9. Information Technology

Purpose

This glossary is a unified reference point for all documentation in the Delaware County Community College ("DCCC") information security program. If a specific document contains a conflicting definition, that definition will supersede the definition found in this document.

Glossary

Accuracy & Misinformation is the practice of fact-checking AI outputs before using them in academic or administrative contexts.

Agent/Agentic AI is a system that can plan, take actions, and pursue goals with a higher degree of autonomy than traditional AI models; unlike chatbots, which only respond to prompts, agentic AI can initiate tasks, use tools or APIs, access external data, and make decisions or execute actions without constant human input.

AI Chatbot is a tool designed to simulate human-like conversations, typically powered by an LLM (e.g., ChatGPT, Claude, or Gemini).

AI Generated Content Detection are tools that identify whether text, images, or media were produced by AI systems; these tools are often unreliable and prone to false positives.

AI Feature is an AI capability embedded in an application, platform, operating system, or device, as distinct from a standalone AI tool. AI features are reviewed and registered separately from the host application.

AI Governance is the framework of policies, procedures, and roles that ensure responsible and compliant AI development and use.

AI Impact Assessment is the assessment required for any High-Risk Use, completed on the College standard form by the requesting department with OIT support, addressing intended use, data inputs, affected populations, alternatives considered, foreseeable harms, and mitigations.

AI Literacy is knowing how to use AI tools safely and smartly, including understanding what AI can and cannot do.

AI Review Committee (AIRC) reviews AI tool requests for ethical use, accessibility, equity, and institutional considerations, reviews exception requests referred to under AI. 9.14.2, and may reclassify or revoke a fast-track approval" with "reviews AI tool requests referred under AI. 9.14.2 for ethical use, accessibility, equity, and institutional considerations and issues a recommendation to the Approving Authority; it may recommend reclassification or revocation of a fast-track approval

AI Tool  Any software, application, service, feature, or integration that uses artificial intelligence and is proposed for or used in College business, whether free or paid, locally installed or cloud-based, stand-alone, or embedded in a larger platform. Includes pilots, trials, and free or freemium versions. Questions about whether a particular technology constitutes an AI tool for the purposes of the AI Policy are directed to the Office of Information Technology.

AI Tool Classification Method is the method set out in Exhibit B of the AI Guidelines (AI. 9.14.1) for assigning a  designation to an AI tool for College staff use and to a course for student use.

AI Tool Instance is a specific account, tenant, or deployment of an AI tool. Approval attaches to the instance, not the product. A tool approved under a College tenant is not approved under a personal account.

AI Tool Register is the authoritative record of AI tools authorized for College use, maintained by the Office of Information Technology, and published on DelaGate. Each entry records at minimum the tool name, vendor legal name and product URL, instance or tenant identifier, business purpose, assigned AI Tool Classification, approved data classifications, and approved integrations. An AI tool in active use that does not appear in the AI Tool Register with an approved status is unauthorized.

Algorithmic Discrimination is when AI models replicate or amplify biases present in training data, resulting in discriminatory outcomes based on race, gender, age, or other characteristics.

API (Application Programming Interface) is a way for different computer programs to communicate with each other, functioning like a bridge that connects two applications.

Approving Authority is the President or the Cabinet member the President designates, who issues the decision on AI tool requests reviewed by the AIRC based on the AIRC's recommendation, and decides appeals of OIT denials under AI. 9.14.2.

Artificial Intelligence (AI)  Software or an application that uses an algorithm or other technology to enable computers or machines to simulate human learning, comprehension, problem solving, decision making, creativity, and autonomy.

The Asset Inventory is a complete inventory of all software, hardware, firmware, data, and cloud assets.

An Asset Owner is DCCC personnel responsible for an asset and maintaining compliance with the information security program, policies, and procedures.

Assets or Information Assets are data of information that belongs to DCCC and the hardware, software, firmware, or physical (i.e., hardcopies) assets that contain or support protecting or operationalizing that data or information.

