Information Technology Security Policy

Purpose

The University's policy is to protect the confidentiality, integrity, and availability of IT Resources based on their risk and value while maintaining appropriate accessibility for authorized Users. 

Scope

This IT security policy, and all policies referenced herein, shall apply to all members of the University community, including faculty, students, administrators, staff, alumni, authorized guests, delegates, and independent contractors (the “User(s)” or “you”) who use, access, or otherwise employ, locally or remotely, the University’s IT Resources, whether individually controlled, shared, stand-alone, or networked.

Policy Statement

• In alignment with the University's strategic plan and oversight, the Board of Trustees, the Information Risk Management Board (IRMB), and the Associate Vice President for IT/Chief Information Security Officer (AVP/CISO) are responsible for approving this policy and overseeing its compliance.
• The University must:
  • Integrate information security principles and risk management into University activities and decisions involving IT Resources.
  • Ensure that information security policies, standards, controls, processes, practices, and procedures are documented, implemented, maintained, and reviewed to safeguard IT Resources.
  • Apply a risk-based approach to protecting the confidentiality, integrity, and availability of IT Resources as business needs, threats, and technologies change.
  • Conduct IT security activities effectively, responsibly, and ethically, in compliance with applicable global, federal, state, and local laws and regulations. 

• By upholding confidentiality, integrity, and availability, Information Security and Assurance (ISA) must:
  • Protect IT Resources against unauthorized access, disclosure, modification, and destruction through risk-appropriate safeguards.
  • Ensure IT Resources are available to authorized Users in accordance with business and operational requirements.
  • Maintain an information security program aligned with the University's IT risk posture that implements, assesses, and improves security policies, processes, practices, procedures, guidelines, and technologies to protect IT Resources.
  • Provide information security awareness and training appropriate to Users' responsibilities.
  • Coordinate with the Incident Response Team (IRT) to identify, report, assess, respond to, and document information security incidents and suspected misuse of IT Resources in accordance with University incident response processes.
  • Coordinate with Public Safety, Legal Counsel, and other appropriate University offices, as applicable, in investigations and communications with authorities. 

• The University's Vice Presidents and Deans must support implementation of this policy and applicable security requirements within their departments and schools, including risk mitigation measures approved through University processes.
• Users must safeguard IT Resources, follow applicable University security policies and procedures, and promptly report suspected security incidents through established University reporting channels.
• University offices responsible for IT Resources must identify information security risks and coordinate risk assessment, treatment, and exception decisions through existing University governance processes.
• IT Resources, including externally hosted services and third-party services, are subject to security requirements and appropriate risk review before use and when material changes occur.
• Security controls must be periodically assessed and monitored, and identified deficiencies must be documented, prioritized, and addressed using a risk-based approach.  

Definitions

IT Resources include computing, networking, communications, application, telecommunications systems, infrastructure, hardware, software, data, databases, personnel, procedures, physical facilities, cloud-based vendors, Software as a Service (SaaS) vendors, and related materials and services.

NIST SP 800-53 Rev. 5 Controls

Program Management: PM-1 Information Security Program Plan; PM-9 Risk Management Strategy. 

• Planning: PL-2 System Security and Privacy Plans.
• Risk Assessment: RA-3 Risk Assessment; RA-5 Vulnerability Monitoring and Scanning.
• Assessment, Authorization, and Monitoring: CA-2 Control Assessments; CA-7 Continuous Monitoring.
• Access Control: AC-2 Account Management; AC-3 Access Enforcement; AC-5 Separation of Duties; AC-6 Least Privilege; AC-7 Unsuccessful Logon Attempts; AC-11 Device Lock; AC-12 Session Termination; AC-16 Security and Privacy Attributes.
• Awareness and Training: AT-2 Literacy Training and Awareness.
• Incident Response: IR-4 Incident Handling; IR-6 Incident Reporting.
• System and Information Integrity: SI-2 Flaw Remediation; SI-4 System Monitoring.
• Supply Chain Risk Management: SR-3 Supply Chain Controls and Processes; SR-6 Supplier Assessments and Reviews. 

Related Policies and Procedures

Acceptable Uses of IT Infrastructure and Resources

Implementation Information

 Revision History