Document No.: VCSATSP Restricted Data Access Policy Revision: 4.0. VCSATS Policy Number: VCSATSP Restricted Data Access Policy

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Document No.: VCSATSP 100-100 Restricted Data Access Policy Revision: 4.0. VCSATS Policy Number: VCSATSP 100-100 Restricted Data Access Policy"

Transcription

1 DOCUMENT INFORMATION VCSATS Policy Number: VCSATSP Title: Restricted Data Access Policy Policy Owner: Director Technology Services Effective Date: 2/1/2014 Revision: 4.0 TABLE OF CONTENTS DOCUMENT INFORMATION... 1 TABLE OF CONTENTS PURPOSE SCOPE RESPONSIBILITIES REFERENCES DEFINITIONS POLICY Management of this Policy Proper Use Administration and Configuration of Controls for Users and Technology Accessing Restricted Data Device Security Service Provider Management ENFORCEMENT COMPLIANCE REFERENCE INDEX HISTORY... 9 Page 1 of 9

2 1. PURPOSE Unauthorized access, breach of confidentiality, loss of integrity, disruption of availability, and other risks threaten VCSATS resources. This policy protects VCSATS resources by establishing rules that reduce exposure of those resources to threats 45 C.F.R (d)(2)(ii). 2. SCOPE This policy applies to all systems owned or maintained by Vice Chancellor Student Affairs that process, store or make readable Restricted Data. 3. RESPONSIBILITIES TABLE 1 - ROLES AND RESPONSIBILITIES Role Responsibility Director Technology Services Review and approve changes to this document Infrastructure Manager Oversee the performance of this process Ensure this document remains current and is updated whenever changes to the process occur Ensure execution of duties described in sections 6.1 Management of this Policy, 6.3 Administration and Configuration of Controls for Users and Technology Accessing Restricted Data, 6.4 Device Security, and 6.5 Service Provider Management Critical Technology Users Adhere to this policy and related work instructions. 4. REFERENCES TABLE 2 - REFERENCES Reference VCSATSP Policy Guidance Location VCSATS Policy Center Page 2 of 9

3 5. DEFINITIONS The terms and definitions found in VCSATSP Policy Guidance, as referenced in section 4 references, shall apply, unless a term is expressly defined here. The scope of every term expressly defined in this section is limited to this document. TABLE 3 - LOCAL DEFINITIONS Term, Abbreviation, Acronym Acceptable Network Location Critical Technologies Definition Acceptable Network Locations include the VCSA network or approved technology for remotely accessing the VCSA network, including but not limited to VPN and Outlook Web App. Examples of using Critical Technology through unacceptable network locations include non-vcsa TS issued laptops/tablets/phones via public wifi or accessing the Environment from a public computer outside of UCR grounds, buildings, and offices. Critical Technologies are those that access the environment (as defined below). If a technology does not access the environment, it is not considered Critical Technology. For example, removable electronic media that does not have access to the environment is not considered Critical Technology. Examples of critical technologies include, but are not limited to remote access technologies, wireless technologies, removable electronic media, laptops, tablets, personal data/digital assistants (PDAs), smartphones, , internet. Critical Technology Users All personnel, including full-time employees, part time employees, temporary employees/personnel, contractors, consultants, vendors and business partners who are resident on the UCR campus or otherwise have access to the Environment. Environment For the purposes of this policy, environment refers to any and all Restricted Data environments within VCSA. Remote Access Network-level access originating from outside of the VCSA network. Page 3 of 9

4 Term, Abbreviation, Acronym Service Provider User access to Restricted data Definition A third party or outsourced supplier: With access to the Environment; or those who send or receive Restricted Data as part of a service This term includes, but is not limited to the following: Use of Restricted data which meets the HIPAA definition of Limited Data Set. Use of Restricted data Disclosure of Restricted data Requests for Restricted data Page 4 of 9

5 6. POLICY 6.1 Management of this Policy This policy shall be published to all users who access or may access Restricted Data, including but not limited to Critical Technology Users as defined in Table 3 - Local Definitions. 6.2 Proper Use User access to Restricted data, as defined in Section 5, shall only be provided when all of the following conditions are met 45 C.F.R (d)(2)(ii) 45 C.F.R (d)(3),, 45 C.F.R (d)(5), 45 C.F.R (e) : Access to the Restricted data is necessary for the user to perform assigned duties 45 C.F.R (d)(2)(i)(A), PCI DSS Access to the Restricted data is based on conditions appropriate to such access 45 C.F.R (d)(2)(i)(B) The conditional access to the Restricted data is documented and approved by the appropriate Privacy Officer, Managed Services Officer, and/or Data Owner The privileges necessary to access the Restricted data are documented and approved by the Infrastructure Manager, appropriate Privacy Officer, Managed Services Officer, and/or Data Owner Proper Use of Critical Technologies: Critical Technologies must be used for VCSA business, only. They may not be used for personal reasons Critical Technologies may not be shared. Examples of prohibited sharing include lending your phone to others if it is synched to the Environment and allowing others to use your logged in session without oversight Explicit approval must be provided by the Infrastructure Manager and any other authorized parties, with evidence vaulted, and the intended/acceptable user of the Critical Technology documented prior to using Critical Technology PCI DSS , PCI DSS This is to be done in a manner consistent with Section Page 5 of 9