An Authorized User is any individual granted access to DCCC information systems through DCCC's access provisioning process or through automated enrollment or onboarding procedures, including but not limited to students, employees, contractors, and consultants, whether accessing DCCC-owned systems or third-party platforms contracted by DCCC.

Automated Decision System (ADS) is a system that uses AI or other automated logic to make or assist in decisions that affect individuals or groups.

Autonomy is the degree to which an AI system can operate without human intervention.

Bias is systematic favoritism or prejudice in AI outputs due to biased or incomplete training data.

Bias & Equity is the practice of monitoring AI for biased outputs and ensuring equitable access to AI tools across campus.

Browser-Based AI are AI tools that operate directly within a web browser, often through extensions, plug-ins, or integrated chat panels (e.g., ChatGPT with browsing enabled, Perplexity, or Copilot in Edge), which can access, read, or interact with live web data, including potentially sensitive or internal content.

Business Owner is the College employee named in an approved AI tool request who is accountable for the tool’s ongoing use, for keeping its AI Tool Register entry accurate, and for any conditions attached to the approval.

Closeout Findings are the documented findings a pilot must produce at its conclusion, recording what was evaluated and what the evaluation showed. Participation in a pilot does not authorize continued or expanded use, and any operational deployment, integration, or procurement following a pilot requires full review under AI. 9.14.2.

Common Vulnerabilities and Exposures (“CVE”) is a list of common vulnerabilities that assists with identifying vulnerabilities in the DCCC systems and patch them.

Common Vulnerability Scoring System (“CVSS”) is an industry standard method of scoring vulnerabilities to assist in prioritizing vulnerability remediation.

A Compensating Control is a control that, though not in line with the control required by policy or procedure, addresses the underlying equity of the original control and is approved via formal approval processes.

Confidential Information Leakage is the risk that data input into an LLM may be stored, used for further training, or inadvertently disclosed by the AI or its provider, and may violate data protection laws or College policies.

Connector is a configured link (including API keys, OAuth consent grants, and MCP servers) that gives an AI tool access to data or functions in another system. A user accepting a consent or permission prompt creates a connector and therefore an integration under AI. 9.14.2.

Covered Persons are any individual acting on behalf of the College or using College systems, data, or resources, including employees, students, faculty, contractors, consultants, vendors, volunteers, or trustees.

Courses Requiring AI Tool Use is a course in which use of a specific AI tool is a required element of the curriculum or a stated learning outcome. Such a course is not a pilot of any type; it must be Green Light and is governed by the section of the same name in AI. 9.14.2.

Critical Systems are the systems that manage the most important business functions and/or contain the most important data where disruption would cause catastrophic operational, legal, or regulatory consequences.

Custom Model Development is the development of custom AI models or applications, which carries unique risks, including novel attack vectors and intellectual property considerations.

Data Breach is a Security Incident that results in confirmed unauthorized access, acquisition, disclosure, or loss of sensitive, protected, or confidential data (e.g., PII, PHI, or educational records).

Data Flow Diagram (“DFD”) is a representation of how data moves through DCCC systems based on the network diagram.

Data Owners are the DCCC personnel responsible for certain data within DCCC systems that they receive or generate while filling their job duties.

Data Processing is the use or modification of data.

Data Storage is the maintenance of data on DCCC systems for later use.

Data Transport/Transit is the movement of data within, between, or outside of DCCC systems.

Dataset / Training Data is the collection of examples used to train, validate, or evaluate an AI model.

DCCC Community Members are all members of the College community, including faculty, staff, students, contractors, consultants, vendors, volunteers, trustees, and agents, in both academic and non-academic contexts.

DCCC Mission is the academic and business mission of DCCC that drives its activities and policy structure.

Deepfakes are fake videos or audio created by AI that look or sound real and can be used to make it seem like someone said or did something they never actually did.

