Policy: Control of Unclassified Electronic Information
|
|
|
- Fay Day
- 8 years ago
- Views:
Transcription
1 Management System: Information Resource Management PO-IRM , Rev. 0 Subject Area Description: Cyber Security (and Personally Identifiable Information [PII]) Policy: Control of Unclassified Electronic Information Management System Owner: Ward Best Subject Matter Expert: Lisa Rawls Issue Date: 12/16/2015 Revision: Purpose The purpose of this policy is to define the use and control of all Unclassified Electronic Information at the Environmental Management Consolidated Business Center (EMCBC) and the reporting requirements for loss of control of Controlled Unclassified Information (CUI). 2.0 Scope & Applicability This policy is applicable to all electronic media managed by the EMCBC directly or by Service Level Agreement. This policy is not applicable to Classified Electronic Information. 3.0 General Information 3.1 Policy: It is the policy of the EMCBC that all electronic information is controlled as required. All forms of electronic information will be reviewed for sensitivity and applicable controls will be applied. Applicable controls come from the references listed in Section 4.0 of this policy. Excessive controls are cumbersome and unduly impact business operations and are to be avoided. Where data types are mixed, the most stringent control shall apply. 3.2 Data Sensitivity and Controls: Data within the EMCBC network is classified by type according to the sensitivity of the data Type I Data: The data in this category requires the most stringent control and is made up of the most sensitive data. All CUI falls into this category. Other 1
2 data may be designated as Type I by the Content Owner if necessary to meet a particular need. These controls mandate: All CUI shall be stored on network peripherals, not on Desktops. All data stored on laptops, USB drives, CDs, and DVDs shall be encrypted. All CUI stored on mobile devices including portable hard drives shall be encrypted. All laptops will use full-device encryption. CUI is encrypted before transfer over open connections. EMCBC uses Entrust for this purpose. Remote access to EMCBC file storage and applications containing CUI shall utilize two-factor authentication and conform with the time-out requirements of the references listed in Section Personally Identifiable Information (PII) is a special form of Type I data and requires additional controls over and above those already stated. PII is not permitted to be stored on Desktop computers, laptops, USB drives, DVDs, CDs or any other form of portable media. In unusual circumstances PII may be stored on portable media with the written authorization of the EMCBC Director or designee. Such authorizations will expire after 90 days, at which time the media will need to be returned to IRM for disposition, or renewal of the authorization is required. Personnel authorized to transport such data will be required to receive additional training to ensure a full understanding of the ramifications of transporting PII. Annual Cyber Security Awareness training, required for all users, will describe PII in detail to provide a clear understanding of the special restrictions and rigorous reporting requirements for PII Type II Data: Information in this category is designated by the Content Manager or Content Owner. The data is usually made up of sensitive business information that, if compromised, could lead to an unfair competitive advantage, divulge sensitive legal position, or expose other confidential information. The Content Owner is responsible for the designation of all Type II data. The following controls apply: 2
3 All data stored on laptops shall be encrypted. USB Drives and other portable media shall be protected by encryption. Remote access to EMCBC file storage and applications containing Type II data shall utilize two-factor authentication and conform to the time-out requirements of the references listed in Section Type III Data: Information in this category is designated by the Content Manager or Content Owner. The goal of this is to protect data integrity and add a level of confidentiality, or screen information from the general public. Certain types of Business Sensitive Data may fall into this category. The following controls apply: USB Drives and other portable media shall be protected by encrypting the device with Lumension Endpoint Security. Remote access shall require two-factor authentication Type IV Data: Information that is or can be made available to the general public without restriction. Data integrity to ensure accurate communications is the goal of this information control. The following controls apply: Data posted to websites are controlled by the Content Owner or Content Manager. Data integrity for web servers and other public facing information systems is maintained by the security controls imposed by the System Owner as part of the Accreditation Boundary. 3.3 Reporting of Data Security Issues: All users responsible for the control or transportation of Type I and Type II Data shall immediately report any loss or potential compromise of the data to the ADIRM. (Note: This reporting shall be done within 30 minutes of any possible loss or breach of PII Data.) All responses to loss of data control will be handled by IRM in accordance with Incident Response procedures. 3.4 Training: All users handling Type I and Type II Data shall receive specific training in the use of encryption and data protection systems. All laptop users will receive training on the use of laptop locking and encryption devices and systems. General User training will address the controls for Type III and Type IV Data. 3