6 6.2.3 All copy, move, and storage of cardholder data onto local hard drives and removable electronic media while remotely accessing the Restricted environment is prohibited unless explicitly authorized for a defined business need PCI DSS (a) Initiate sessions to the Restricted environment only when necessary. Terminate the session once there is no longer an immediate need to access the Restricted environment Devices must be screen-locked when leaving a workstation. 6.3 Administration and Configuration of Controls for Users and Technology Accessing Restricted Data An access control system shall be in place for systems with multiple users to restrict access Restricted data based on a user s job function, need to know, and shall be set to deny all unless specifically allowed, as follows PCI DSS 7.1.4, PCI DSS 7.2 : Access control systems shall be in place on all system components PCI DSS Access control systems shall be configured to enforce privileges PCI DSS assigned to individuals based on job classification and function Access control systems shall have a default deny-all setting PCI DSS Users shall be assigned a unique ID before receiving access to system components or Restricted data PCI DSS In addition to assigning a unique ID, one or more of the following methods shall be employed to authenticate all users, including but not limited to users of Critical Technology PCI DSS 8.2, PCI DSS : Something the user knows, such as a password or passphrase Something the user has, such as a token device or smart card Something the user is, such as a biometric Group, shared, and generic accounts/passwords/other authentication methods are expressly prohibited PCI DSS : Generic user IDs and accounts shall be disabled or removed Shared user IDs for system administration activities and other critical functions shall not exist Shared and generic user IDs shall not be used to administer any system components. Page 6 of 9

7 6.3.5 Controls shall be implemented to protect databases that access or store Restricted data All access to any database containing Restricted data shall be authenticated consistent with the full set of instructions in this policy. This includes access by applications, administrators, and all other users PCI DSS (a) All user access to, user queries of, and user actions on a database containing Restricted data shall be through programmatic methods only (for example, through stored procedures) PCI DSS (b) The ability for a user to directly access or query a database containing PCI DSS Restricted data shall be limited to database administrators (c) Application IDs with database access shall only be able to be used by the intended applications and not by individual users or other processes PCI DSS (d) Controls shall be implemented for Critical Technologies to protect Restricted data and environments as follows: Use of Critical Technology must require authentication in a manner PCI DSS 8.3, PCI DSS consistent with the full set of instructions in this policy Software and devices, including phones and laptops, must be configured to require a password to access the device Networks and systems must be configured to require twofactor authentication to remotely access the Environment Service accounts (non-human) are exempt from the twofactor authentication requirement Critical Technologies shall only be used with Acceptable Network Locations PCI DSS Devices that have the ability to be configured to automatically connect to network locations shall be configured to disable automatic connection to network locations other than Acceptable Network Locations Sessions for remote access to the Environment shall time out after a period of inactivity PCI DSS Page 7 of 9

8 Critical Technologies used by vendors and business partners to remotely access the Environment shall be activated only when needed and shall be immediately deactivated after use PCI DSS Critical Technologies used by vendors and business partners to PCI DSS remotely access the Environment shall be monitored when in use Device Security A list of all Critical Technology shall be maintained, including PCI DSS : All devices using or constituting Critical Technology PCI DSS All personnel authorized to use the devices PCI DSS All handheld devices using or constituting Critical Technology shall be enabled to automatically lockout after a long idle period PCI DSS All handheld devices using or constituting Critical Technology shall be configured to require a password when powering on PCI DSS All devices using or constituting Critical Technology shall be labeled in accordance with VCSATSP Physical Security of Restricted Data PCI DSS Service Provider Management An agreement must be in place and approved in written form by UCR Purchasing and a director from either UCR C&C or VCSATS PCI DSS The agreement must include an acknowledgement that the service provider is responsible for the security of Restricted Data in their possession PCI DSS A list of service providers shall be maintained PCI DSS Evidence of Service Provider compliance status shall be vaulted as required for: PCI DSS PCI DSS HIPAA Other applicable regulatory or contractual requirements. 7. ENFORCEMENT Any employee found to have violated this work instruction may be subject to disciplinary action. Page 8 of 9

9 8. COMPLIANCE REFERENCE INDEX 45 C.F.R (d)(2)(i)(A) C.F.R (d)(2)(i)(B) C.F.R (d)(2)(ii)... 2, 5 45 C.F.R (d)(3) C.F.R (d)(5) C.F.R (e)... 5 PCI DSS PCI DSS (a)... 6 PCI DSS PCI DSS , 8 PCI DSS PCI DSS PCI DSS PCI DSS PCI DSS PCI DSS PCI DSS PCI DSS PCI DSS PCI DSS PCI DSS PCI DSS PCI DSS PCI DSS PCI DSS PCI DSS PCI DSS PCI DSS (a)... 7 PCI DSS (b)... 7 PCI DSS (c)... 7 PCI DSS (d)... 7 PCI DSS PCI DSS PCI DSS HISTORY FogBugz Case Description of Changes 1490 Create initial version of this Policy. 5323, 5324 Requested approval for version 1.0 of this policy. (Not Approved) 6795, 6796 Requested approval for version 2.0 of this policy. 8270, 8311, 8314, 8315, 8317, 8407, 8409, 8504, 8788 Added support for 45 C.F.R , PCI DSS Requirements 7, 8, 9 and , 8917 Requested approval for version 2.0 of this policy Added sections and , Requested approval for version 4.0 of this policy Page 9 of 9

Document No.: VCSATSP 100-030 Vulnerability and Penetration Testing Policy Revision: 7.0

