The University of Memphis

Campus Data Security Policy

POLICIES

In the course of its operations, the University of Memphis collects and maintains restricted data about students, employees, donors, vendors, and others.  This policy governs the use, control, and access to restricted data defined by statute, regulation, contract, license, or definitions within this policy.  The Data Classification document differentiates the types of University data.

University data must be protected against threats such as malicious misuse, unauthorized intrusions, and/or inadvertent compromise.  Activities outsourced to off-campus entities must comply with the same security requirements as in-house activities.  Each University of Memphis department and employee is responsible for the integrity and security of University data used, controlled, or accessed within their area.  This policy establishes parameters for protection of University data, not the medium or application that the data resides in.  This policy aligns with other established policies and procedures for data security in Institutional Research and the University of Memphis Foundation.

Prior to use of restricted University data via laptop computer or other electronic portable data device, employees are responsible for obtaining appropriate protections for such computers or portable devices, or for verifying that such protections are already in place.  The use of unprotected equipment to access or store University data is prohibited, whether or not the equipment is owned or controlled by the University.
        

The Vice President for Information Technology/Chief Information Officer (VP/CIO) is responsible for implementing appropriate data security policies, procedures, and technology standards (i.e. hardware and software) for the University.

Employees, in cooperation with their Local Support Provider (LSP), are responsible for protecting restricted University data to which they have access.  In areas not supported by a LSP, the Information Technology Division (ITD) will work in cooperation with employees to secure University computers.

ITD is responsible for communicating current security standards and procedures to the University community.  These standards and procedures are posted at the IT Security web page. 

Department heads, in cooperation with their LSP and ITD, are responsible for insuring their employees have adequate technical support to understand and implement security standards and procedures.  This responsibility extends to data accessed on University office equipment, as well as personally owned equipment on which restricted University data is stored or manipulated.  Each unit of the University instructs employees about the "safe and protected" storage space for saved University data.  In the event of an audit, each unit of the University would be responsible for providing the location of the unit's "safe and protected" storage.
    

Portable devices include laptops, Personal Digital Assistants (PDA), or any other portable technology hardware.  Media includes technology storage mediums such as CDs, DVDs, magnetic tapes, floppy disks, external hard drives, and universal serial bus (USB) drives, or any other portable data storage media.

In coordination with the Office of Legal Counsel and the Department of Internal Audit, ITD will develop appropriate specific procedures for compliance with this policy and provide education to the University community on the implementation of this policy and such procedures.  Procedures, technology standards, and Best Practices can be found at the IT Security web page.

Restricted and Internal University data must be saved to a University-owned, protected server, except for the rare instances approved by the Information Security Advisory Committee (ISAC).  Data Stewards may request to store data on local machines through the VP/CIO office, and the request will be forwarded to ISAC for approval.  The request acceptance or denial will be noted in the minutes of the ISAC meeting following the request.  Access to saved and stored University data while on campus must be through the University network.

If ISAC grants permission for University data to be saved and stored on a University-owned destop or laptop or a personal computer, faculty and staff are personally responsible for encrypting the data with the current ITD standard and for remembering their password.
Employees are responsible for insuring that appropriate security controls in accordance with published University standards are installed on their office and personal/home computers or any portable devices or media on which restricted University data is stored or accessed.

Restricted University data must be protected against physical theft or loss, electronic invasion, or unintentional exposure through a variety of personal and technical means.

All University computers must have recommended operating system patches and updates installed, updated antivirus and antispyware tools installed, and firewalls turned on.  Personal passwords are established and secured by employees.  Passwords are not to be disclosed or shared.

ITD is responsible for the security of all Enterprise Information Systems throughout campus, including but not limited to, myMemphis enterprise resource planning and associated systems, Active Directory, and the UMmail e-mail system.

ITD will audit servers, computers, and portable devices or media with restricted data for compliance with policies and standards and will deny network access for servers, computers, and portable devices or media out of compliance.
     

Remote access to restricted University data is available only to authorized employees.  Employees must be authenticated to access restricted University data remotely.  Data must be encrypted during transit.  

Access from off-campus must be via VPN. 

Home computers that are used to access, store, or transmit restricted University data should use current security patches, updated antivirus and antispyware software, and encryption.  In instances where standard security precautions are not free, the employee will incur all costs for security of their home computer.

Each user in the possession of restricted University data is responsible for protecting the data, regardless of the portable devices or media the data resides on.

Restricted University data may not be loaded onto any portable device or media unless protective measures are implemented that safeguard the confidentiality and integrity of the data in the event of theft or loss.  Protective measures must be implemented before restricted University data is installed.

Restricted University data stored on portable devices or media must be encrypted with the University's data encryption standard.

Restricted University data cannot be saved and stored on mobile devices that cannot be encrypted with the current ITD standard.
  

https://umdrive.memphis.edu/g-itgovernance/ISAC/FY09/Classification%20of%20University%20Data%20Final.docx

www.tbr.state.tn.us/policies/default.aspx?id=1114