4 Type Definition Summary Chart on Controls for Electronic Information Control I-PII Data defined as PII by regulation or requirement. Data is only stored on network storage devices. Access is controlled by network credentials. Special authorization required for transportation on mobile devices. Users receive special training to ensure protection of this data. I II III IV Data that has been specifically defined as needing encryption by requirement such as Sensitive Unclassified Information. Business Sensitive Data Data that has a direct bearing on business decisions that if compromised could result in an unfair advantage to parties conducting business or in legal action with the Department. Type II data is designated by the Content Owner. Information about Business Sensitive Data that requires protection to ensure data integrity and a level of confidentiality, or data that needs to be screened from the general public. Type III data is designated by the Content Owner. Public data that may be released at any time. Web site data makes up the bulk of this data. Data is stored or transported encrypted as required and requires two-factor authentication for remote access. Users receive special training to ensure protection of this data. Data access is controlled through the network and requires two-factor authentications for remote access. Data is protected by encryption in transport. Data access is controlled through the network and requires two-factor authentication for remote access. Files transported on removable media should be protected by password. Data access is controlled through the network. Data is posted to the web as directed by the Content Manager. Precautions are taken to ensure data integrity. 4.0 References 4.1. Office of Management and Budget Memorandum M-06-16, Protection of Sensitive Agency Information, dated June 23, DOE O 205.1B, Department of Energy Cyber Security Program 4
5 4.3. DOE EM Risk Management Approach Implementation Plan (RMAIP) PO-IRM , Rev EMCBC IMP-IRM , Software Application Development and Management 4.5. EMCBC PP-IRM , Cyber Security System Security Plan (SSP) for General Support System (GSS) AC-19, Access Control for Mobile Devices MP-4, Media Storage MP-5, Media Transport 5.0 Definitions Definitions are located at the top of the Management System Description page. 5
6 EMCBC RECORD OF REVISION Document Title: DIGITAL AUTHORIZATION IN APPLICATIONS AND DATABASES If there are changes to the controlled document before the two-year review cycle, the revision number stays the same; one of the following will indicate the change: l or Placing a vertical black line in the margin adjacent to sentence or paragraph that was revised, l Placing the words GENERAL REVISION at the beginning of the text. This statement is used when entire sections of the document are revised. If changes and updates occur at the two-year review cycle, the revision number increases by one. Rev. No. Description of Changes Revision on Pages Date 0 Format revision N/A 12/16/15 FM-OD-410B-02-F1 Rev. 0 6
Environmental Management Consolidated Business Center (EMCBC) Subject: Policy on the Control of Unclassified Electronic Information
Date 06/10/2010 Environmental Management Consolidated Business Center (EMCBC) Subject: Policy on the Control of Unclassified Electronic Information Policy Statement APPROVED: (Signature on File) EMCBC
Policy: Email Retention, Storage and Archiving
Management System: Information Resource Management (IRM) Subject Area Description: Computer Systems Management (Including Help Desk) Policy: Email Retention, Storage and Archiving Management System Owner:
Environmental Management Consolidated Business Center (EMCBC) Subject: Cyber Security Incident Response
Date 06/10/10 Environmental Management Consolidated Business Center (EMCBC) Subject: Cyber Security Incident Response 1.0 PURPOSE Implementing Procedure APPROVED: (Signature on File) EMCBC Director ISSUED
Environmental Management Consolidated Business Center (EMCBC) Subject: Email Retention, Storage and Archiving
Date: 1/1/01 Environmental Management Consolidated Business Center (EMCBC) Subject: Email Retention, Storage and Archiving POLICY APPROVED: (Signature on File) EMCBC Director ISSUED BY: Office of Information
POLICIES. Campus Data Security Policy. Issued: September, 2009 Responsible Official: Director of IT Responsible Office: IT Central.
POLICIES Campus Data Security Policy Issued: September, 2009 Responsible Official: Director of IT Responsible Office: IT Central Policy Statement Policy In the course of its operations, Minot State University
Securing Corporate Data and Making Life Easier for the IT Admin Benefits of Pre Boot Network Authentication Technology
20140115 Securing Corporate Data and Making Life Easier for the IT Admin Benefits of Pre Boot Network Authentication Technology TABLE OF CONTENTS What s at risk for your organization? 2 Is your business
Appendix H: End User Rules of Behavior
Appendix H: End User Rules of Behavior 1. Introduction The Office of Management and Budget (OMB) has established the requirement for formally documented Rules of Behavior as set forth in OMB Circular A-130.
