Minnesota State Board Policy 5.23 Security & Privacy of Information Resources Procedure 5.23.2 & Operating Instructions 5.23.2.1 Data Security Classification Data Definition Highly Restricted Data Elements Security (This is an Exhaustive List) Classification Institutional data must be Social security numbers Highly classified as "highly restricted" if Credit/payment card numbers and related Restricted the data requires limiting access information to only persons with a legitimate Financial account numbers such as need to know, and: banking or investment account numbers the data elements for which Security or access codes or passwords loss of confidentiality is used to access highly restricted data sufficient to assume a Personal health/medical information person’s identity in including insurance policy ID numbers financial transactions; or and any information covered under by law, regulation, or HIPAA contract, the data requires Non-public investigation data high-level security (determined by legal counsel) controls, or Credentials for IT systems that manage the loss of confidentiality data elements in this classification level could cause significant Biometric information personal or institutional Trade secret or intellectual property harm. protected by a non-disclosure agreement Data Definition Restricted Data Elements Security (Not an Exhaustive List) Classification Institutional data must be Student records admission – Restricted classified as if it applications, transcripts, exam papers, “restricted” does not classify as test scores, evaluations, grades, student “highly restricted” but the data: discipline, student class schedule, by law is not public data, or student worker information, financial requires limiting access to aid, and loan collection records only persons with a Student directory information that has legitimate need to know, or been suppressed by the student whose unauthorized Student lists disclosure will require College, university, system office, or statutory notification to faculty trade secret or intellectual affected parties (i.e., breach property notification). Library use information
Minnesota State Board Policy 5.23 Security & Privacy of Information Resources Procedure 5.23.2 & Operating Instructions 5.23.2.1 Data Security Classification Data Security Classification Definition Highly Restricted Data Elements (This is an Exhaustive List) Highly Restricted Institutional data must be classified as "highly restricted" if the data requires limiting access to only persons with a legitimate need to know, and: the data elements for which loss of confidentiality is sufficient to assume a person’s identity in financial transactions; or by law, regulation, or contract, the data requires high-level security controls, or the loss of confidentiality could cause significant personal or institutional harm. Social security numbers Credit/payment card numbers and related information Financial account numbers such as banking or investment account numbers Security or access codes or passwords used to access highly restricted data Personal health/medical information including insurance policy ID numbers and any information covered under HIPAA Non-public investigation data (determined by legal counsel) Credentials for IT systems that manage data elements in this classification level Biometric information Trade secret or intellectual property protected by a non-disclosure agreement Data Security Classification Definition Restricted Data Elements (Not an Exhaustive List) Restricted Institutional data must be classified as “restricted” if it does not classify as “highly restricted” but the data: by law is not public data, or requires limiting access to only persons with a legitimate need to know, or whose unauthorized disclosure will require statutory notification to affected parties (i.e., breach notification). Student records – admission applications, transcripts, exam papers, test scores, evaluations, grades, student discipline, student class schedule, student worker information, financial aid, and loan collection records Student directory information that has been suppressed by the student Student lists College, university, system office, or faculty trade secret or intellectual property Library use information
data-security-classification-table.docx