To classify data and establish minimum standards and guidelines to protect against accidental or intentional damage or loss of data, interruption of CWI business, or the compromise of confidential information.
Applies to all users with access to (a) confidential information through CWI or its affiliates or (b) college information resources, including those used by CWI under license, contract, or other affiliation agreement.
Access: Any personal inspection or review of the confidential information or a copy of the confidential information, or an oral or written account of such information.
Confidential Information: Information identified by applicable laws, regulations, or policies as personal information, individually identifiable health information, education records, personally identifiable information, non-public personal data, confidential personal information, or sensitive scientific or sponsored project information. Confidential information includes but is not limited to any information that identifies or describes an individual such as a social security number, physical description, home address, non-business telephone numbers, ethnicity, gender, signature, passport number, bank account or credit card numbers, expiration dates, security codes, passwords, educational information, medical or employment history, driver’s license number, or date of birth. It also includes electronic data that includes an individual’s first name or first initial and last name in combination with one or more of the following data elements, when either the name or data elements are not encrypted: 1) social security number; 2) driver’s license or state identification card number; 3) student or employee identification number; or 4) credit card number in combination with any required security code, access code, password, or expiration number that would permit access to an individual’s financial account.
Confidential information does not include any information knowingly and voluntarily made publicly available by the owner of such information, such as information voluntarily listed in college or other public directories. Custodian: Member of the CWI community having primary responsibility for gathering, inputting, storing, managing, or disposing of confidential information. One becomes a custodian either by designation or by virtue of having acquired, developed, or created information resources for which no other party has stewardship. For example, for purposes of this policy, librarians have custody of library catalogs and related records, faculty have custody of their research and course materials, students have custody of their own work, and any individual who accepts a credit card number in the course of conducting CWI business is the custodian of that information. The term does not necessarily imply legal ownership.
Data: Information generated in the course of official CWI business. Information that is personal to the operator of a system and stored on a college IT resource as a result of incidental personal use is not considered CWI data.
Disclosure: To permit access to or release, transfer, disseminate, or otherwise communicate any part of information by any means, including but not limited to orally, in writing, or by electronic means to any person or entity.
Incident: A potentially reportable incident that may include, but is not limited to, the following:
Individually Identifiable Health Information: Any information, including demographics, collected from an individual that is created or received by a health care provider, health plan, employer, or health care clearinghouse relating to the past, present or future physical or mental health or condition of an individual and identifies the individual, or information which can reasonably be expected to identify the individual.
Information Resources: Includes information in any form and recorded on any media, and all computer and communications equipment and software.
Information Security Officer (ISO) – The individual or individuals responsible for protecting confidential information in the custody of CWI; the security of the equipment and/or repository where this information is processed and/or maintained and the related privacy rights of college students, faculty and staff concerning this information. An ISO has primary responsibility for oversight of information security, networks and systems, and working in cooperation with IT and Human Resource (HR) to educate the CWI community about security responsibilities.
Information Service Provider (Service Providers): A person or entity, including CWI departments, individuals, and ancillary organizations, that receives, maintains, processes or otherwise is permitted to access confidential information through its provision of services directly to CWI who manages significant information resources and systems for the purpose of making those resources available to others. This includes the Office of Information Technology, the Alumni Association, Registrar, and Financial Aid, as well as other entities that operate at a division, department, or sub-department level.
Information Technology (IT) Resources: An array of products and services that collect, transform, transmit, display, present, and otherwise make data into usable, meaningful and accessible information. IT Resources include but are not limited to: desktop computers, laptops, and tablet PC’s; handheld devices including but not limited to, cell phones; e-mail, voicemail, servers, central computers, and networks; cloud storage systems; network access systems including wireless systems; portable hard drives and databases; computer software; printers and FAX machines and lines; campus, classroom and office audio and visual display devices and switching, camcorders, televisions, physical media; telephone equipment and switches including local and long-distance services; satellite equipment and any other current or future IT resource adopted by CWI as new technologies are developed.
Level One Data: Private information that must be protected by law or industry regulation. This information is considered highly sensitive (“HS”).
Level Two Data: Information that should be protected. This information is considered moderately sensitive (“MS”).
Level Three Data: Publicly available information. This information is considered non-sensitive (“NS”).
Managers: Members of the CWI community who have management or supervisory responsibilities, including deans, department chairs, directors, department heads, group leaders, supervisors and faculty who supervise teaching or research assistants.
Minimum Security Standards (“MSS”): Required configuration standards, maintained by the Office of Information Technology, that increase the security of systems (servers, workstations, mobile devices) and help safeguard CWI’s information technology resources and data.
Protected Health Information (“PHI”): Individually identifiable health information that is maintained in any medium or transmitted or maintained in any other form. PHI excludes individually identifiable health information in education records covered by the Family Educational Rights and Privacy Act (FERPA), and records held by a covered entity in its role as an employer.
User: Anyone who uses CWI’s information resources, even if they have no responsibility for managing the resources. This includes students, faculty, staff, contractors, consultants, and temporary employees.
This policy creates an environment that will help protect all members of the CWI community from information security threats that could compromise privacy, productivity, reputation, or intellectual property rights. CWI recognizes the vital role data and information plays in its educational and research missions, and the importance of taking the necessary steps to protect information in all forms.
Given the large amounts of data and information generated by CWI employees and students, it is important everyone is familiar with the provisions of this policy. As more information is used and shared by students, faculty and staff, both within and outside CWI, an associated effort must be made to protect information resources from threats by establishing responsibilities, guidelines, and practices that will help CWI prevent, deter, detect, respond to and recover from compromises to these resources. All CWI data must be subject to some protective measures. This policy classifies CWI data into categories in order to apply appropriate protective security measures.
Users are responsible for protecting the information resources to which they have access. Their responsibilities cover both computerized and non-computerized information and information technology devices they use or possess, including but not limited to paper, reports, books, film, microfiche, microfilms, recordings, computers, PDAs, disks, jump drives/memory sticks, printers, phones, and fax machines. Users must follow the information security practices set by the ISO, as well as any additional departmental or other applicable information security practices.