Legacy systems within higher education institutions are prime targets for cybercriminals due to the immense volumes of sensitive data they house on people, organizations, and finances. But despite their longstanding tenure as “stable” technologies, many ERP and SIS platforms are categorized as risk infrastructure because they rely on staff memory, customizations, and undocumented processes. For many institutions, this observation is enough to push them to SaaS solutions—but moving to the cloud without tackling the source of risk issues may not solve the underlying problems.
Software-as-a-service (SaaS) platforms often support stronger cybersecurity tactics, but they do not automatically reduce risk—especially if institutions move too quickly or without clear strategic alignment. The truth is that SaaS ERP and SIS platforms have become the dominant direction in higher education not simply because of technical capabilities, but because they offer a structured way to align responsibility with institutional capacity.
Let’s explore how to reframe the approach to SaaS ERP and SIS: Instead of quickly moving to the cloud out of fear from cyberthreats, institutions must first address risk ownership, clarify accountability, and align leadership expectations. Done well, this reframing enables institutions to modernize with confidence, execute a sustainable approach, and develop a better partnership with your preferred vendor.
Choose the Right Operating Model Over Software
Ownership is vital when assessing higher education technology, but ownership can vary between different operating models. While one vendor’s solution may outweigh the capabilities of another platform, the system’s operating model is equally important, as this may be the deciding factor for who carries responsibility when something goes wrong. Without clear, established accountability, even the most modern systems can invite risk.
While there are some generic distinctions between self-hosted, hosted, and SaaS operating models, institutions must work with their vendor to understand how responsibilities for uptime, security, patching, compliance, and recovery are allocated. With a better understanding of the operating model and its limits, institutions can better assign responsibilities and will likely minimize the chance of unintentionally shifting risk back on them in the case of a problem.
Accountability Should Never Be an Assumption
When colleges and universities move to the cloud with unclear expectations, immature governance strategies, or assumptions over responsibilities, they are more likely to encounter poor experiences that negatively impact their expectation of the cloud. Instead of framing SaaS as a loss of control, institutions should look at moving to a SaaS environment as an opportunity to formalize responsibility—internally and externally.
When working with a technology vendor, institutional decision-makers need to understand—clearly—the breakdowns of a shared responsibility model. “Who owns what risk? Are those responsibilities realistic for my institution?”
Importantly, these conversations about accountability need to be contractual, not assumed. Contractual accountability changes institutional risk exposure and enables staff to build more resilient frameworks that clearly articulate role breakdowns, responsibilities, and repercussions.
Keep Leadership In the Loop
Sustainable ERP and SIS outcomes depend on shared understanding across executive leadership. Rather than pulling leadership into conversations about vendors during the system migration, change-makers should get buy-in early to mitigate challenges associated with risk, costs, and accountability down the line.
Presidents, CFOs, CIOs, and boards should have input on acceptable risk tradeoffs. This can help with establishing decision principles even before vendors, products, or roadmaps are brought into the conversation. With these guiding principles in mind, stakeholders can better identify options that will work for their institution without raising the alarm with leadership later. Early executive buy-in will also create a durable foundation that can withstand opposition or budget cycles in the future.
Successful SaaS ERP or SIS modernizations are not necessarily the ones that move the fastest—they are the ones that are carefully deliberated and methodically executed. Any technology change will likely introduce new risk—but that comes with the territory of evolution. By addressing concerns on ownership, accountability, and leadership buy-in early on, institutions will more likely encounter success and mitigate risk down the road.
Institutions may also take a more sustainable approach to long-term modernization by building and maintaining a close relationship with their trusted technology partners. An experienced partner like Jenzabar can guide institutions through the process and transition of modernization—helping to identify the best path forward, providing enhanced security to minimize risk, and aligning with internal expectations.
