Web Infrastructure and Marketing

Scope

This policy pertains to all public facing Indiana University School of Medicine (IUSM) web sites.

Back to top

Policy Statement

Indiana University School of Medicine websites and digital properties are owned by the Trustees of Indiana University and governed by the Office of the Vice President for Communications and Marketing (VPCM). VPCM works in partnership with IUSM Communications and IUSM Data Services to ensure that websites reflect the University brand and are compliant, accessible as determined by the U.S. Office of Civil Rights and are aligned with the University’s strategic priorities.

Content Management System

To ensure unified branding, compliance, security, support and business continuity across all IUSM web properties, the following standards are in place:

• All IUSM Dean’s Office units, campuses, departments, divisions, institutes, centers, programs, or core-dedicated websites must be built and maintained in Sitecore, the school’s enterprise web content management system (CMS).
• Use of Sitecore applies to any web property within the medicine.iu.edu subdomain, and whose content is primarily static, and which exists for informational or marketing purposes.
• IUSM Data Services governs all Sitecore installations within the School in strategic partnership with IUSM Communications.
• Only Data Services can assign web roles or remove user access as needed to ensure University policies, federal and state laws.
  • Access to the Sitecore content management system is requested by contacting IU School of Medicine Data Services (For Data Services Support, Email HTSHelp@iu.edu.
  • Include “For IUSM Data Services” in the Subject Line) or the Office of Strategic Communications. (Email medicine@iu.edu. Include “Website Request” in the Subject Line)
• IUSM Communications is the final authority within IUSM to ensure Web Content Accessibility Guidelines (WCAG) 2.1 AA level, web standards, and IUSM and University brand guidelines are followed.
• IUSM Communications is the final authority within IUSM for granting exceptions to the above policy statements (e.g., entities seeking to create or maintain a website where funding is primarily external or the service can only be administered via different hosting or a specific content management system). See also “URL Naming Structure” below. Filing an exception request does not guarantee an approval will be granted.
• Websites housed within the University’s Sitekube server and utilizing the University’s web content management system (WCMS) Cascade will not be supported by Data Services. Support for these websites should be coordinated through UITS. If UITS sends the support request back to IUSM Data Services, then that will automatically trigger the process to redo and migrate the website into Sitecore.
• Any IU School of Medicine application or transactional system not intended for marketing, and that is critical to school infrastructure or may contain protected information, must be hosted in secure, approved environments. Units can coordinate with IU School of Medicine Data Services to identify the best alternative environment for hosting and managing these resources.

Hosting

All IUSM web content that is built in the Sitecore CMS is hosted in Microsoft Azure. Azure provides users with enterprise-grade security, leveraging Azure’s cloud protections and redundancies, regular security updates, and robust authentication (including IU Login, SSO, and multi-factor authentication).

URL Naming Structure

In coordination with University Communications and Marketing (UCM) and University Information Technology Services (UITS), the IU School of Medicine is responsible for the creation of all URLs associated with the IU School of Medicine. This includes but is not limited to subfolders or subdomains on medicine.iu.edu, vanity URLs, and short URLs or redirects.

• All official IU School of Medicine units must use the medicine.iu.edu subdomain for web content.
• Subfolders of medicine.iu.edu are required for all official units (e.g. medicine.iu.edu/surgery).
• In the case of multi-institutional research collaborations, where funding is primarily external or the service can only be administered via different hosting or a specific content management system, a subdomain or other top-level domain may be approved for use by IUSM Data Services.
• All requests for domains are reviewed for adherence to the University’s strategic priorities and are subject to revision or denial. (Consolidated Websites Approval Form)
• In the case of vanity top-level domains (.com, .org, etc.) domain names should not be requested or registered via third-party service providers without prior notification and approval from both IUSM Communications and IUSM Data Services. Failure to get prior approval may result in the registered domain being modified or decommissioned.
• Indiana University and IUSM reserve the right to reclaim, reassign or decommission any medicine.iu.edu subfolder or subdomain whenever necessary to support University- or School-level branding and strategic priorities.