State of South Carolina Policy Guidance and Training
State of South Carolina Policy Guidance and Training Policy Workshop All Agency Mobile Security July 2014 Agenda Questions & Follow-Up Policy Workshop Overview & Timeline Policy Overview: Mobile Security
Telemedicine HIPAA/HITECH Privacy and Security
Telemedicine HIPAA/HITECH Privacy and Security 1 Access Control Role Based Access The organization shall provide secure rolebased account management. Privileges granted utilizing the principle of least
7 VITAL FACTS ABOUT HEALTHCARE BREACHES. www.eset.com
7 VITAL FACTS ABOUT HEALTHCARE BREACHES www.eset.com 7 vital facts about healthcare breaches Essential information for protecting your business and your patients Large breaches of Personal Health Information
Initial Cyber Security Briefing
Initial Cyber Security Briefing For New Hires, Visitors, and Contractors NT 75.20 Chief Information Officer Division Cyber Security Department GOAL Introduce cyber security requirements at Pantex as outlined
Privacy Impact Assessment. For. Non-GFE for Remote Access. Date: May 26, 2015. Point of Contact and Author: Michael Gray michael.gray@ed.
For Non-GFE for Remote Access Date: May 26, 2015 Point of Contact and Author: Michael Gray michael.gray@ed.gov System Owner: Allen Hill allen.hill@ed.gov Office of the Chief Information Officer (OCIO)
Information Security Policy for Associates and Contractors
Policy for Associates and Contractors Version: 1.12 Status: Issued Date: 30 July 2015 Reference: 61418080 Location: Livelink Review cycle: Annual Contents Introduction... 3 Purpose... 3 Scope... 3 Responsibilities...
FileCloud Security FAQ
is currently used by many large organizations including banks, health care organizations, educational institutions and government agencies. Thousands of organizations rely on File- Cloud for their file
DRAFT Standard Statement Encryption
DRAFT Standard Statement Encryption Title: Encryption Standard Document Number: SS-70-006 Effective Date: x/x/2010 Published by: Department of Information Systems 1. Purpose Sensitive information held
Sample Data Security Policies
This document provides three example data security policies that cover key areas of concern. They should not be considered an exhaustive list but rather each organization should identify any additional
Protecting Personal Information: The Massachusetts Data Security Regulation (201 CMR 17.00)
Protecting Personal Information: The Massachusetts Data Security Regulation (201 CMR 17.00) May 15, 2009 LLP US Information Security Framework Historically industry-specific HIPAA Fair Credit Reporting
Management System: Office of Human Resources Program Description: EMCBC Career and Leadership Development Program
Management System: Office of Human Resources Program Description: EMCBC Career and Leadership Development Program Issue Date: 11/8/13 Revision Number: 1 Management System Owner: Assistant Director, Office
What Consumers Believe About Cloud File Sharing & Why That s a Warning to IT Pros
20151019 What Consumers Believe About Cloud File Sharing & Why That s a Warning to IT Pros TABLE OF CONTENTS THE ELEPHANT IN THE ROOM 3 ADDRESSING EMPLOYEE CLOUD SECURITY PERCEPTIONS 4 1) COMPLETELY BLOCK
HIPAA Compliance (DSHS and HCA) Preamble: This section of the Contract is the Business Associate Agreement as
HIPAA Compliance (DSHS and HCA) Preamble: This section of the Contract is the Business Associate Agreement as required by HIPAA. 1. Definitions. a. Business Associate, as used in this Contract, means the
University of California, Riverside Computing and Communications. IS3 Local Campus Overview Departmental Planning Template
University of California, Riverside Computing and Communications IS3 Local Campus Overview Departmental Planning Template Last Updated April 21 st, 2011 Table of Contents: Introduction Security Plan Administrative
State of Vermont. User Password Policy and Guidelines
State of Vermont User Password Policy and Guidelines Date of Rewrite Approval: 10/2009 Originally Approved: 4/08/2005 Approved by: Neale F. Lunderville Policy Number: fib lleul~ 1.0 Introduction... 3 1.1
Congregation Identity Theft Education Program
Congregation Identity Theft Education Program Definition - PII Personal Identity Information (PII) is defined as any data that can be used by a third party to steal an individual s or entity s identity
