions

Guidance for Identifying High Impact Systems

Original Issuance Date: September 29, 2026

Last Revision Date: September 29, 2026

1. Purpose of Guidance 

Consistent with the principles and definitions established in SYS 1000, Information Security: General Terms and Definitions, each university is responsible for identifying systems that are essential to the continuity of its administrative, academic, research, and public service functions. A High Impact System is generally one for which a loss of confidentiality, integrity, or availability could result in significant operational disruption, financial loss, reputational harm, regulatory noncompliance, or an inability to perform mission-critical activities. 

This guidance is intended to support consistent, risk-informed decision-making when determining whether a system should be considered a High Impact System. It does not prescribe a specific assessment methodology, scoring model, or list of systems that must be designated as high impact. Each university should make determinations based on its mission, operating environment, dependencies, and risk tolerance. 

This is a framework for identifying High Impact Systems as defined or referenced in applicable University of Wisconsin (UW) System policies and standards, supporting consistent implementation of associated security and operational requirements. 

2. Publishing Office(s) 

Universities of Wisconsin Administration Office of Information Security 

3. Affected Stakeholders on Campus 

The following stakeholders should actively adhere to this guidance: 

  • Chief Information Officers (CIOs) 
  • Information Security Officers (ISOs) 
  • Security Operations Personnel 
  • System Owners 
  • System Administrators 
  • IT Teams responsible for system administration, logging, monitoring, and security operations 
  • Business process owners, continuity personnel, privacy personnel, risk management personnel, and technology stakeholders involved in determining system impact classifications 

4. Primary Responsibility 

Universities 

Universities are responsible for identifying systems that are essential to the continuity of their administrative, academic, research, and public service missions. Identifying High Impact Systems supports effective risk management and enables universities to appropriately prioritize security controls, business continuity and disaster recovery planning, risk assessment activities, and incident response capabilities. 

Universities are responsible for: 

  • Identifying and maintaining an inventory of High Impact Systems. 
  • Applying applicable requirements for High Impact Systems as defined in UW System policies, standards, and related governance documents. 
  • Maintaining documentation to support High Impact System determinations. 
  • Reviewing High Impact System designations periodically and whenever significant changes to system functionality, business use, dependencies, or risk occur. 

UW Administration 

UW Administration is responsible for maintaining applicable policies, standards, and guidance related to High Impact Systems and for providing resources, support, and clarification as needed to promote consistent implementation across universities. 

5. Guidance  

Universities are responsible for identifying the systems that are most important to the continuity of their administrative, academic, research, and public service missions. Identifying these systems helps universities appropriately prioritize security protections, continuity planning, recovery capabilities, risk assessments, and incident response activities. 

This guidance is intended to support consistent, risk-informed decision-making when determining whether a system should be considered a High Impact System. It does not prescribe a specific assessment methodology, scoring model, or list of systems that must be designated as high impact. Each university should make determinations based on its mission, operating environment, dependencies, and risk tolerance. 

A. Definition 

i. High Impact System 

    1. A system that is identified as instrumental to continued business operations, including administrative, research, and academic missions. This includes systems that, if made unavailable or compromised, would cause a major disruption to daily operations or would be significantly expensive to restore, as well as systems with data that, if compromised, would cause significant financial or reputational harm. 

  2. II. Applying the Definition

    1. A system may be considered high impact because of the operational functions it supports, the information it stores or processes, the consequences of its compromise, or a combination of these factors. 

Universities should apply the definition using informed judgment rather than relying exclusively on system size, cost, ownership, or data classification. A system does not need to meet every consideration described below to be designated as high impact. In some circumstances, a single significant consequence may be sufficient. 

B. Mission and Operational Importance 

Consider the degree to which the system supports functions necessary for the university to continue operating or fulfill its core mission. Relevant considerations may include whether the system: 

  • Supports essential academic, administrative, research, health, safety, or public service functions. 
  • Is required to deliver instruction, provide student services, process financial transactions, administer payroll, maintain critical infrastructure, or support emergency operations. 
  • Is relied upon by a substantial portion of the university or by multiple universities. 
  • Supports a time-sensitive function for which a prolonged interruption would create significant operational consequences. 
  • Has no practical manual workaround or alternative service. 