Designated Evaluator is an individual named in an approved pilot request who is permitted to use the tool during the pilot. Pilot access is restricted to designated evaluators.

The Development Environment is the environment where new systems, applications, or configurations are built, evaluated, and validated prior to deployment to the Production Environment.

End-of-Life assets are no longer supported by its manufacturer, most notably, where updates or security patches are not released.

Endpoints are Devices that connect to the network (i.e., workstations, mobile phones, Internet of Things (“IoT”) devices) that the network is meant to service.

Enterprise Data Protection describes contractual and technical terms under which a vendor commits that College data is not used for model training, is not shared, and is managed under the College's agreement. It applies only when the tool is used under the College account or tenant covered by that agreement.

Fast Track Review is a full approval granted by OIT without AIRC review, available only where the tool will be used with Public data only, no integration with College systems, storage, identity, or cloud repositories is requested, the vendor terms prohibit use of input or output data for model training or an opt-out has been exercised, the use is not a High-Risk Use, no student-facing or public-facing interface or content is generated, and annual cost does not exceed $5,000. Fast-track approvals are recorded in the AI Tool Register, reported to the AIRC, and may be reclassified or revoked by the Approving Authority on the AIRC's recommendation. A fast-track approval does not extend to any change in data classification, integration, or purpose, and is not a pilot.

Fine-tuning is the process of teaching an AI system to be better at specific tasks by giving it extra training on topics.

Flawed Computer Code is computer code generated by AI that may include errors, vulnerabilities, or malicious libraries; a human expert should review all AI-generated code before use.

Gen AI is the short form of Generative Artificial Intelligence and carries the same meaning.

Generative Adversarial Network (GAN) is a type of machine learning model with two components (a generator and a discriminator) that compete, often used to create realistic images, videos, or other synthetic data.

Generative Artificial Intelligence (Generative AI) includes any machine-based tool designed to consider user questions, prompts, and other inputs (e.g., text, images, videos) to generate a human-like output (e.g., a response to a question, a written document, software code, or a product design), including both standalone offerings such as ChatGPT and Gemini, and offerings embedded in other software, such as Microsoft Copilot.

Hallucination (Fabricated Content) is AI-generated content that appears factual but is entirely made up or inaccurate.

High-Risk Use is a proposed use in which an AI tool or Automated Decision System will inform, score, rank, prioritize, or recommend outcomes affecting individuals in any of the following: admissions, placement, course assignment, or academic standing; financial aid awarding, packaging, verification, or holds; advising, early alert, retention risk, or student outreach prioritization; student conduct, academic integrity, or disciplinary outcomes; hiring, applicant screening, promotion, discipline, termination, compensation, or workload assignment; access to accommodations, benefits, or College services; or public safety, monitoring, or surveillance. Any use involving biometric data, and any use involving Sensitive data as defined in ISP. 9.9, is also High-Risk Use. A High-Risk Use requires a completed AI Impact Assessment in addition to the standard review steps.

Human-in-the-Loop (HITL) is the integration of human oversight into AI processes to ensure ethical use, accuracy, and error correction, including avoiding fully automated actions in other systems based solely on AI outputs.

Human Oversight is the practice of keeping a human decision-maker involved, especially in high-stakes decisions like grading, hiring, or policymaking.

Indirect Injection is an attack method where malicious prompts are hidden in data the AI consumes (e.g., training data or web content) to manipulate the AI's behavior.

Insider Threat is the threat that an authorized user will intentionally or unintentionally misuse access to create risk or harm to the information environment.

Instructional Pilot is an exception-only pilot type in which an AI tool is evaluated within one or more credit-bearing course sections during a single academic term. Because it occurs in a live course it is treated as production use for all purposes under AI. 9.14.2. It may not continue into a subsequent term.

Intellectual Property (IP) Risks is the risk that using copyrighted or proprietary content in AI training or prompts may violate IP rights; ownership of AI-generated outputs may also be uncertain.