Department of Defense INSTRUCTION. Security of Unclassified DoD Information on Non-DoD Information Systems
Department of Defense INSTRUCTION NUMBER 8582.01 June 6, 2012 DoD CIO SUBJECT: Security of Unclassified DoD Information on Non-DoD Information Systems References: See Enclosure 1 1. PURPOSE. This Instruction:
Procedure: Electronic Discovery
Management System: Office of Chief Counsel Subject Area: Support and Information Access Procedure: Electronic Discovery Issue Date and Revision Number: 1/6/15 0 Lead Subject Matter Expert: Jay Jalovec
University for the Creative Arts. Mobile Working and Remote Access Policy
Mobile Working and Remote Access Policy Version 1.0 Date: 20 July 2009 Document History Version History 1.0 20 July 2009 Approved for publication by the IS Board after E&FC approval in June 2009 Title:
Checklist to Assess Security in IT Contracts
Checklist to Assess Security in IT Contracts Federal Agencies that outsource or contract IT services or solutions must determine if security is adequate in existing and new contracts. Executive Summary
HIPAA PRIVACY AND SECURITY AWARENESS. Covering Kids and Families of Indiana April 10, 2014
HIPAA PRIVACY AND SECURITY AWARENESS Covering Kids and Families of Indiana April 10, 2014 GOALS AND OBJECTIVES The goal is to provide information to you to promote personal responsibility and behaviors
Research Information Security Guideline
Research Information Security Guideline Introduction This document provides general information security guidelines when working with research data. The items in this guideline are divided into two different
Policies and Procedures for Electronic Protected Health Information (ephi) and Personally Identifiable Information (PII)
Policies and Procedures for Electronic Protected Health Information (ephi) and Personally Identifiable Information (PII) Effective Date: April 10, 2012 Prepared by: Joe Raschke (IT) Table of Contents Purpose
Driving Company Security is Challenging. Centralized Management Makes it Simple.
Driving Company Security is Challenging. Centralized Management Makes it Simple. Overview - P3 Security Threats, Downtime and High Costs - P3 Threats to Company Security and Profitability - P4 A Revolutionary
Security Management. Keeping the IT Security Administrator Busy
Security Management Keeping the IT Security Administrator Busy Dr. Jane LeClair Chief Operating Officer National Cybersecurity Institute, Excelsior College James L. Antonakos SUNY Distinguished Teaching
HIPAA TRAINING. A training course for Shiawassee County Community Mental Health Authority Employees
HIPAA TRAINING A training course for Shiawassee County Community Mental Health Authority Employees WHAT IS HIPAA? HIPAA is an acronym that stands for Health Insurance Portability and Accountability Act.
The Information Security Tool Kit Think secure
The Information Security Tool Kit Think secure Password Protecting Your Printing - Aficio MP C5000 To ensure your print job is not lying around the printer and to keep your information secure, you can
IBM Data Security Services for endpoint data protection endpoint encryption solution
Protecting data on endpoint devices and removable media IBM Data Security Services for endpoint data protection endpoint encryption solution Highlights Secure data on endpoint devices Reap benefits such
Policies and Procedures. Policy on the Use of Portable Storage Devices
Policies and Procedures Policy on the Use of Date Approved by Trust Board Version Issue Date Review Date Lead Person One May 2008 Dec 2012 Head of ICT Two Dec 2012 Dec 2014 Head of ICT Procedure /Policy
Data at Rest Security in Navy/NMCI. Steven Gillis ONR Information Assurance Manager 10 January 2008
Data at Rest Security in Navy/NMCI Steven Gillis ONR Information Assurance Manager 10 January 2008 Agenda Data at Rest Security What is it? What are the policies? Existing Solutions in Navy Do DAR solutions
Congregation Data Security Education
Congregation Data Security Education Data Security Risks Incoming and Outgoing Internet Traffic Remote Access Outbound Email Improperly Discarded Paper Portable Media Devices (i.e. laptops, flash drives,
