Â鶹´«Ã½

Purpose

To provide Â鶹´«Ã½ with guidance in developing and implementing the appropriate protective safeguards to ensure the confidentiality, integrity, and availability of Â鶹´«Ã½ assets and information.

Policy

Â鶹´«Ã½â€™s information, data, and records are managed in a manner consistent with Â鶹´«Ã½â€™s risk strategy to protect the confidentiality, integrity, and availability of the assets. Data security controls are submitted to Â鶹´«Ã½ senior leadership for review and approval, and include a cost-benefit analysis to inform the executive staff in their risk strategy decisions.

Summary

• Data security controls are submitted to Â鶹´«Ã½ senior leadership for review and approval
• Data security controls will include a cost-benefit analysis to inform the executive staff in their risk strategy decisions
• Â鶹´«Ã½ employs cryptographic controls in accordance with applicable Federal and State laws, regulations and standards
• Â鶹´«Ã½ system that requires protection includes but is not limited to configuration settings, intrusion detection and prevention, various logs and password databases
• Â鶹´«Ã½ protects the confidentiality and integrity of sensitive data by using cryptographic mechanisms
• Â鶹´«Ã½ applies full disk encryption to all Â鶹´«Ã½-owned laptops, mobile devices and desktop workstations
• Backups are encrypted (at rest)
• Â鶹´«Ã½ recommends that students enable full disk encryption on their personal devices
• All transportable media is also encrypted
• Papers containing confidential information must not be left out in public view and must be properly destroyed when no longer needed
• Â鶹´«Ã½ hardware and software assets are documented, tracked, and managed through inventory management
• Faculty and staff status is tracked and managed by Human Resources and the Dean of the College
• Student documentation is managed by Admissions, Registrar’s Office, the Dean of Students and the Advancement Office depending upon student status
• Prior to disposal, sanitization techniques are applied to media
• Â鶹´«Ã½ ensures that there is adequate capacity to provide availability of its systems
• Â鶹´«Ã½ employs reasonable and appropriate methods for data loss prevention

Data Security Policy Details [pdf]