Jailbreaking is exploiting or bypassing built-in AI controls or safeguards to make the system perform restricted tasks or access unauthorized data.

Knowledge Cutoff Date is the point in time after which an AI model has no reliable knowledge because it was not trained on newer data.

Large Language Model (LLM) is a type of AI system trained on vast text datasets to understand and generate human language (e.g., GPT-4, Claude, or Meta AI).

Learning Tools Interoperability (LTI) is the standard through which approved AI tools are connected to the College Learning Management System. All approved AI tools used in the LMS must be integrated through LTI and implemented by Online Learning.

Least Functionality is the act of configuring assets to have only the functionality necessary to complete its business function and reduce attack surface.

Libraries (Code) are external software modules used in AI-generated code; sources should always be verified as trusted to avoid malicious injections.

Machine Learning is a way for computers to learn patterns and make decisions by looking at a lot of examples, without being programmed for every single situation.

Model Drift is the degradation of an AI model's performance over time as real-world data changes.

Multifactor Authentication (“MFA”) is an infrastructure that requires two or more authentication methods to confirm the identity of authorized users (i.e., push notifications, text/phone call, biometrics, etc.).

Multimodal AI / Multimodal LLM are AI models that can process and respond to multiple input types, such as text, images, video, or audio.

Natural Language Processing (NLP) is how computers understand and work with human language, which is what allows AI chatbots to communicate with users.

Network Devices are the assets that manage traffic and enforce policy on DCCC information systems.

A Network Diagram is a visual representation of the network components and architecture.

Non-Production Data Pilot is the default pilot type. Evaluation is conducted without production College data.

Office of Information Technology Staff refers to the employees and authorized personnel within the DCCC Office of Information Technology ("OIT"), operating under the direction of the Assistant Vice President of Information Technology, who are responsible for the implementation, operation, and maintenance of DCCC's information technology systems, infrastructure, and security controls.

OS-Integrated AI is an AI feature built into a device operating system that can read content from or act across applications on the device, such as Apple Intelligence, Siri, Gemini on Android, Galaxy AI, and Windows Copilot. OS-Integrated AI is not eligible for Public-Use Registration; OIT maintains its Register entries directly.

Personally Identifiable Information (PII”) is any information that on its own or in combination with other information can be used to determine or trace the data subject’s identity.

Phishing is an attempt to obtain personal information from authorized users, such as log on credentials, or PII, by sending correspondence to an authorized user disguised as a legitimate business concern.

Pilot is a short-term, small-scale, pre-production evaluation of an AI tool intended solely to assess feasibility, performance, accessibility, usability, potential bias, and alignment with College needs. A pilot does not authorize operational use or long-term adoption. A pilot is requested and approved under AI. 9.14.2, is subject to the additional requirements of the AI Pilot Procedures (AI. 9.14.3) and produce documented Closeout Findings.

Plagiarism Detection is software that compares a person's work to other documents to identify text copied without giving credit to the original author.

Plan of Action and Milestone (“POAM”) is a register of action item required to implement information security controls and milestones assigned with completion dates required to execute on those action items.

A Policy is a topic-specific document that enumerates the DCCC behavioral requirement based on organizational objectives and legal and regulatory requirements.

The Principle of Least Privilege is an access provisioning method where users are provided with the least amount of access required to complete their job obligations.

Privacy & Confidentiality is the practice of avoiding entering sensitive student, employee, or research data into AI tools without institutional approval.

A Procedure implements policies and provides guidance for day-to-day activities.

The Production Environment is a live operational environment where DCCC systems and applications serve students, faculty, and staff.

Production Data Pilot is an exception-only pilot type in which production College data is used during evaluation.

Prompt is the input or instruction given to an AI model to produce a desired response.

Prompt-a-thon is a collaborative session to explore generative AI, practice prompting, and learn real-world applications.