Information Security Program Management Standard
State of California California Information Security Office Information Security Program Management Standard SIMM 5305-A September 2013 REVISION HISTORY REVISION DATE OF RELEASE OWNER SUMMARY OF CHANGES
SERVER, DESKTOP AND PORTABLE SECURITY. September 2014. Version 3.0
SERVER, DESKTOP AND PORTABLE SECURITY September 2014 Version 3.0 Western Health and Social Care Trust Page 1 of 6 Server, Desktop and Portable Policy Title SERVER, DESKTOP AND PORTABLE SECURITY POLICY
Information Security Risk Assessment Checklist. A High-Level Tool to Assist USG Institutions with Risk Analysis
Information Security Risk Assessment Checklist A High-Level Tool to Assist USG Institutions with Risk Analysis Updated Oct 2008 Introduction Information security is an important issue for the University
FIVE KEY CONSIDERATIONS FOR ENABLING PRIVACY IN HEALTH INFORMATION EXCHANGES
FIVE KEY CONSIDERATIONS FOR ENABLING PRIVACY IN HEALTH INFORMATION EXCHANGES The implications for privacy and security in the emergence of HIEs The emergence of health information exchanges (HIE) is widely
MINNESOTA STATE STANDARD
Version: 1.00 Approved Date: 4/29/2011 Approval: Signature on file MINNESOTA STATE STANDARD From the Office of Carolyn Parnell Chief Information Officer, State of Minnesota Enterprise Security Portable
OIT OPERATIONAL PROCEDURE
OIT OPERATIONAL PROCEDURE Title: DATA CLASSIFICATION GUIDELINES Identification: OIT 1 Page: 1 of 5 Effective Date: 3/31/2014 Signature/Approval: Guidelines and Handling Procedure (9 10 ) specifies that
Additional Security Considerations and Controls for Virtual Private Networks
CYBER SECURITY OPERATIONS CENTRE APRIL 2013 (U) LEGAL NOTICE: THIS PUBLICATION HAS BEEN PRODUCED BY THE DEFENCE SIGNALS DIRECTORATE (DSD), ALSO KNOWN AS THE AUSTRALIAN SIGNALS DIRECTORATE (ASD). ALL REFERENCES
Identity and Access Management Initiatives in the United States Government
Identity and Access Management Initiatives in the United States Government Executive Office of the President November 2008 Importance of Identity Management within the Federal Government "Trusted Identity"
WHITE PAPER: MASSACHUSETTS DATA SECURITY REGULATIONS
WHITE PAPER: MASSACHUSETTS DATA SECURITY REGULATIONS Introduction Massachusetts regulations set forth minimum requirements for both the protection of personal information and the electronic storage or
How To Protect Your Information From Being Hacked By A Hacker
DOL New Hire Training: Computer Security and Privacy Table of Contents Introduction Lesson One: Computer Security Basics Lesson Two: Protecting Personally Identifiable Information (PII) Lesson Three: Appropriate
Smith College Information Security Risk Assessment Checklist
Smith College Information Security Risk Assessment Checklist This form contains a checklist for individual data handlers who are conducting an information security risk assessment of their work environment.
SURVEY RESULTS CYBER-SECURITY PRACTICES OF MINNESOTA REGISTERD INVESTMENT ADVISERS
SURVEY RESULTS CYBER-SECURITY PRACTICES OF MINNESOTA REGISTERD INVESTMENT ADVISERS Minnesota Department of Commerce July 2014 GENERIC FIRM INFORMATION Has your firm been the subject of a cyber-security
I ve been breached! Now what?
I ve been breached! Now what? THE AFTERMATH OF A BREACH & STEPS TO REDUCE RISK The number of data breaches in the United States in 2014 hit a record high. And 2015 is not looking any better. There have
The University of Texas Rio Grande Valley. Network Security. Create a Virtual Private. Network (VPN) Connection. Network Security How-to:
Create a Virtual Private Network (VPN) Connection 1 Virtual Private Network (VPN) The VPN service provides secure (encrypted) off-campus connection to access University resources. Use VPN to access Oracle
Ixion Group Policy & Procedure. Remote Working
Ixion Group Policy & Procedure Remote Working Policy Statement The Ixion Group (Ixion) provide laptops and other mobile technology to employees who have a business requirement to work away from Ixion premises
Hengtian Information Security White Paper
Hengtian Information Security White Paper March, 2012 Contents Overview... 1 1. Security Policy... 2 2. Organization of information security... 2 3. Asset management... 3 4. Human Resources Security...
