91°µÍø

Purpose

To provide 91°µÍø with guidance in developing and implementing the appropriate protective safeguards to ensure the confidentiality, integrity, and availability of 91°µÍø assets and information.

Policy

91°µÍø’s information, data, and records are managed in a manner consistent with 91°µÍø’s risk strategy to protect the confidentiality, integrity, and availability of the assets. Data security controls are submitted to 91°µÍø senior leadership for review and approval, and include a cost-benefit analysis to inform the executive staff in their risk strategy decisions.

Summary

• Data security controls are submitted to 91°µÍø senior leadership for review and approval
• Data security controls will include a cost-benefit analysis to inform the executive staff in their risk strategy decisions
• 91°µÍø employs cryptographic controls in accordance with applicable Federal and State laws, regulations and standards
• 91°µÍø system that requires protection includes but is not limited to configuration settings, intrusion detection and prevention, various logs and password databases
• 91°µÍø protects the confidentiality and integrity of sensitive data by using cryptographic mechanisms
• 91°µÍø applies full disk encryption to all 91°µÍø-owned laptops, mobile devices and desktop workstations
• Backups are encrypted (at rest)
• 91°µÍø recommends that students enable full disk encryption on their personal devices
• All transportable media is also encrypted
• Papers containing confidential information must not be left out in public view and must be properly destroyed when no longer needed
• 91°µÍø hardware and software assets are documented, tracked, and managed through inventory management
• Faculty and staff status is tracked and managed by Human Resources and the Dean of the College
• Student documentation is managed by Admissions, Registrar’s Office, the Dean of Students and the Advancement Office depending upon student status
• Prior to disposal, sanitization techniques are applied to media
• 91°µÍø ensures that there is adequate capacity to provide availability of its systems
• 91°µÍø employs reasonable and appropriate methods for data loss prevention

Data Security Policy Details [pdf]