Unrestricted Data Highly Restricted Data Restricted Data Access Protocol Master Access Plan Master Access Plan Master Access Plan If there is an exception it must be approved by the Council Transmission * National Institute of Standards and * NIST- approved encryption is strongly No special controls Protocol Technology (NIST) approved recommended when transmitting encryption is required when transmitting information outside ISU network. information though the network. * Third party (personal) email services are * Third party (personal) email services discouraged for transmitting this are not appropriate for transmitting this information information * Restricted data may be masked instead of encrypted if displaying Storage Protocol Data in this category can only be stored Encryption of restricted information is No special controls strongly recommended if stored in in University servers (no desktop, laptop desktops, laptops, thumb drives, or or cloud environment) unless personal devices such as smart phones and specifically approved by the other PDAs. Level of required protection Stewardship Council. If approved, of restricted information is either pursuant encryption and/or masking would be to ISU policy or procedure (e.g. 9.8.2) or required. at the discretion of the Stewardship Council. If the appropriate level of protection is not known, check with the Stewardship Council before storing restricted information outside of ISU servers. Data Disposal reports; Department of Defense Recycle reports; Wipe/erase media No special controls unless on (DOD) Level Wipe or destruction of equipment electronic media (please reference Procedure 9.8.2) Secondary Use Prohibited As authorized by Business Owner As authorized by – use of the data Business Process other than for the Owner requested purpose. External Data As required by Federal regulations; As required by Federal regulations; Illinois As authorized by Sharing Illinois Open Records Law; FERPA Open Records Law; FERPA regulations, Business Process regulations, and external contracts and and external contracts and agreements Owner agreements Auditing (IT Logins, accesses and changes Logins No special controls Audit Logs) Review Annually or as needed Annually or as needed Annually or as needed
Highly Restricted Data Restricted Data Unrestricted Data Access Protocol Master Access Plan If there is an exception it must be approved by the Council Master Access Plan Master Access Plan Transmission Protocol * National Institute of Standards and Technology (NIST) approved encryption is required when transmitting information though the network. * Third party (personal) email services are not appropriate for transmitting this information * Restricted data may be masked instead of encrypted if displaying * NIST- approved encryption is strongly recommended when transmitting information outside ISU network. * Third party (personal) email services are discouraged for transmitting this information No special controls Storage Protocol Data in this category can only be stored in University servers (no desktop, laptop or cloud environment) unless specifically approved by the Stewardship Council. If approved, encryption and/or masking would be required. Encryption of restricted information is strongly recommended if stored in desktops, laptops, thumb drives, or personal devices such as smart phones and other PDAs. Level of required protection of restricted information is either pursuant to ISU policy or procedure (e.g. 9.8.2) or at the discretion of the Stewardship Council. If the appropriate level of protection is not known, check with the Stewardship Council before storing restricted information outside of ISU servers. No special controls Data Disposal reports; Department of Defense (DOD) Level Wipe or destruction of electronic media Recycle reports; Wipe/erase media No special controls unless on equipment (please reference Procedure 9.8.2) Secondary Use – use of the data other than for the requested purpose. Prohibited As authorized by Business Owner As authorized by Business Process Owner External Data Sharing As required by Federal regulations; Illinois Open Records Law; FERPA regulations, and external contracts and agreements As required by Federal regulations; Illinois Open Records Law; FERPA regulations, and external contracts and agreements As authorized by Business Process Owner Auditing (IT Audit Logs) Logins, accesses and changes Logins No special controls Review Annually or as needed Annually or as needed Annually or as needed
Data%20Classification_June%202012_APPROVED.docx