Network Infrastructure - General Support System (NI-GSS) Privacy Impact Assessment (PIA)
Network Infrastructure - General Support System (NI-GSS) Privacy Impact Assessment (PIA) System Categorization: Moderate Version 1.5 May 30, 2013 Prepared by: Security & Compliance Services (SCS) and Infrastructure
Healthcare IT (HIT) Strategic Planning & Budgeting MARCH 26, 2014
Healthcare IT (HIT) Strategic Planning & Budgeting MARCH 26, 2014 Agenda Introduction / Session Overview HIT Budgeting 101 Security and Compliance EHR budgeting HIT Where Are We Going Q & A 2 Copyright
FEDERAL ELECTION COMMISSION OFFICE OF INSPECTOR GENERAL
FEDERAL ELECTION COMMISSION OFFICE OF INSPECTOR GENERAL FINAL REPORT Audit of the Federal Election Commission s Fiscal Year 2012 Financial Statements November 2012 ASSIGNMENT No. OIG-12-03 FEDERAL ELECTION
SAD: Critical Decision and Change Control Management
Management System: Project Management Subject Area: Critical Decision and Change Control Management Management System Owner: Terry Brennan Point of Contact: Sue Smiley Issue Date: 2/26/15 CBC MS Revision:
Name: Position held: Company Name: Is your organisation ISO27001 accredited:
Third Party Information Security Questionnaire This questionnaire is to be completed by the system administrator and by the third party hosting company if a separate company is used. Name: Position held:
IDENTITY & ACCESS. Privileged Identity Management. controlling access without compromising convenience
IDENTITY & ACCESS Privileged Identity Management controlling access without compromising convenience Introduction According to a recent Ponemon Institute study, mistakes made by people Privilege abuse
The Contractor's Responsibility - Preventing Improper Information Process
BRIGHT HORIZONS BASELINE THIRD PARTY SECURITY REQUIREMENTS Version 1.0 (updated March 2015) Contents SECTION 1:... 3 REQUIREMENTS INTRODUCTION AND BACKGROUND... 3 1. SUMMARY... 3 2. DEFINITIONS... 3 3.
MOBILE DEVICE SECURITY POLICY
State of Illinois Department of Central Management Services MOBILE DEVICE SECURITY Effective: October 01, 2009 State of Illinois Department of Central Management Services Bureau of Communication and Computer
Bring Your Own Device Policy. Report to the Joint Legislative Oversight Committee on Information Technology
Bring Your Own Device Policy Report to the Joint Legislative Oversight Committee on Information Technology Chris Estes State Chief Information Officer March 2014 This page left blank intentionally Contents
MONTSERRAT COLLEGE OF ART WRITTEN INFORMATION SECURITY POLICY (WISP)
MONTSERRAT COLLEGE OF ART WRITTEN INFORMATION SECURITY POLICY (WISP) 201 CMR 17.00 Standards for the Protection of Personal Information Of Residents of the Commonwealth of Massachusetts Revised April 28,
Data Security Policy
Policy Number: Revision Number: 0 QP1.44 Date of issue: March 2009 Status: Approved Date of approval: April 2009 Responsibility for policy: Responsibility for implementation: Responsibility for review:
WIRELESS LOCAL AREA NETWORK (WLAN) IMPLEMENTATION
United States Department of Agriculture Marketing and Regulatory Programs Grain Inspection, Packers and Stockyards Administration Directive GIPSA 3140.5 11/30/06 WIRELESS LOCAL AREA NETWORK (WLAN) IMPLEMENTATION
BYOD BEST PRACTICES GUIDE
BYOD BEST PRACTICES GUIDE 866.926.8746 1 www.xantrion.com TABLE OF CONTENTS 1 Changing Expectations about BYOD... 3 2 Mitigating the Risks... 4 2.1 Establish Clear Policies and Expectations... 4 2.2 Create
UCI FISMA Core Program Procedures & Processes Frequently Asked Questions (FAQs)
Health Affairs Information Systems University of California, Irvine UCI FISMA Core Program Procedures & Processes Frequently Asked Questions (FAQs) April 11, 2012 Version 1.1 HAIS Coordination Copy The
Georgia Institute of Technology Data Protection Safeguards Version: 2.0
Data Protection Safeguards Page 1 Georgia Institute of Technology Data Protection Safeguards Version: 2.0 Purpose: The purpose of the Data Protection Safeguards is to provide guidelines for the appropriate
