account Customer Obtain prior written approval of department Code of Virginia, Breach numbers Information, Policy head after written request of coworker for of personal information 7025 storing debit/credit card numbers for assisting notification. with travel arrangements Standard for the Code of Virginia, identity No third-party storage or transmission Procurement of penalty; restitution; without prior ITSO review and university Information victim assistance. contract Technology Applications Driver’s license Encrypt the data file/database element in Standard for the Code of Virginia, Breach numbers, and storage and in transmission using Procurement of of personal information passport cryptographic methods approved by NIST Information notification. numbers Obtain prior written approval of department Technology head after written request of coworker for Applications Code of Virginia, identity storing passport numbers for assisting with penalty; restitution; travel arrangements victim assistance. No storage or transmission without prior ITSO review and university contract Student data Student The Family Educational Dprmnsms o include personally identifiable (nondirectory or Rights and Privacy Act FERPA data in totality in an email: e.g. no full items marked (FERPA) name in combination with full student ID confidential) number. Maintaining Departments must not list student name and Student's Privacy ID number in the subject line Departments may communicate using either the student ID with the full initials of the student [999999999 (ANW)] or use the full name with the last four of the ID [Alice N. Wonderland (1234)] Departments must not attach spreadsheets or scanned documents with full identifiers or nondirectory information via email. Departments may communicate spreadsheets or scanned documents via a secure link or shared electronic files requiring user authentication Do not store FERPA data on a flash drive. If forwarding items with personally identifiable FERPA data, use a cover sheet directing the recipient to contact you if it is misdirected. Virginia Tech Technology Control Plan Export Virginia Tech Executive 13556 guidelines controlled Technology Control Controlled Unclassified research data Plan Information Department of Defense Instruction 8582.01 Controlled Unclassified Information 32 CFR VT Export and §2002 (As applicable) Federal Acquisition Regulation Sanctions 52.204-21 Basic Safeguarding of Covered Compliance Policy Contractor Information Systems Export Administration Regulations (EAR) 15 OSP Procedure CFR §§730-774 (As applicable) NIST 800-171 Management
account numbers Customer Information, Policy 7025 Standard for the Procurement of Information Technology Applications Code of Virginia, Breach of personal information notification. Code of Virginia, identity penalty; restitution; victim assistance. Obtain prior written approval of department head after written request of coworker for storing debit/credit card numbers for assisting with travel arrangements No third-party storage or transmission without prior ITSO review and university contract Driver’s license numbers, and passport numbers Standard for the Procurement of Information Technology Applications Code of Virginia, Breach of personal information notification. Code of Virginia, identity penalty; restitution; victim assistance. Encrypt the data file/database element in storage and in transmission using cryptographic methods approved by NIST Obtain prior written approval of department head after written request of coworker for storing passport numbers for assisting with travel arrangements No storage or transmission without prior ITSO review and university contract Student data (nondirectory or items marked confidential) Student Maintaining Student's Privacy The Family Educational Rights and Privacy Act (FERPA) Dprmnsms o include personally identifiable FERPA data in totality in an email: e.g. no full name in combination with full student ID number. Departments must not list student name and ID number in the subject line Departments may communicate using either the student ID with the full initials of the student [999999999 (ANW)] or use the full name with the last four of the ID [Alice N. Wonderland (1234)] Departments must not attach spreadsheets or scanned documents with full identifiers or nondirectory information via email. Departments may communicate spreadsheets or scanned documents via a secure link or shared electronic files requiring user authentication Do not store FERPA data on a flash drive. If forwarding items with personally identifiable FERPA data, use a cover sheet directing the recipient to contact you if it is misdirected. Export controlled research data Virginia Tech Technology Control Plan VT Export and Sanctions Compliance Policy OSP Procedure Management Executive 13556 Controlled Unclassified Information Controlled Unclassified Information 32 CFR §2002 Export Administration Regulations (EAR) 15 CFR §§730-774 Virginia Tech Technology Control Plan guidelines Department of Defense Instruction 8582.01 (As applicable) Federal Acquisition Regulation 52.204-21 Basic Safeguarding of Covered Contractor Information Systems (As applicable) NIST 800-171
StandardforHighRiskDigitalDataProtection.docx