Document No.: VCSATSP 100-030 Vulnerability and Penetration Testing Policy Revision: 7.0 DOCUMENT INFORMATION VCSATS Policy Number: VCSATSP 100-030 Title: Policy Owner: Effective Date: 5/1/2013 Revision: 7.0 Vulnerability and Penetration Testing Policy Infrastructure Manager TABLE OF CONTENTS

More information

Document No.: VCSATSP 100-040 Restricted Data Encryption Policy Revision: 4.0. Restricted Data Encryption Policy

Document No.: VCSATSP 100-040 Restricted Data Encryption Policy Revision: 4.0. Restricted Data Encryption Policy DOCUMENT INFORMATION VCSATS Policy Number: VCSATSP 100-040 Title: Policy Owner: Restricted Data Encryption Policy Infrastructure Manager Effective Date: 4/22/2013 Revision: 4.0 TABLE OF CONTENTS DOCUMENT

More information

Managed Hosting & Datacentre PCI DSS v2.0 Obligations

Managed Hosting & Datacentre PCI DSS v2.0 Obligations Any physical access to devices or data held in an Melbourne datacentre that houses a customer s cardholder data must be controlled and restricted only to approved individuals. PCI DSS Requirements Version

More information

Automating Compliance Reporting for PCI Data Security Standard version 1.1

Automating Compliance Reporting for PCI Data Security Standard version 1.1 PCI Compliance Reporting Solution Brief Automating Regulatory Compliance and IT Best Practices Reporting Automating Compliance Reporting for PCI Data Security Standard version 1.1 The PCI Data Security

More information

CREDIT CARD SECURITY POLICY PCI DSS 2.0

CREDIT CARD SECURITY POLICY PCI DSS 2.0 Responsible University Official: University Compliance Officer Responsible Office: Business Office Reviewed Date: 10/29/2012 CREDIT CARD SECURITY POLICY PCI DSS 2.0 Introduction and Scope Introduction

More information

Information Security Handbook

Information Security Handbook Information Security Handbook Adopted 6/4/14 Page 0 Page 1 1. Introduction... 5 1.1. Executive Summary... 5 1.2. Governance... 5 1.3. Scope and Application... 5 1.4. Biennial Review... 5 2. Definitions...

More information

www.xceedium.com 2: Do not use vendor-supplied defaults for system passwords and other security parameters

www.xceedium.com 2: Do not use vendor-supplied defaults for system passwords and other security parameters 2: Do not use vendor-supplied defaults for system passwords and other security parameters 2.1: Always change vendor-supplied defaults and remove or disable unnecessary default accounts before installing

More information

micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) August, 2013 Revision 8.0 MICROS Systems, Inc. Version 8.

micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) August, 2013 Revision 8.0 MICROS Systems, Inc. Version 8. micros MICROS Systems, Inc. Enterprise Information Security Policy (MEIP) Revision 8.0 August, 2013 1 Table of Contents Overview /Standards: I. Information Security Policy/Standards Preface...5 I.1 Purpose....5

More information

Information Technology Security Standards and Protocols. Coast Community College District

Information Technology Security Standards and Protocols. Coast Community College District Information Technology Security Standards and Protocols Coast Community College District 1 Contents DIT 01 - Information Security Program Overview... 7 1.0 Purpose, Scope, and Maintenance... 7 1.1 Purpose...

More information

PA-DSS Implementation Guide for. Sage MAS 90 and 200 ERP. Credit Card Processing

PA-DSS Implementation Guide for. Sage MAS 90 and 200 ERP. Credit Card Processing for Sage MAS 90 and 200 ERP Credit Card Processing Version 4.30.0.18 and 4.40.0.1 - January 28, 2010 Sage, the Sage logos and the Sage product and service names mentioned herein are registered trademarks

More information

Information Technology Branch Access Control Technical Standard

Information Technology Branch Access Control Technical Standard Information Technology Branch Access Control Technical Standard Information Management, Administrative Directive A1461 Cyber Security Technical Standard # 5 November 20, 2014 Approved: Date: November 20,

More information

Accounting and Administrative Manual Section 100: Accounting and Finance

Accounting and Administrative Manual Section 100: Accounting and Finance No.: C-13 Page: 1 of 6 POLICY: It is the policy of the University of Alaska that all payment card transactions are to be executed in compliance with standards established by the Payment Card Industry Security

More information

Achieving PCI COMPLIANCE with the 2020 Audit & Control Suite. www.lepide.com/2020-suite/

Achieving PCI COMPLIANCE with the 2020 Audit & Control Suite. www.lepide.com/2020-suite/ Achieving PCI COMPLIANCE with the 2020 Audit & Control Suite 7. Restrict access to cardholder data by business need to know PCI Article (PCI DSS 3) Report Mapping How we help 7.1 Limit access to system

More information

Minnesota State Colleges and Universities System Procedures Chapter 5 Administration. Guideline 5.23.1.10 Payment Card Industry Technical Requirements

Minnesota State Colleges and Universities System Procedures Chapter 5 Administration. Guideline 5.23.1.10 Payment Card Industry Technical Requirements Minnesota State Colleges and Universities System Procedures Chapter 5 Administration Payment Card Industry Technical s Part 1. Purpose. This guideline emphasizes many of the minimum technical requirements

More information

PCI DSS Requirements - Security Controls and Processes

PCI DSS Requirements - Security Controls and Processes 1. Build and maintain a secure network 1.1 Establish firewall and router configuration standards that formalize testing whenever configurations change; that identify all connections to cardholder data