Prompt Disclosure is a type of attack where the AI is manipulated to reveal its original instructions or proprietary system prompts.

Prompt Injection is a technique of crafting harmful or manipulative prompts to get the AI to behave in unintended ways, bypass restrictions, or produce undesirable outputs.

Protected Health Information ("PHI") is a Health Insurance Portability and Accountability Act of 1996 ("HIPAA") term defined as "all 'individually identifiable health information' held or transmitted by [DCCC] or its business associate, in any form or media, whether electronic, paper, or oral."

Provisional Authorization is a time-limited authorization of up to 30 days granted by the CIO where an operational need cannot wait for full review, stating the permitted data classification, permitted integration, designated users, and the required path to full review. It is not available for Sensitive data or for a High-Risk Use. Provisional authorizations are recorded in the AI Tool Register with an expiry date, reported to the AIRC, expired automatically, and did not renew. A provisional authorization is not an evaluation and does not substitute for a pilot.

Public / Confidential / Sensitive data are the three data classification levels established by the Asset and Data Management Policy (ISP. 9.9), which determines the conditions under which data may be used with an AI tool. Permitted and prohibited uses by classification are set out in Exhibit C of the AI Guidelines (AI. 9.14.1).

Public-Use Registration is the self-service registration under Step 4B of AI. 9.14.2 by which a Covered Person may register a free or low-cost AI tool for immediate use with Public data only, without OIT screening or AIRC review, subject to the criteria and registrant obligations stated there. A registered tool carries the status Registered and has not been reviewed by OIT or the AIRC.

Remote Connection is a connection to DCCC information systems made through networks not controlled by DCCC.

Remote Workers are authorized users who are approved to work remotely, or access DCCC remotely to fulfill their job responsibilities.

Removable (Storage) Media is a storage device that can be removed from DCCC’s systems while retaining data stored on it.

Responsible AI / Ethical AI is the practice of designing, developing, and deploying AI in alignment with ethical principles, such as fairness, transparency, and respect for human rights.

Retrieval-Augmented Generation (RAG) is the combination of external information retrieval with AI-generated content to improve accuracy and relevance.

Risk is the likelihood a vulnerability will be exploited multiplied by the severity of the impact that exploit would exact on DCCC systems.

Risk Assessment is the evaluation of potential harm or impacts associated with an AI system before deployment.

Role-Based Access Control (“RBAC”) is the implementation of the Principle of Least Privilege where users are assigned roles and roles are associated with a certain level of access.

Separation of Duties is an implementation method where all critical tasks require at least two users to complete to reduce the risk of human error, single points of failure, or malicious activity.

Service Accounts are generic accounts that are used by assigned authorized users to perform a specific task.

Shadow AI is the use of AI tools or systems within an organization without formal approval, oversight, or data protection measures.

System Prompt are predefined instructions or rules that guide an AI model's behavior, often invisible to the end user.

The Test Environment is the environment where software is evaluated prior to release.

Third Party is a person or entity that does not have a direct employment or managerial relationship with DCCC.

Token is the smallest unit of text (word or character fragments) that an AI model uses to process inputs and outputs; "tokenization" is the process of breaking text into these units.

Toxic or Harmful Outputs (Responses) are offensive or harmful outputs produced by AI due to inaccurate or biased training data.

Training Data Disclosure is when an AI model repeats or reveals parts of its training data, potentially violating privacy or intellectual property rights.

Transparency is the practice of disclosing how AI systems work, what data they use, and how decisions are made, enabling users to understand and challenge outcomes.

Utility Programs are software tools that assist in network and application management and often run with heightened privileges.

Virtual Private Network (“VPN”) creates a secure, encrypted remote connection between a computing device or network and DCCC’s information system.

Zero-Trust is the principle that all users, devices, and applications shall be verified and continuously revalidated based elements like location, role, data access, etc., and minimizing implicit trust zones.