Data Classification and Protection Policy
Version 4.0
For Students, Faculty, Staff, Guests, Alumni
Purpose
The purpose of this policy is to ensure that institutional data is classified according to its sensitivity, value, and criticality to the University and that appropriate safeguards are applied throughout the data lifecycle.
Scope
This IT security policy, and all policies referenced herein, shall apply to all members of the University community, including faculty, students, administrators, staff, alumni, authorized guests, delegates, and independent contractors (the "User(s)" or "you") who use, access, or otherwise employ, locally or remotely, the University's IT Resources, whether individually controlled, shared, stand-alone, or networked.
Policy Statement
- All University data must be classified as Fordham Protected Data, Fordham Sensitive Data, or Public Data upon creation or acceptance of ownership by the University. Data Owners must document the classification and review it when the data’s use, sensitivity, or applicable requirements materially change.
- Data classifications must guide the selection and application of security controls for the protection and use of data to ensure:
- The University's statutory, regulatory, legal, contractual, and privacy obligations are met,
- Government and regulatory agency reporting is conducted per any legislative, regulatory, and legal requirements,
- The University's proprietary data is protected as required,
- Data is appropriately available for decision-making as required, and
- Relevant data and information are shared, including with third parties, with safeguards appropriate to the classification.
- If data is jointly created by more than one department, the involved departments must cooperatively classify the data. If they cannot agree, the data must be classified as Fordham Sensitive Data until the Data Owners agree on a classification or authorized University administrators (e.g., area Vice Presidents) determine the classification. Data containing Personally Identifiable Information (PII) or Personal Data must be treated as Fordham Protected Data regardless of departmental disagreement.
- Data Owners must assess risk based on the likelihood and impact of unauthorized access, disclosure, modification, loss, or destruction of the data and must consider applicable regulatory, contractual, and privacy requirements.
- Departments must implement managerial, operational, physical, and technical safeguards for access, usage, storage, transmission, sharing, retention, and disposal of University data, consistent with its classification and applicable University policies.
- Access to Fordham Protected Data and Fordham Sensitive Data must be restricted to authorized individuals with a legitimate University business need and must follow applicable access approval and review processes.
- Fordham Protected Data and Fordham Sensitive Data must not be shared with a third party or transferred to an external service unless applicable University privacy, information security, procurement, contractual, and data transfer reviews and approvals have been completed.
- Fordham Protected Data and Fordham Sensitive Data must be retained and securely disposed of according to applicable University records retention requirements, legal holds, and approved disposal procedures.
- When data from different classifications are combined, the combined dataset must be protected at the highest level of data classification in that dataset.
- Suspected unauthorized disclosure, loss, or misuse of Fordham Protected Data or Fordham Sensitive Data must be reported promptly through the University’s established incident reporting process.
Definitions
Data Classification, in the context of information security, is the categorization of data according to its sensitivity and the potential impact on the University or individuals if the data is disclosed, altered, lost, or destroyed without authorization.
Data Owner(s) are accountable for determining and maintaining the classification of assigned information and for authorizing its appropriate access, use, sharing, and protection in coordination with the responsible departments.
Fordham Protected Data is any data that contains Personally Identifiable Information (PII) or Personal Data concerning any individual. Fordham Protected data includes data regulated by local, state, Federal, the European Union (EU), or other statutes/agreements. These regulations may include, but are not limited to:
- Family Educational Rights and Privacy Act (FERPA)
- Gramm-Leach-Bliley Act (GLBA)
- Health Insurance Portability and Accountability Act (HIPAA)
- Payment Card Industry Data Security Standards (PCI-DSS)
- General Data Protection Regulation (GDPR)
- Stop Hacks and Improve Electronic Data Security Act (SHIELD)
Fordham Protected Data may also include information covered by voluntary industry standards or University-adopted practices that require enhanced protection.
Fordham Sensitive Data is based on departmental/internal standard operating procedures (e.g., budgets, payroll, or properties that Fordham may be interested in purchasing).
IT Resources include computing, networking, communications, applications, telecommunications systems, infrastructure, hardware, software, data, databases, personnel, procedures, physical facilities, cloud-based vendors, Software as a Service (SaaS) vendors, and related materials and services.
Personal Data is any information relating to a natural person (data subject) that can directly or indirectly identify that person. Examples include a name, an identification number, location data (e.g., mailing address, IP address), an online identifier (e.g., cookies), or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. The GDPR does not apply to data rendered anonymous (i.e., individuals cannot be identified from the data) or pseudonymous (provided that the "key" that enables the re‑identification of individuals is kept separate and secure).
Personally Identifiable Information (PII) is information about an individual maintained by an agency, including any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information, driver's license number or non-driver identification card number, passport number, account number, credit, or debit card number in combination with other identifiable data, biometric information such as a fingerprint, voice print, retina or iris image, or other unique physical representation or digital representation, and username or email address in combination with a password or security question.
Public Data may be disclosed to anyone, regardless of affiliation with the University, without restriction. It is data that does not contain PII or Personal Data concerning any individual and is not Fordham Protected Data or Fordham Sensitive Data.
NIST SP 800-53 Revision 5 Control Alignment
- Access Control: AC-3 Access Enforcement; AC-4 Information Flow Enforcement; AC-6 Least Privilege.
- Media Protection: MP-6 Media Sanitization.
- Risk Assessment: RA-3 Risk Assessment.
- System and Communications Protection: SC-8 Transmission Confidentiality and Integrity; SC-28 Protection of Information at Rest.
- System and Information Integrity: SI-12 Information Management and Retention.
Related Policies and Procedures
- Data Classification Guidelines
- Data Standards Manual
- Family Educational Rights and Privacy Act (FERPA) Policy
- HIPAA (Health Insurance Portability and Accountability Act of 1996)
- Merchant Credit Card Acceptance Policy
- Privacy Policy
- Third-Party Data Transfer Policy
Implementation Information
| Review Frequency | Annual |
|---|---|
| Responsible Person | Senior Director of IT Security and Assurance |
| Approved By | CISO |
| Approval Date | June 12, 2019 |
Revision History
| Version | Date | Description |
|---|---|---|
| 1.1 | 01/15/2016 | Supersedes January 1, 2012 |
| 1.2 | 06/12/2019 | Policy statement update, definition changes |
| 2.0 | 07/15/2020 | Policy name change, policy statement update, purpose statement update, definition changes, added SHIELD Act |
| 2.1 | 07/26/2021 | Updated purpose statement |
| 2.2 | 07/26/2022 | Updated policy statement |
| 2.3 | 05/30/2023 | Updated definitions |
| 3.0 | 08/30/2023 | Updated policy statement, definitions, disclaimer, and links |
| 03/19/2024 | Updated links | |
| 09/04/2024 | Reviewed with no changes | |
| 3.1 | 04/09/2025 | Updated policy statement |
| 3.2 | 05/27/2026 | Updated the policy statement, definitions |
| 4.0 | 11/03/2026 | Substantive updates to data classification responsibilities, definitions, and handling safeguards; updated NIST SP 800-53 Rev. 5 alignment. |
Policy Disclaimer Statement
Deviations from policies, procedures, or guidelines published and approved by Information Security and Assurance (ISA) will only be considered cooperatively between ISA and the requesting entity with sufficient notice to allow for conducting appropriate risk analysis, documentation, review, and notification to authorized University representatives where necessary. Failure to adhere to ISA written policies may be met with University sanctions up to and including dismissal.