Small Business IT Risk Assessment
Small Business IT Risk Assessment Company name: Completed by: Date: Where Do I Begin? A risk assessment is an important step in protecting your customers, employees, and your business, and well as complying
Wellesley College Written Information Security Program
Wellesley College Written Information Security Program Introduction and Purpose Wellesley College developed this Written Information Security Program (the Program ) to protect Personal Information, as
Practice Good Enterprise Security Management. Presented by Laurence CHAN, MTR Corporation Limited
Practice Good Enterprise Security Management Presented by Laurence CHAN, MTR Corporation Limited About Me Manager Information Security o o o o Policy formulation and governance Incident response Incident
PROCESSING CLASSIFIED INFORMATION ON PORTABLE COMPUTERS IN THE DEPARTMENT OF JUSTICE
PROCESSING CLASSIFIED INFORMATION ON PORTABLE COMPUTERS IN THE DEPARTMENT OF JUSTICE U.S. Department of Justice Office of the Inspector General Audit Division Audit Report 05-32 July 2005 PROCESSING CLASSIFIED
DHHS Information Technology (IT) Access Control Standard
DHHS Information Technology (IT) Access Control Standard Issue Date: October 1, 2013 Effective Date: October 1,2013 Revised Date: Number: DHHS-2013-001-B 1.0 Purpose and Objectives With the diversity of
Altius IT Policy Collection Compliance and Standards Matrix
Governance IT Governance Policy Mergers and Acquisitions Policy Terms and Definitions Policy 164.308 12.4 12.5 EDM01 EDM02 EDM03 Information Security Privacy Policy Securing Information Systems Policy
RSA Solution Brief RSA. Encryption and Key Management Suite. RSA Solution Brief
RSA Encryption and Key Management Suite The threat of experiencing a data breach has never been greater. According to the Identity Theft Resource Center, since the beginning of 2008, the personal information
2012 Endpoint Security Best Practices Survey
WHITE PAPER: 2012 ENDPOINT SECURITY BEST PRACTICES SURVEY........................................ 2012 Endpoint Security Best Practices Survey Who should read this paper Small and medium business owners
Did security go out the door with your mobile workforce? Help protect your data and brand, and maintain compliance from the outside
Help protect your data and brand, and maintain compliance from the outside September 2006 Copyright 2006 Entrust. All rights reserved. Entrust is a registered trademark of Entrust, Inc. in the United States
SECURITY FOR ENTERPRISE TELEWORK AND REMOTE ACCESS SOLUTIONS
SECURITY FOR ENTERPRISE TELEWORK AND REMOTE ACCESS SOLUTIONS Karen Scarfone, Editor Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Many people
Kaspersky Lab s Full Disk Encryption Technology
Kaspersky Lab s Full Disk Encryption Technology In the US alone, an estimated 12,000 laptops are lost or stolen each week. According to the Ponemon Institute, a laptop is stolen every 53 seconds; more
General Rules of Behavior for Users of DHS Systems and IT Resources that Access, Store, Receive, or Transmit Sensitive Information
General Rules of Behavior for Users of DHS Systems and IT Resources that Access, Store, Receive, or Transmit Sensitive Information The following rules of behavior apply to all Department of Homeland Security
PCI General Policy. Effective Date: August 2008. Approval: December 17, 2015. Maintenance of Policy: Office of Student Accounts REFERENCE DOCUMENTS:
Effective Date: August 2008 Approval: December 17, 2015 PCI General Policy Maintenance of Policy: Office of Student Accounts PURPOSE: To protect against the exposure and possible theft of account and personal
Estate Agents Authority
INFORMATION SECURITY AND PRIVACY PROTECTION POLICY AND GUIDELINES FOR ESTATE AGENTS Estate Agents Authority The contents of this document remain the property of, and may not be reproduced in whole or in
This policy applies to all DRC employees, contractors, volunteers, interns and other agents of the state.