More information

74% 96 Action Items. Compliance

74% 96 Action Items. Compliance Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on July 02, 2013 11:12 AM 1 74% Compliance 96 Action Items Upcoming 0 items About PCI DSS 2.0 PCI-DSS is a legal obligation mandated

More information

Vermont Information Technology Leaders

Vermont Information Technology Leaders Vermont Information Technology Leaders HIPAA COMPLIANCE POLICIES AND PROCEDURES Policy Number: InfoSec 1 Policy Title: Information Privacy and Security Management Process IDENT INFOSEC1 Type of Document:

More information

University of Sunderland Business Assurance PCI Security Policy

University of Sunderland Business Assurance PCI Security Policy University of Sunderland Business Assurance PCI Security Policy Document Classification: Public Policy Reference Central Register IG008 Policy Reference Faculty / Service IG 008 Policy Owner Chief Financial

More information

General Standards for Payment Card Environments at Miami University

General Standards for Payment Card Environments at Miami University General Standards for Payment Card Environments at Miami University 1. Install and maintain a firewall configuration to protect cardholder data and its environment Cardholder databases, applications, servers,

More information

This policy shall be reviewed at least annually and updated as needed to reflect changes to business objectives or the risk environment.

This policy shall be reviewed at least annually and updated as needed to reflect changes to business objectives or the risk environment. - 1. Policy Statement All card processing activities and related technologies must comply with the Payment Card Industry Data Security Standard (PCI-DSS) in its entirety. Card processing activities must

More information

MONTSERRAT COLLEGE OF ART WRITTEN INFORMATION SECURITY POLICY (WISP)

MONTSERRAT COLLEGE OF ART WRITTEN INFORMATION SECURITY POLICY (WISP) MONTSERRAT COLLEGE OF ART WRITTEN INFORMATION SECURITY POLICY (WISP) 201 CMR 17.00 Standards for the Protection of Personal Information Of Residents of the Commonwealth of Massachusetts Revised April 28,

More information

Information Security Policy and Handbook Overview. ITSS Information Security June 2015

Information Security Policy and Handbook Overview. ITSS Information Security June 2015 Information Security Policy and Handbook Overview ITSS Information Security June 2015 Information Security Policy Control Hierarchy System and Campus Information Security Policies UNT System Information

More information

Payment Card Industry (PCI) Policy Manual. Network and Computer Services

Payment Card Industry (PCI) Policy Manual. Network and Computer Services Payment Card Industry (PCI) Policy Manual Network and Computer Services Forward This policy manual outlines acceptable use Black Hills State University (BHSU) or University herein, Information Technology

More information

APPROVED BY: DATE: NUMBER: PAGE: 1 of 9

APPROVED BY: DATE: NUMBER: PAGE: 1 of 9 1 of 9 PURPOSE: To define standards for appropriate and secure use of MCG Health electronic systems, specifically e-mail systems, Internet access, phones (static or mobile; including voice mail) wireless

More information

Altius IT Policy Collection Compliance and Standards Matrix

Altius IT Policy Collection Compliance and Standards Matrix Governance IT Governance Policy Mergers and Acquisitions Policy Terms and Definitions Policy 164.308 12.4 12.5 EDM01 EDM02 EDM03 Information Security Privacy Policy Securing Information Systems Policy

More information

MIT s Information Security Program for Protecting Personal Information Requiring Notification. (Revision date: 2/26/10)

MIT s Information Security Program for Protecting Personal Information Requiring Notification. (Revision date: 2/26/10) MIT s Information Security Program for Protecting Personal Information Requiring Notification (Revision date: 2/26/10) Table of Contents 1. Program Summary... 3 2. Definitions... 4 2.1 Identity Theft...

More information

Information Systems Access Policy

Information Systems Access Policy Information Systems Access Policy I. PURPOSE The purpose of this policy is to maintain an adequate level of security to protect data and information systems from unauthorized access. This

More information

Estate Agents Authority

Estate Agents Authority INFORMATION SECURITY AND PRIVACY PROTECTION POLICY AND GUIDELINES FOR ESTATE AGENTS Estate Agents Authority The contents of this document remain the property of, and may not be reproduced in whole or in

More information

Miami University. Payment Card Data Security Policy

Miami University. Payment Card Data Security Policy Miami University Payment Card Data Security Policy IT Policy IT Standard IT Guideline IT Procedure IT Informative Issued by: IT Services SCOPE: This policy covers all units within Miami University that

More information

SUBJECT: Effective Date Policy Number Security of Mobile Computing, Data Storage, and Communication Devices

SUBJECT: Effective Date Policy Number Security of Mobile Computing, Data Storage, and Communication Devices SUBJECT: Effective Date Policy Number Security of Mobile Computing, Data Storage, and Communication Devices 8-27-2015 4-007.1 Supersedes 4-007 Page Of 1 5 Responsible Authority Vice Provost for Information

More information

SAQ D Compliance. Scott St. Aubin Senior Security Consultant QSA, CISM, CISSP

SAQ D Compliance. Scott St. Aubin Senior Security Consultant QSA, CISM, CISSP SAQ D Compliance Scott St. Aubin Senior Security Consultant QSA, CISM, CISSP Ground Rules WARNING: Potential Death by PowerPoint Interaction Get clarification Share your institution s questions, challenges,

More information

Central Agency for Information Technology

Central Agency for Information Technology Central Agency for Information Technology Kuwait National IT Governance Framework Information Security Agenda 1 Manage security policy 2 Information security management system procedure Agenda 3 Manage

