Education

UNC analyzed its risks. Not on the list? Cybersecurity. Here’s why.

Higher Stakes is a weekly newsletter about higher education from The News & Observer and reporter Jane Winik Sartwell.
Higher Stakes is a weekly newsletter about higher education from The News & Observer and reporter Jane Winik Sartwell. File images; graphic by Rachel Handley
Key Takeaways
Key Takeaways

AI-generated summary reviewed by our newsroom.

Read our AI Policy.


  • Legislature has not yet provided enrollment funding.
  • Board authorized planning for UNC Wilmington medical school.
  • Cybersecurity was absent from UNC’s risk survey a week after the Canvas outage.

Hello reader! Welcome back to Higher Stakes, where we explore what drove the news in higher education this week. I’m your host, Jane Winik Sartwell.

Now that Memorial Day weekend has passed, it’s officially summer vacation. It’s still my absolute favorite time of year, even though I no longer have one. Just because classes are out of session, that doesn’t mean the higher ed news stops.

What happened at UNC System committee meetings this week

Here’s what I noticed at the UNC System Board of Governors committee meetings Wednesday.

  • The legislature still hasn’t provided enrollment funding. That’s the system’s single biggest legislative priority during this session. When describing the long-awaited budget framework to the board, the system’s chief financial officer, Jennifer Haygood, noted that there is nothing in that framework related to enrollment funding. A bill called “UNC Enrollment” hasn’t had any action since April 21.
  • The board authorized planning for a medical school at UNC Wilmington. Now, the school can begin planning to seek accreditation for a Doctor of Medicine program.
  • The system officially joined the Board of Directors for the Commission for Public Higher Education, an accrediting body formed by six public university systems including those of North Carolina and Florida. “The [existing] accreditation bodies have become rather rigid in their methods,” system President Peter Hans said at the meeting. “Which is a big part of the impetus here, to achieve a less expensive, less time-consuming entity for public institutions who are already subject to so many layers of oversight.”
  • The system is working to improve its emergency management protocol. A council is working on coordinating responses to issues like mental health, public safety, natural disasters and cybersecurity.
  • The board heard a presentation on achievement culture from Shun Robertson, senior vice president for strategy and policy. “Our responsibility as a system is to not lower [our] expectations, our responsibility is to pair those high expectations with access and support,” Robertson. “We want to build a culture where students can achieve at a high level without sacrificing their health.”

How UNC-Chapel Hill analyzes its risks, and why the chancellor says it’s not good enough

The way UNC-Chapel Hill analyzes the biggest risks to its mission is not sufficient, according to Chancellor Lee Roberts. As it stands, the university surveys leaders across campus about their biggest concerns.

That results in a list like the one the trustees were presented with at their May meeting, one that included stagnant compensation, the ServiceFirst initiative, federal funding pressure, the development of Carolina North, and the pace of AI advancement.

The Board of Trustees elected not to hear a planned presentation on these risks or adopt them into their strategic plan because many deemed them irrelevant.

“I think it represents more of a gripe list than it does actual risks,” said trustee Marty Kotis.

Case in point? Cybersecurity was absent from the risk list. Just one week after the Canvas hack that left UNC’s data in the hands of hackers.

Cybersecurity “doesn’t appear doesn’t appear anywhere on the survey, but it’s obviously an important risk as we saw last Friday,” Roberts said. “This is an inferior risk management approach — it’s what we’ve been using for some time.”

“You’re going to expect to see in a process like that the things that that affect the survey response respondents on a day-to-day basis: things like working conditions and salary levels and recruitment and retention, that’s entirely to be expected,” he continued. “That’s worthwhile feedback. [But] in the example of cybersecurity, that’s less likely to be captured in a survey like that but remains a significant risk, as we saw with the Canvas outage that affected us and thousands of other schools that are clients of Canvas.”

Roberts says he’s focused on updating the risk assessment methodology, and that this will be the last time the board sees a list like this.

Higher ed headlines from this week

Oh, and just for fun, check out my colleagues’ rankings of North Carolina sweet teas. Also, meet our new breaking news reporter, Faith Wardwell.

Thank you for reading Higher Stakes. See you back here next week.

Jane Winik Sartwell

Not a subscriber? Sign up on our website to receive Higher Stakes in your inbox each week: newsobserver.com/newsletters.

Jane Winik Sartwell
The News & Observer
Jane Winik Sartwell covers higher education for The News & Observer. 
Get unlimited digital access
#ReadLocal

Try 1 month for $1

CLAIM OFFER