CONFIDENTIAL RESTRICTED PUBLIC (highest of security) (moderate level of security) (low of security) Description Data is designated as legally Data which the owner or No expectation for regulated. Data which is owners (Department Heads) privacy or considered confidential or have not decided to publish confidentiality. restrictive. or publicly announce. Data protected by contract obligations. Legal Requirements Protection The protection of this data is The protection of this required/identified by Red at the discretion of the data is at the Flag Rule and/or Department Head or discretion of the Gordon College. Department Head or Gordon College. Reputation to College High High/Medium Low Data Access and Control ethical or other Data is access by Gordon No restrictions. reasons (College Policy) College employees and/or prevent access without non-employees who have a authorization. Data is only business need and were accessed by individuals with approved by the specific approved access. Department Head. Transmission Transmission of Transmission of restricted No protection is Confidential Data will be data through required. ‘Guest’ sent only via an SSL-based wireless and non-Gordon or higher encryption wired or wireless will be method. For example, prohibited. When XYTHOS ticketing/email necessary, or ‘GordonNET’ method. Transmission via Gordon’s wired network will texting, SMS, instant be used. If off campus, messaging or any electronic Gordon Colleges will be system (FTP or TFTP) is used. prohibited. Storage The saving of confidential Data will be stored using No protection is data is prohibited on local NAS1, NAS2 and/or XYTHOS required. hard drives, desktops, drive. If the level of laptops, smartphones or protection is unknown, tablet computers. If these check with the Information devices are approved by the Security Officer before Information Security storing the data. Officer, then approved encryption is required. Storage of credit card information is never allowed on local devices. Data Backup and Documented backup and Documented backup and Documented backup Recovery recovery procedures are recovery procedures are and recovery required by law required. procedures are required.
CONFIDENTIAL (highest of security) RESTRICTED (moderate level of security) PUBLIC (low of security) Description Data is designated as legally regulated. Data which is considered confidential or restrictive. Data which the owner or owners (Department Heads) have not decided to publish or publicly announce. Data protected by contract obligations. No expectation for privacy or confidentiality. Legal Requirements Protection required/identified by Red Flag Rule and/or The protection of this data is at the discretion of the Department Head or Gordon College. The protection of this data is at the discretion of the Department Head or Gordon College. Reputation to College High High/Medium Low Data Access and Control ethical or other reasons (College Policy) prevent access without authorization. Data is only accessed by individuals with specific approved access. Data is access by Gordon College employees and/or non-employees who have a business need and were approved by the Department Head. No restrictions. Transmission Transmission of Confidential Data will be sent only via an SSL-based or higher encryption method. For example, XYTHOS ticketing/email method. Transmission via texting, SMS, instant messaging or any electronic system (FTP or TFTP) is prohibited. Transmission of restricted data through ‘Guest’ wireless and non-Gordon wired or wireless will be prohibited. When necessary, ‘GordonNET’ or Gordon’s wired network will be used. If off campus, Gordon Colleges will be used. No protection is required. Storage The saving of confidential data is prohibited on local hard drives, desktops, laptops, smartphones or tablet computers. If these devices are approved by the Information Security Officer, then approved encryption is required. Storage of credit card information is never allowed on local devices. Data will be stored using NAS1, NAS2 and/or XYTHOS drive. If the level of protection is unknown, check with the Information Security Officer before storing the data. No protection is required. Data Backup and Recovery Documented backup and recovery procedures are required by law Documented backup and recovery procedures are required. Documented backup and recovery procedures are required.
CONFIDENTIALCLASSIFICATIONOFDATA.docx