More information

PCI Data Security and Classification Standards Summary

PCI Data Security and Classification Standards Summary PCI Data Security and Classification Standards Summary Data security should be a key component of all system policies and practices related to payment acceptance and transaction processing. As customers

More information

Rule 4-004G Payment Card Industry (PCI) Remote and Mobile Access Security (proposed)

Rule 4-004G Payment Card Industry (PCI) Remote and Mobile Access Security (proposed) Version: Modified By: Date: Approved By: Date: 1.0 Michael Hawkins October 29, 2013 Dan Bowden November 2013 Rule 4-004G Payment Card Industry (PCI) Remote and Mobile Access Security (proposed) 01.1 Purpose

More information

About the white paper: The pressure to demonstrate compliance with standards and regulations such as Sarbanes Oxley, HIPAA, PCI DSS and Basel II,

About the white paper: The pressure to demonstrate compliance with standards and regulations such as Sarbanes Oxley, HIPAA, PCI DSS and Basel II, TWO FACTOR AUTHENTICATION FOR THE IBM SYSTEM i WHITE PAPER MAY 2010 About the white paper: The pressure to demonstrate compliance with standards and regulations such as Sarbanes Oxley, HIPAA, PCI DSS and

More information

IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:

IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225

More information

13. Acceptable Use Policy

13. Acceptable Use Policy To view the complete Information and Security Policies and Procedures, log into the Intranet through the IRSC.edu website. Click on the Institutional Technology (IT) Department link, then the Information

More information

DHHS Information Technology (IT) Access Control Standard

DHHS Information Technology (IT) Access Control Standard DHHS Information Technology (IT) Access Control Standard Issue Date: October 1, 2013 Effective Date: October 1,2013 Revised Date: Number: DHHS-2013-001-B 1.0 Purpose and Objectives With the diversity of

More information

Office of Finance and Treasury

Office of Finance and Treasury Office of Finance and Treasury How to Accept & Process Credit and Debit Card Transactions Procedure Related Policy Title Credit Card Processing Policy For University Merchant Locations Responsible Executive

More information

Massachusetts Identity Theft/ Data Security Regulations

Massachusetts Identity Theft/ Data Security Regulations Massachusetts Identity Theft/ Data Security Regulations Effective March 1, 2010 Are You Ready? SPECIAL REPORT All We Do Is Work. Workplace Law. In four time zones and 45 major locations coast to coast.

More information

PCI PA - DSS. Point XSA Implementation Guide. Atos Worldline Banksys XENTA SA. Version 1.00

PCI PA - DSS. Point XSA Implementation Guide. Atos Worldline Banksys XENTA SA. Version 1.00 PCI PA - DSS Point XSA Implementation Guide Atos Worldline Banksys XENTA SA Version 1.00 POINT TRANSACTION SYSTEMS AB Box 92031, 120 06 Stockholm, Tel. +46 8 566 287 00 www.point.se Page number 2 (16)

More information

Compliance and Industry Regulations

Compliance and Industry Regulations Compliance and Industry Regulations Table of Contents Introduction...1 Executive Summary...1 General Federal Regulations and Oversight Agencies...1 Agency or Industry Specific Regulations...2 Hierarchy

More information

HIPAA Security Alert

HIPAA Security Alert Shipman & Goodwin LLP HIPAA Security Alert July 2008 EXECUTIVE GUIDANCE HIPAA SECURITY COMPLIANCE How would your organization s senior management respond to CMS or OIG inquiries about health information

More information

BEFORE THE BOARD OF COUNTY COMMISSIONERS FOR MULTNOMAH COUNTY, OREGON RESOLUTION NO. 05-050

BEFORE THE BOARD OF COUNTY COMMISSIONERS FOR MULTNOMAH COUNTY, OREGON RESOLUTION NO. 05-050 BEFORE THE BOARD OF COUNTY COMMISSIONERS FOR MULTNOMAH COUNTY, OREGON RESOLUTION NO. 05-050 Adopting Multnomah County HIPAA Security Policies and Directing the Appointment of Information System Security

More information

Supplier Information Security Addendum for GE Restricted Data

Supplier Information Security Addendum for GE Restricted Data Supplier Information Security Addendum for GE Restricted Data This Supplier Information Security Addendum lists the security controls that GE Suppliers are required to adopt when accessing, processing,

More information

Central Texas College District Human Resource Management Operating Policies and Procedures Manual Policy No. 294: Computer Security Policy

Central Texas College District Human Resource Management Operating Policies and Procedures Manual Policy No. 294: Computer Security Policy Central Texas College District Human Resource Management Operating Policies and Procedures Manual Policy No. 294: Computer Security Policy I. PURPOSE To identify the requirements needed to comply with

More information

P01 - Information Security Policy

<COMPANY> P01 - Information Security Policy P01 - Information Security Policy Document Reference P01 - Information Security Policy Date 30th September 2014 Document Status Final Version 3.0 Revision History 1.0 09 November 2009: Initial release.

