Systems storage media must be securely erased or disposed of 3.4.7 when system function/role Required Required Required Recommended changes including equipment disposal. Storage media must be physically destroyed when system 3.4.8 function/role changes to a lower Required Recommended Recommended N/A classification or at equipment disposal. 3.5. Minimum Standards for Training and Compliance These are the steps necessary to ensure security policy and standard awareness. Data Protection Level Standard Restricted High Moderate Low All system users must be notified of 3.5.1 what protected data exists on a system Required Recommended Recommended N/A and its protection requirements. At least annually all system users must 3.5.2 sign the Required Recommended Recommended N/A Protected Data Confidentiality Agreement. [link pending] 3.6. Minimum Standards for Change Management Standards related to approved changes to systems. Data Protection Level Standard Restricted High Moderate Low System administrators must establish, document and use an 3.6.1 Required Recommended Recommended Recommended approved change control process for system configuration. System changes and patches must be evaluated and tested 3.6.2 Recommended Recommended Recommended Recommended prior to installation in a production environment. 3.7. Minimum Standards for Business Continuity This ensures the availability of university data and information processing systems. Data Protection Level Standard Restricted High Moderate Low System administrators must 3.7.1 establish, document, and follow a Required Recommended Recommended Recommended regular backup schedule.
3.4.7 Systems storage media must be securely erased or disposed of when system function/role changes including equipment disposal. Required Required Required Recommended 3.4.8 Storage media must be physically destroyed when system function/role changes to a lower classification or at equipment disposal. Required Recommended Recommended N/A 3.5. Minimum Standards for Training and Compliance These are the steps necessary to ensure security policy and standard awareness. Standard Data Protection Level Restricted High Moderate Low 3.5.1 All system users must be notified of what protected data exists on a system and its protection requirements. Required Recommended Recommended N/A 3.5.2 At least annually all system users must sign the Protected Data Confidentiality Agreement. [link pending] Required Recommended Recommended N/A 3.6. Minimum Standards for Change Management Standards related to approved changes to systems. Standard Data Protection Level Restricted High Moderate Low 3.6.1 System administrators must establish, document and use an approved change control process for system configuration. Required Recommended Recommended Recommended 3.6.2 System changes and patches must be evaluated and tested prior to installation in a production environment. Recommended Recommended Recommended Recommended 3.7. Minimum Standards for Business Continuity This ensures the availability of university data and information processing systems. Standard Data Protection Level Restricted High Moderate Low 3.7.1 System administrators must establish, document, and follow a regular backup schedule. Required Recommended Recommended Recommended
Minimum%20Security%20Standards%202015-08-01.docx