Site Stewardship and Attestation

• Web properties not contained within the iu.edu web structure are required to assign a responsible party designated as the website steward.
• Website stewards are required to complete an annual attestation including, but not limited to, their responsibility for ensuring all contributors operate in compliance with this and any applicable University policies.
• Individuals creating websites are responsible for keeping university website inventory records accurate, including assigned stewardship.

Web Design and User Interface

IUSM Communications is responsible for curating the IU School of Medicine’s visual identity as it is presented via the web. The following standards are in place to ensure this responsibility:

• IUSM utilizes the University’s Rivet design system. Rivet is intended to provide common markup, layouts, components, styles and design guidelines for digital products built with or hosted by the University. This helps to ensure users have a more consistent experience across all digital properties, including websites, apps, email and digital signs.
• All IU School of Medicine entities contained within medicine.iu.edu must utilize the Rivet design system for their content.
• In cases where flexibility is required, flexibility is built into the overall system to allow for variation, but certain elements must persist to reinforce usability, patterned browsing and best practices.
• Development of new components or design aspects of the overall digital brand must be coordinated and approved by IUSM Communications and IUSM Data Services before being deployed.
• In the case where multi-institutional research collaborations are led by IUSM faculty and therefore may benefit from a neutral, non-branded web presence, limited exceptions may be granted. These exceptions must be approved in advance by the Dean of the IU School of Medicine and IUSM Communications in coordination with UCM.

Analytics and Tag Management

Indiana University provides website performance reporting via an enterprise-wide ("Global") installation of Google Analytics (GA) via the IU Global Google Tag Manager (GTM). All IU School of Medicine websites will report usage data via the Global GA installation. At no time and under no circumstances should a vendor or non-IU entity be allowed to install custom GA code to IU School of Medicine websites. 

Site stewards may request custom GTMs from UCM or the IU School of Medicine for the purpose of additional analytics tracking or custom tags for marketing purposes on a site-by-site basis. All such requests must be coordinated through the Office of Strategic Communication in coordination with UCM.

Outsourcing Digital Marketing

A consistent application of branding and digital strategy is vital to protect the University and the School of Medicine’s reputation, and to ensure adherence to best practices and any applicable state and federal laws. To ensure this alignment, all IUSM related requests for digital services procured through Buy.IU will be flagged and sent to IUSM Communications for approval. Coordination with IUSM Strategic Communications and UCM prior to any contract negotiations can help expedite this approval process.

Individual units (e.g. departments, offices, programs, centers, etc.) may not contract directly with any digital marketing agency to complete any work without prior written consent from IUSM Strategic Communications and UCM.

Hiring of Web Developers

Web developer support for IUSM content management system (Sitecore) is provided by IUSM Data Services in coordination with our agency of record, Paragon Consulting Inc.

• All developers working within Sitecore are certified to work within the platform and partner with the Office of Strategic Communications to ensure alignment with University and IU School of Medicine best practices and priorities.
• Units within IUSM may not hire individual developers to solely support initiatives within their units.
• All hiring of developers or contracting of third-party web development support must be approved by IUSM Data Services in coordination with UITS and VPCM leadership. This is to help reduce redundancy and waste, and to ensure that all applicable security, accessibility, branding and search engine optimization best practices are being enforced.

Content

Information housed within the official IUSM website (medicine.iu.edu) will be kept up to date. It is the responsibility of each unit to identify a web lead within their area to facilitate updates.

• This individual will be responsible for ensuring that the information contained therein is of the highest editorial standards (spelling, punctuation, grammar, style, etc.) and is factually accurate.
• Once identified, web leads will be provided access and will be trained on Sitecore to be able to make updates and submit them to the Office of Strategic Communications for review before publishing.

Images, Fonts, and Other Licensed Materials

All images, fonts, and other licensed materials must comply with federal laws, state laws, and University policies. Images and fonts must be original content, considered public domain, or be purchased with appropriate licensing.