The importance of a system may vary throughout the year. For example, a system may have greater operational significance during registration, financial aid processing, payroll, admissions, or other critical periods. 

C. Consequences of Unavailability 

Consider the potential effect if the system were unavailable, corrupted, or otherwise unable to perform its intended function. A system may warrant a high-impact designation when an outage could: 

  • Cause a major disruption to university operations or academic activities. 
  • Prevent the university from delivering essential or time-sensitive services. 
  • Create significant health, safety, legal, regulatory, or contractual consequences. 
  • Affect a large number of students, employees, research participants, patients, or other constituents. 
  • Require substantial time, cost, or specialized expertise to restore. 
  • Result in the permanent loss of information or business capability that cannot be readily recreated. 

The determination should consider the anticipated severity and duration of the disruption, not simply whether an outage would be inconvenient. 

D. Consequences of Compromise 

A system may also be high impact when unauthorized access, manipulation, disclosure, or destruction could cause significant harm. Relevant considerations may include whether compromise could: 

  • Expose a substantial volume of High Risk Data. 
  • Results in significant financial loss, fraud, identity theft, or misuse of university resources. 
  • Materially affect the integrity of academic, financial, research, personnel, health, or university records. 
  • Enable unauthorized access to other important systems or infrastructure. 
  • Create substantial legal, regulatory, contractual, or notification obligations. 
  • Cause significant and sustained reputational harm or loss of public trust. 

Data classification is an important consideration, but it should not be the sole factor. A system containing relatively limited sensitive information may still be high impact because of its operational role, privileged access, integrations, or ability to affect other systems. 

E. Dependencies and University Reach 

Universities should consider the broader environment in which a system operates. A supporting service may be high impact even when it is not directly visible to most users. 

Examples may include identity and access management services, network infrastructure, security services, integration platforms, enterprise data repositories, cloud administration environments, or systems that provide foundational services to multiple applications. 

Consider whether the system: 

  • Provides a shared or foundational service on which other important systems depend. 
  • Has privileged access to university infrastructure, accounts, or information. 
  • Connects to multiple systems or facilitates the exchange of significant university data. 
  • Creates a concentration of risk because a single failure or compromise could affect numerous services. 
  • Supports multiple departments, universities, or external partners. 

A system should therefore be evaluated in the context of its dependencies and potential cascading effects, rather than as an isolated technology. 

F. Additional Considerations 

A high-impact designation should reflect the consequences of system failure or compromise, not the perceived likelihood that an incident will occur. A well-secured or highly resilient system may still be high impact because of the importance of the function it performs. 

Similarly, the following factors do not automatically determine whether a system is high impact: 

  • Whether the system is hosted on-premises or by a third party. 
  • Whether the system is centrally managed or departmentally managed. 
  • Whether the system was developed internally or purchased commercially. 
  • The financial cost of the system itself. 
  • The number of users, considered in isolation. 
  • The presence or absence of a particular data classification. 

Third-party and cloud-hosted systems should be evaluated using the same impact considerations as university-operated systems. 

G. Documenting and Reviewing Determinations 

Universities should maintain sufficient documentation to explain why a system was designated as high impact or if the classification has changed. Documentation may be brief but should identify the primary operational, data, financial, reputational, safety, or dependency considerations supporting the determination. 

Determinations should involve appropriate business, technology, security, data, continuity, and risk stakeholders. System owners and business process owners are generally best positioned to describe the operational consequences of an outage, while information security, privacy, continuity, and technology personnel can help evaluate data exposure, dependencies, recovery challenges, and broader university effects. 

High-impact designations should be reviewed periodically and when significant changes occur, such as: 

  • A substantial change in system functionality or university use. 
  • The introduction of new data types or integrations. 
  • Expansion to additional departments or universities. 
  • Changes in hosting, architecture, or administrative access. 
  • Identification of new operational dependencies. 
  • Major changes to legal, regulatory, or contractual obligations. 

The objective is not to classify every important system as high impact. Rather, universities should identify the systems for which disruption or compromise would create consequences significant enough to warrant elevated attention, protection, resilience, and oversight. 

6. Contact 

For questions or clarification regarding this guidance, contact: 

Universities of Wisconsin Administration Office of Information Security
informationsecurity@lists.wisconsin.edu 

7. Guidance History 

Original Issuance: September 29, 2026 

8. Scheduled Review 

September 2031