More information

Section 3.9 PCI DSS Information Security Policy Issued: June 2016 Replaces: January 2015

Section 3.9 PCI DSS Information Security Policy Issued: June 2016 Replaces: January 2015 Section 3.9 PCI DSS Information Security Policy Issued: June 2016 Replaces: January 2015 I. PURPOSE The purpose of this policy is to establish guidelines for processing charges on Payment Cards to protect

More information

Parallels Plesk Panel

Parallels Plesk Panel Parallels Plesk Panel Copyright Notice Parallels Holdings, Ltd. c/o Parallels International GmbH Vordergasse 59 CH-Schaffhausen Switzerland Phone: +41-526320-411 Fax: +41-52672-2010 Copyright 1999-2011

More information

Seven Requirements for Successfully Implementing Information Security Policies and Standards

Seven Requirements for Successfully Implementing Information Security Policies and Standards Seven Requirements for Successfully Implementing and Standards A guide for executives Stan Stahl, Ph.D., President, Citadel Information Group Kimberly A. Pease, CISSP, Vice President, Citadel Information

More information

State of Vermont. System/Service Password Policy. Date: 10/2009 Approved by: Neale F. Lunderville Policy Number:

State of Vermont. System/Service Password Policy. Date: 10/2009 Approved by: Neale F. Lunderville Policy Number: State of Vermont System/Service Password Policy Date: 10/2009 Approved by: Neale F. Lunderville Policy Number: Contents Contents 1.0 Introduction... 3 1.1 Authority... 3 1.2 Purpose... 3 1.3 Scope... 3

More information

Electronic Data Protection and Encryption Policy

Electronic Data Protection and Encryption Policy Electronic Data Protection and Encryption Policy Date Approved: 10/27/2010 Effective Date: 1/1/2011 Date(s) Reviewed: Date (s) Revised: PURPOSE: Information Security exists to further the mission of the

More information

Newcastle University Information Security Procedures Version 3

Newcastle University Information Security Procedures Version 3 Newcastle University Information Security Procedures Version 3 A Information Security Procedures 2 B Business Continuity 3 C Compliance 4 D Outsourcing and Third Party Access 5 E Personnel 6 F Operations

More information

POL 08.00.02 Information Systems Access Policy. History: First issued: November 5, 2001. Revised: April 5, 2010. Last revised: June 18, 2014

POL 08.00.02 Information Systems Access Policy. History: First issued: November 5, 2001. Revised: April 5, 2010. Last revised: June 18, 2014 POL 08.00.02 Information Systems Access Policy Authority: History: First issued: November 5, 2001. Revised: April 5, 2010. Last revised: June 18, 2014 Related Policies: NC General Statute 14-454 - Accessing

More information

Introduction. PCI DSS Overview

Introduction. PCI DSS Overview Introduction Manage Engine Desktop Central is part of ManageEngine family that represents entire IT infrastructure with products such as Network monitoring, Helpdesk management, Application management,

More information

Catapult PCI Compliance

Catapult PCI Compliance Catapult PCI Compliance Table of Contents Catapult PCI Compliance...1 Table of Contents...1 Overview Catapult (PCI)...2 Support and Contact Information...2 Dealer Support...2 End User Support...2 Catapult

More information

Qualified Integrators and Resellers (QIR) Implementation Statement

Qualified Integrators and Resellers (QIR) Implementation Statement Qualified Integrators and Resellers (QIR) Implementation Statement For each Qualified Installation performed, the QIR Employee must complete this document and confirm whether the validated payment application

More information

Implementation Guide

Implementation Guide Implementation Guide PayLINK Implementation Guide Version 2.1.252 Released September 17, 2013 Copyright 2011-2013, BridgePay Network Solutions, Inc. All rights reserved. The information contained herein

More information

INFORMATION TECHNOLOGY Policy 8400 (Regulation 8400) Data Security

INFORMATION TECHNOLOGY Policy 8400 (Regulation 8400) Data Security INFORMATION TECHNOLOGY Policy 8400 (Regulation 8400) Data Security State Fair Community College shall provide a central administrative system for use in data collection and extraction. Any system user

More information

SECURELINK.COM COMPLIANCE AND INDUSTRY REGULATIONS

SECURELINK.COM COMPLIANCE AND INDUSTRY REGULATIONS COMPLIANCE AND INDUSTRY REGULATIONS INTRODUCTION Multiple federal regulations exist today requiring government organizations to implement effective controls that ensure the security of their information

More information

Information Security Program Management Standard

Information Security Program Management Standard State of California California Information Security Office Information Security Program Management Standard SIMM 5305-A September 2013 REVISION HISTORY REVISION DATE OF RELEASE OWNER SUMMARY OF CHANGES

More information

Using Automated, Detailed Configuration and Change Reporting to Achieve and Maintain PCI Compliance Part 4

Using Automated, Detailed Configuration and Change Reporting to Achieve and Maintain PCI Compliance Part 4 WHITEPAPER Using Automated, Detailed Configuration and Change Reporting to Achieve and Maintain PCI Compliance Part 4 An in-depth look at Payment Card Industry Data Security Standard Requirements 10, 11,

More information

LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES

LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable

More information

Mobile Device Usage Standards (Phones, Smart Phones, Tablets, Laptops)

Mobile Device Usage Standards (Phones, Smart Phones, Tablets, Laptops) Mobile Device Usage Standards (Phones, Smart Phones, Tablets, Laptops) 1. Purpose Banner encourages the business use of Mobile Devices by employees as productivity enhancement tools. The purpose of this

More information

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation Melissa J. Krasnow, Dorsey & Whitney LLP A Note discussing written information security programs (WISPs)

More information

Third-Party Access and Management Policy

Third-Party Access and Management Policy Third-Party Access and Management Policy Version Date Change/s Author/s Approver/s Dean of Information Services 1.0 01/01/2013 Initial written policy. Kyle Johnson Executive Director for Compliance and

More information

California State University, Sacramento INFORMATION SECURITY PROGRAM

California State University, Sacramento INFORMATION SECURITY PROGRAM California State University, Sacramento INFORMATION SECURITY PROGRAM 1 I. Preamble... 3 II. Scope... 3 III. Definitions... 4 IV. Roles and Responsibilities... 5 A. Vice President for Academic Affairs...

