...
Finally, personal equipment that is used on NCSA networks will still be monitored and must follow the NCSA Network Security Policy. Personal equipment must never be used to store high risk data for the University.
Data Security
The University has three categories in their Data Classification Policy: High Risk, Confidential, and Public. NCSA staff must follow University policies regarding these classifications and also inform the NCSA Security Office if they are in possession of any high risk data as this will require a data management plan.
University data that lives exclusively on a staff member's laptop, workstation or other device must be backed up regularly or moved to shared service that is backed up, like a wiki or file server. NCSA provides a backup service to all staff and will help to configure its use on their systems.
Only University approved third-party cloud services are allowed for storing high risk or confidential University data (this includes backups that may contain such data). Data must otherwise be encrypted before being put on third-party services such that the cloud provider cannot read the contents of that data . For example, syncing a password manager across a cloud service like Dropbox is allowed, provided that it is always stored encrypted with a password known only to the user of the password manager.
- PolicyPolicy
Information/Data - Follow university policy
- includes printed materials and physical locks
- Notify of high risk or confidential data
- backup important
- encryption on backup & mobile approved third parties like box
- employee exit
- authorizations
- keys
- email lists
- property return
- Authority & Consequences
- revoked accounts, privileges, taken off network, reported to HR
- PA only has authority to speak with the public directly or the DO
- Exceptions process
- Review & update
- References
...