Files and Documents

All files, such as PDFs, Word documents, etc. are subject to accessibility requirements as outlined by the university’s ADA policy. This includes files hosted on IUSM servers as well as any external content being linked or referenced.

Brand Alignment

All IUSM websites must align with the Indiana University brand, as outlined in Indiana University’s Marketing and Communications Policy. IUSM Communications works closely with UCM regarding enforcement of or any exceptions to this requirement.

Clinical Care & Patient Marketing

Webpages or sites with a primary purpose of marketing to prospective patients or providing information to prospective or current patients should not utilize IUSM hosting or resources for web content. If the primary audience for a webpage is prospective or current patients, content should be coordinated through IU Health and housed on the iuhealth.org domain or the appropriate partner hospital website. Links back to the IUSM website should be utilized where appropriate to reference relevant educational or research related content.

Lifecycle Management

Websites no longer needed must be decommissioned promptly. Sites with any of the following are subject to review and potential removal: no validated purpose, minimal traffic, out of date content or no site steward on record.

Back to top

Reason for Policy

The IU School of Medicine Office of Strategic Communications (“IUSM Communications”), in partnership with IU School of Medicine Data Services (“IUSM Data Services”), is charged with maintaining a consistent, secure and accessible online presence throughout a rapidly growing network of IUSM initiatives.

This policy is intended to:

• Create a more comprehensive, centralized understanding of IUSM through its online presence.
• Ensure that the visual identity and name are correctly and consistently portrayed.
• Ensure all public facing IUSM associated websites comply with current University and federal guidelines for security and accessibility.

Avoid any unnecessary costs incurred by outsourcing web development projects to third-party vendors.

Back to top

Definitions

website / web property – A collection of web pages, documents or content available on the internet intended to communicate information to a specific audience.

content management system (CMS) - Software that allows users to create, manage, edit, and publish digital content on the web without extensive coding knowledge. The software utilized by the IU School of Medicine is Sitecore.

hosting – A service or the act of providing storage for a website's files on a server, making them accessible on the internet.  The service utilized by the IU School of Medicine is Microsoft Azure.

site steward - An individual responsible for a specific university website. They might not be involved in the day-to-day management of the website, but they are the responsible party. This responsibility includes but is not limited to decisions regarding security, accessibility and content.

web lead – An individual designated by the site steward to manage the day-to-day upkeep of the website. This person will be trained on Sitecore and, at minimum, is responsible for ensuring editorial standards are followed and information is factually accurate.

domain name system (DNS) – A hierarchical and distributed system that translates human-friendly domain names, like “medicine.iu.edu” into computer-friendly addresses. It acts as the "phonebook of the Internet," making it possible to navigate websites and online services without having to memorize complex numerical addresses. 

Back to top

Sanctions

The IU School of Medicine web presence is actively monitored. In coordination with UITS and UCM, the IU School of Medicine works to ensure all web properties are in alignment with the University’s strategic priorities and digital strategy.

Site stewards found to be in violation of University policy will receive notification to remedy the issue. If the issue is not remedied in a timely manner, websites or pages found to be in violation of this policy, or any Indiana University policy or guideline, shall be subject to immediate removal. The university will take immediate action to remediate sites that violate university policy or federal, state, or local laws. These actions include but are not limited to revoking CMS access, revoking server access, and removing the domain name system (DNS) entry.

Incident Response Plan

If a website is involved in a security incident, IUSM Communications and IUSM Data Services will coordinate containment, investigation, and communication with UITS and the University Information Security Office (UISO). All affected website stewards must comply with UITS requirements and participate in post-incident reviews.

Back to top

Additional Contacts

Back to top

Forms

Website Directory and Site Stewards

CMS Requirement Exception Form

Consolidated Websites Approval Form

Back to top

History

1. as-as-0009, 23 September 2025, first draft of policy.
2. Policy reviewed and approved on 11 November 2025.
3. Policy re-reviewed and updated on 10 December 2025.
4. Policy published on 12 December 2025.

Back to top