Data at Rest Policy

Version 1.0.2

For Students, Faculty, Staff, Guests, Alumni

Purpose

The purpose of this policy is to govern how University data is stored.

Scope

This IT security policy, and all policies referenced herein, shall apply to all members of the University community, including faculty, students, administrators, staff, alumni, authorized guests, delegates, and independent contractors (the “User(s)” or “you”) who use, access, or otherwise employ, locally or remotely, the University’s IT Resources, whether individually controlled, shared, stand-alone, or networked.

Policy Statement

Fordham Protected Data, Fordham Sensitive Data, or Public Data must be stored according to the Data Classification Guidelines.

Related Policies and Procedures

Implementation Information

Review Frequency	Triennial
Responsible Person	Senior Director of IT Security and Assurance
Approved By	CISO
Approval Date	May 22, 2018

Revision History:

Version	Date	Description
1.0	01/23/2017	Initial policy.
1.0.1	02/07/2018	Minor edits are pointing to existing policies and the renamed Acceptable Uses of IT Infrastructure and Resources Policy. There are no substantial changes to this policy.
1.0.2	05/22/2018	Updated disclaimer statement.
	06/09/2020	Periodic review. No changes.
	07/26/2023	Periodic review. No changes.

Policy Disclaimer Statement

Deviations from policies, procedures, or guidelines published and approved by Information Security and Assurance (ISA) will only be considered cooperatively between ISA and the requesting entity with sufficient notice to allow for conducting appropriate risk analysis, documentation, review, and notification to authorized University representatives where necessary. Failure to adhere to ISA written policies may be met with University sanctions up to and including dismissal.