Name policies and procedures that would enable universities to limit vulnerabilities while still allowing students access to systems. Ultimately, who should be held accountable for ensuring a sound security policy is in place?