More information

Detailed Analysis Achieving PCI Compliance with SkyView Partners Products for Open Systems

Detailed Analysis Achieving PCI Compliance with SkyView Partners Products for Open Systems Detailed Analysis Achieving PCI Compliance with SkyView Partners Products for Open Systems The Payment Card Industry has a published set of Data Security Standards to which organization s accepting and

More information

SonicWALL PCI 1.1 Implementation Guide

SonicWALL PCI 1.1 Implementation Guide Compliance SonicWALL PCI 1.1 Implementation Guide A PCI Implementation Guide for SonicWALL SonicOS Standard In conjunction with ControlCase, LLC (PCI Council Approved Auditor) SonicWall SonicOS Standard

More information

Title: Data Security Policy Code: 1-100-200 Date: 11-6-08rev Approved: WPL INTRODUCTION

Title: Data Security Policy Code: 1-100-200 Date: 11-6-08rev Approved: WPL INTRODUCTION Title: Data Security Policy Code: 1-100-200 Date: 11-6-08rev Approved: WPL INTRODUCTION The purpose of this policy is to outline essential roles and responsibilities within the University community for

More information

Vulnerability Management Policy

Vulnerability Management Policy Vulnerability Management Policy Policy Statement Computing devices storing the University s Sensitive Information (as defined below) or Mission-Critical computing devices (as defined below) must be fully

More information

Controls for the Credit Card Environment Edit Date: May 17, 2007

Controls for the Credit Card Environment Edit Date: May 17, 2007 Controls for the Credit Card Environment Edit Date: May 17, 2007 Status: Approved in concept by Executive Staff 5/15/07 This document contains policies, standards, and procedures for securing all credit

More information

INFORMATION SECURITY GOVERNANCE ASSESSMENT TOOL FOR HIGHER EDUCATION

INFORMATION SECURITY GOVERNANCE ASSESSMENT TOOL FOR HIGHER EDUCATION INFORMATION SECURITY GOVERNANCE ASSESSMENT TOOL FOR HIGHER EDUCATION Information security is a critical issue for institutions of higher education (IHE). IHE face issues of risk, liability, business continuity,

More information

Access Control BUSINESS REQUIREMENTS FOR ACCESS CONTROL

Access Control BUSINESS REQUIREMENTS FOR ACCESS CONTROL AU7087_C013.fm Page 173 Friday, April 28, 2006 9:45 AM 13 Access Control The Access Control clause is the second largest clause, containing 25 controls and 7 control objectives. This clause contains critical

More information

Information Security Policy

Information Security Policy Information Security Policy Touro College/University ( Touro ) is committed to information security. Information security is defined as protection of data, applications, networks, and computer systems

More information

Antivirus and Malware Prevention Policy and Procedures (Template) Employee Personal Device Use Terms and Conditions (Template)

Antivirus and Malware Prevention Policy and Procedures (Template) Employee Personal Device Use Terms and Conditions (Template) Below you will find the following sample policies: Antivirus and Malware Prevention Policy and Procedures (Template) Employee Personal Device Use Terms and Conditions (Template) *Log in to erisk Hub for

More information

INFORMATION TECHNOLOGY SECURITY STANDARDS

INFORMATION TECHNOLOGY SECURITY STANDARDS INFORMATION TECHNOLOGY SECURITY STANDARDS Version 2.0 December 2013 Table of Contents 1 OVERVIEW 3 2 SCOPE 4 3 STRUCTURE 5 4 ASSET MANAGEMENT 6 5 HUMAN RESOURCES SECURITY 7 6 PHYSICAL AND ENVIRONMENTAL

More information

Policy. London School of Economics & Political Science. Remote Access Policy. IT Services. Jethro Perkins. Information Security Manager.

Policy. London School of Economics & Political Science. Remote Access Policy. IT Services. Jethro Perkins. Information Security Manager. London School of Economics & Political Science IT Services Policy Remote Access Policy Jethro Perkins Information Security Manager Summary This document outlines the controls from ISO27002 that relate

More information

ISO 27001 Controls and Objectives

ISO 27001 Controls and Objectives ISO 27001 s and Objectives A.5 Security policy A.5.1 Information security policy Objective: To provide management direction and support for information security in accordance with business requirements

More information

Standard: Network Security

Standard: Network Security Standard: Network Security Page 1 Executive Summary Network security is important in the protection of our network and services from unauthorized modification, destruction, or disclosure. It is essential

More information

Department of Homeland Security Management Directive System MD Number: 4900 INDIVIDUAL USE AND OPERATION OF DHS INFORMATION SYSTEMS/ COMPUTERS

Department of Homeland Security Management Directive System MD Number: 4900 INDIVIDUAL USE AND OPERATION OF DHS INFORMATION SYSTEMS/ COMPUTERS Department of Homeland Security Management Directive System MD Number: 4900 INDIVIDUAL USE AND OPERATION OF DHS INFORMATION SYSTEMS/ COMPUTERS 1. Purpose This directive establishes the Department of Homeland

More information

University of Pittsburgh Security Assessment Questionnaire (v1.5)

