Educause '23: Colleges Understaffed for IT Privacy Issues

While many colleges and universities have increased investments in cybersecurity staffing, many still lack personnel solely dedicated to privacy issues, according to a recent Educause survey examining IT workforce issues in higher education.

According to Nicole Muscanell, an Educause researcher who spoke Wednesday at the annual Educause conference, the survey consulted 350 administrators and IT staff from several higher-ed institutions, many of whom noted that the two roles often go hand in hand. She said that many cybersecurity and privacy professionals reported "excessive" workloads, causing institutions to be more reactive about cybersecurity and privacy issues.

“A majority of our respondents said that cybersecurity issues fall within their area of responsibility, with the top one being 37 percent of respondents saying they work on both cybersecurity and privacy issues,” she said. “Over half of our sample, 52 percent, are saying that they work primarily on cybersecurity issues but not privacy issues. And then we see fewer respondents, about 11 percent, saying they actually focus primarily on privacy issues.”
Muscanell said that many institutions simply do not have the budgets for separate positions dedicated to privacy, and this problem is often compounded by the fact that cybersecurity and privacy professionals find better pay and benefits in the private sector and outside of education.

“For institutions that were doctoral institutions and also had larger enrollment, those were the institutions that had more positions budgeted for the current fiscal year,” she said. “Sixty percent of our respondents said their institution does not currently have a role dedicated to privacy.”

She said in the last 12 months, a “significant number” of respondents reported overall increases in budgets for cybersecurity positions and privacy positions, with most of that being dedicated to cybersecurity positions. She said several respondents said privacy positions have not seen budget increases, and in many cases the effects of those increases were moderated by inflation.

“Those reporting a decrease in budget reported things like projects being postponed … and because of that, an increase in risks and security incidents,” she said, adding that those with increased budgets were able to expand and improve existing services and better handle staffing issues. “The really telling thing is that even for those reporting budget increases, many of those respondents also said there are still a lot of challenges, even though we have a lot of money.”

Muscanell said Educause will release a full report on the survey in November.