STATE OF OHIO SUBJECT: PAGE 1 OF 9 DRC Sensitive Data Security Requirements NUMBER: 05-OIT-23 DEPARTMENT OF REHABILITATION AND CORRECTION RULE/CODE REFERENCE: RELATED ACA STANDARDS: SUPERSEDES: 05-OIT-23
Montclair State University. HIPAA Security Policy
Montclair State University HIPAA Security Policy Effective: June 25, 2015 HIPAA Security Policy and Procedures Montclair State University is a hybrid entity and has designated Healthcare Components that
SmartHIPAA! 5 simple and inexpensive tips to protect patient information
SmartHIPAA! 5 simple and inexpensive tips to protect patient information 5 simple and inexpensive tips to protect patient information HIPAA security guidelines can be confusing and compliance expensive.
Your Agency Just Had a Privacy Breach Now What?
1 Your Agency Just Had a Privacy Breach Now What? Kathleen Claffie U.S. Customs and Border Protection What is a Breach The loss of control, compromise, unauthorized disclosure, unauthorized acquisition,
Society for Information Management
Society for Information Management The Projected Top 5 Security Issues of 2010 Steve Erdman CSO and Staff Security Consultant of SecureState Network +, MCP Precursor 2009 has been a difficult year in Information
ITS Policy Library. 11.06 - Device Encryption. Information Technologies & Services
ITS Policy Library 11.06 - Device Encryption Information Technologies & Services Responsible Executive: Chief Information Officer, WCMC Original Issued: July 15, 2008 Last Updated: November 21, 2014 POLICY
This policy outlines different requirements for the use of PSDs based on the classification of information.
POLICY OFFICE OF THE INFORMATION COMMISSIONER Use of portable storage devices 1. Purpose A Portable Storage Device (PSD) is a mobile device capable of storing and transferring digital information. Examples
AB 1149 Compliance: Data Security Best Practices
AB 1149 Compliance: Data Security Best Practices 1 Table of Contents Executive Summary & Overview 3 Data Security Best Practices 4 About Aurora 10 2 Executive Summary & Overview: AB 1149 is a new California
Eclypt Secure Data-At-Rest Encrypted Hard Drives and Media Encryptors
Eclypt Secure Data-At-Rest Encrypted Hard Drives and Media Encryptors Eclypt Hard Drive Encryption ACCREDITED DATA-AT-REST SECURITY HARDWARE IS YOUR DATA SAFE FROM BREACH? THINK AGAIN.» A laptop is stolen
School of Anthropology and Museum Ethnography & School of Interdisciplinary Area Studies Information Security Policy
School of Anthropology and Museum Ethnography & School of Interdisciplinary Area Studies Information Security Policy Page 1 of 10 Contents 1 Preamble...3 2 Purpose...3 3 Scope...3 4 Roles and responsibilities...3
'Namgis First Nation. 1.0 Overview. 2.0 Purpose. 3.0 Scope. 4.0 Policy
Created: 2/18/2011 Page 1 of 8 'Namgis First Nation is hereinafter referred to as "the government." 1.0 Overview Though there are a number of reasons to provide a user network access, by far the most common
Cyber Safety Use Agreement - ICT at School
Cyber Safety Use Agreement Year 4 to Year 7 students Dear Parents and Caregivers, To assist us to enhance learning through the safe use of information and communication technologies (ICTs), we are now
INFORMATION SECURITY GUIDE. Employee Teleworking. Information Security Unit. Information Technology Services (ITS) July 2013
INFORMATION SECURITY GUIDE Employee Teleworking Information Security Unit Information Technology Services (ITS) July 2013 CONTENTS 1. Introduction... 2 2. Teleworking Risks... 3 3. Safeguards for College
A Buyer's Guide to Data Loss Protection Solutions
A Buyer's Guide to Data Loss Protection Solutions 2010 Websense, Inc. All rights reserved. Websense is a registered trademark of Websense, Inc. in the United States and certain international markets. Websense
The Department of Health and Human Services Privacy Awareness Training. Fiscal Year 2015
The Department of Health and Human Services Privacy Awareness Training Fiscal Year 2015 Course Objectives At the end of the course, you will be able to: Define privacy and explain its importance. Identify
SAFEGUARDING PRIVACY IN A MOBILE WORKPLACE
SAFEGUARDING PRIVACY IN A MOBILE WORKPLACE Checklist for taking personally identifiable information (PII) out of the workplace: q Does your organization s policy permit the removal of PII from the office?