University of Pittsburgh Security Assessment Questionnaire (v1.5) Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.5) Directions and Instructions for completing this assessment The answers provided

More information

05.118 Credit Card Acceptance Policy. Vice Chancellor of Business Affairs. History: Effective July 1, 2011 Updated February 2013

05.118 Credit Card Acceptance Policy. Vice Chancellor of Business Affairs. History: Effective July 1, 2011 Updated February 2013 05.118 Credit Card Acceptance Policy Authority: Vice Chancellor of Business Affairs History: Effective July 1, 2011 Updated February 2013 Source of Authority: Office of State Controller (OSC); Office of

More information

Payment Card Industry Data Security Standard

Payment Card Industry Data Security Standard Payment Card Industry Data Security Standard Introduction Purpose Audience Implications Sensitive Digital Data Management In an effort to protect credit card information from unauthorized access, disclosure

More information

Information Security Risk Assessment Checklist. A High-Level Tool to Assist USG Institutions with Risk Analysis

Information Security Risk Assessment Checklist. A High-Level Tool to Assist USG Institutions with Risk Analysis Information Security Risk Assessment Checklist A High-Level Tool to Assist USG Institutions with Risk Analysis Updated Oct 2008 Introduction Information security is an important issue for the University

More information

Please review and make copies of the following documents for each designated staff in need of Valley Express access.

Please review and make copies of the following documents for each designated staff in need of Valley Express access. Welcome to Valley Express (VE) Valley Express is Valley Health Plan s (VHP) Authorization and Referral data system. By signing this document, the individual signifies that the County s User Responsibility

More information

WHITE PAPER: MASSACHUSETTS DATA SECURITY REGULATIONS

WHITE PAPER: MASSACHUSETTS DATA SECURITY REGULATIONS WHITE PAPER: MASSACHUSETTS DATA SECURITY REGULATIONS Introduction Massachusetts regulations set forth minimum requirements for both the protection of personal information and the electronic storage or

More information

OIT OPERATIONAL PROCEDURE

OIT OPERATIONAL PROCEDURE OIT OPERATIONAL PROCEDURE Title: DATA CLASSIFICATION GUIDELINES Identification: OIT 1 Page: 1 of 5 Effective Date: 3/31/2014 Signature/Approval: Guidelines and Handling Procedure (9 10 ) specifies that

More information

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation View the online version at http://us.practicallaw.com/7-523-1520 Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation Melissa J. Krasnow, Dorsey & Whitney LLP

More information

Montclair State University. HIPAA Security Policy

Montclair State University. HIPAA Security Policy Montclair State University HIPAA Security Policy Effective: June 25, 2015 HIPAA Security Policy and Procedures Montclair State University is a hybrid entity and has designated Healthcare Components that

More information

Network Security Policy

Network Security Policy Network Security Policy I. PURPOSE Attacks and security incidents constitute a risk to the University's academic mission. The loss or corruption of data or unauthorized disclosure of information on campus

More information

Detailed Analysis Achieving PCI Compliance with SkyView Partners Products for AIX

Detailed Analysis Achieving PCI Compliance with SkyView Partners Products for AIX Detailed Analysis Achieving PCI Compliance with SkyView Partners Products for AIX The Payment Card Industry has a published set of Data Security Standards to which organization s accepting and storing

More information

ADMINISTRATIVE POLICY # 32 8 117 (2014) Remote Access. Policy Number: ADMINISTRATIVE POLICY # 32 8 117 (2014) Remote Access

ADMINISTRATIVE POLICY # 32 8 117 (2014) Remote Access. Policy Number: ADMINISTRATIVE POLICY # 32 8 117 (2014) Remote Access Policy Title: Remote Access Policy Type: Administrative Policy Number: ADMINISTRATIVE POLICY # 32 8 117 (2014) Remote Access Approval Date: 05/20/2014 Revised Responsible Office: Office of Information

More information

Global Partner Management Notice

Global Partner Management Notice Global Partner Management Notice Subject: Critical Vulnerabilities Identified to Alert Payment System Participants of Data Compromise Trends Dated: May 4, 2009 Announcement: To support compliance with

More information

FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY

FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY Page 1 of 6 Summary The Payment Card Industry Data Security Standard (PCI DSS), a set of comprehensive requirements for enhancing payment account

More information

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation View the online version at http://us.practicallaw.com/7-523-1520 Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation MELISSA J. KRASNOW, DORSEY & WHITNEY LLP

More information

IT ACCESS CONTROL AND USER ACCESS MANAGEMENT POLICY

IT ACCESS CONTROL AND USER ACCESS MANAGEMENT POLICY IT ACCESS CONTROL AND USER Effective Date May 20, 2016 Cross-Reference 1. Contract Management Policy Responsibility Director, Information 2. IT Password Policy Technology 3. Record Classification and Handling

More information

Adams County, Colorado

Adams County, Colorado Colorado Independent Consultants Network, LLC Adams County, Colorado Bring-Your-Own-Device Policy Prepared by: Colorado Independent Consultants Network, LLC Denver, Colorado March 20, 2014 Table of Contents

More information

HIPAA SECURITY RISK ASSESSMENT SMALL PHYSICIAN PRACTICE

HIPAA SECURITY RISK ASSESSMENT SMALL PHYSICIAN PRACTICE HIPAA SECURITY RISK ASSESSMENT SMALL PHYSICIAN PRACTICE How to Use this Assessment The following risk assessment provides you with a series of questions to help you prioritize the development and implementation

More information