CLOUD STORAGE POLICY IT-P-013
|
|
|
- Anis Lawrence
- 8 years ago
- Views:
Transcription
1 IT-P-013 Date: 31 5 tjuly, 2014
2 A memberof, LAUREATE t'l RNM y"a V,'Vr~SITli:S Stamford International University Usage Policy Purpose The purpose ofthis policy is to provide advice and establish best-practices for appropriate usage of cloud computing servi ces to support the processing, storage, and management of Institutional data at Stamford International University (henceforth, referred to as "Stamford" or "STIU"). This policy also outlines any limitations I restrictions placed on usage of such services for sharing sensitive Institutional I Corporate Data (henceforth, referred to as "Institutional Data"). Scope This policy applies to all employees of STIU in all locations including the temporary employees, part-time and contractors. This policy concerns cloud computing resources that provide services, platforms, and infrastructure that provide support for a wide range of activities involving the processing, exchange, storage, or management of institutional data. This policy does not cover the use of social media services, which is addressed in other policies. Policy Information Responsible Office: Department of Information Technology, Stamford International University Issued Date: July,
3 Revision History Revision Number Document Number 00 IT-P-013 New Release Description Effective Date 31 st july, 2014 Revision: The University reserves the right to change this policy from time to time. Proposed changes will normally be developed by the policy managers with appropriate stakeholders. The review entities have sole authority to approve changes to this policy. 3
4 Recommendation and Approvals Drafted by: Name: Position: Date: Chava nath Chatchaiyan Technology Services Manager 3P 1 July, 2014 Approved by: Name: Position: Date: Sourjya Sankar Sen Director, Information Technology 3P 1 july, 2014 c; XL _ Name: Position: Date: Gilles Mahe CEO, Stamford International University 31S 1 july, 2014,&_~_: Name: Position: Date: Dr. Boon mark Sirinaovakul President, Stamford International University 31S 1 July,
5 Policy Overview Cloud computing services are application and infrastructure resources that users access via the internet. These services, contractually provided by companies such as Apple, Google, Microsoft, and Amazon, enable customers to leverage powerful computing resources that would otherwise be beyond their means to purchase and support. Cloud services provide services, platforms, and infrastructure to support a wide range of business activities. These services support, among other things, communication; collaboration; project management; scheduling; and data analysis, processing, sharing, and storage. Cloud computing services are generally easy for people and organizations to use, they are accessible over the internet through a variety of platforms (workstations, laptops, tablets, and smart phones), and they may be able to accommodate spikes in demand much more readily and efficiently than in-house computing services. For more details about cloud computing see: Wikipedia's definition of Cloud Computing. Acquiring Cloud Computing Services Most cloud services, such as Google Docs, Dropbox, Box etc. make it easy for individuals to signup and use (self-provision) their services via an end user license agreement (EULA), often at no monetary cost. STIU also centrally acquires cloud services for use by members of the Stamford community. Stamford faculty, staff, and administrators must be very cautious about self-provisioning a cloud service to process, share, store, or otherwise manage institutional data. Self-provisioned cloud services are often unvetted environments with significant unmeasured risks or are subject to changes in risk with or without notice. Virtually all cloud services require individual users to accept click-through agreements. These end-user license agreements do not allow users to negotiate terms, do not provide the opportunity to clarify terms, often provide vague descriptions of services and safeguards, and often change without notice. Risks with using self-provisioned cloud services include: Unclear, and potentially poor access control or general security provisions Sudden loss of service without notification Sudden loss of data without notification Data stored, processed, or shared on cloud service are often mined for resale to third parties that may compromise people's privacy 6
6 The exclusive intellectual rights to the data stored, processed, or shared on cloud service may become compromised. In contrast, Stamford negotiates agreements with service providers for locally as well as centrally provisioned services. The terms of these services are more clearly defined and well known by the University. In short, university provisioned cloud services are vetted environments whose risks are better measured and accepted by Stamford International University. Faculty, staff, and administrators may not self-provision cloud services to store, process, share, or manage regulated Institutional Data. Regulated institutional data are data that are regulated by information privacy or protection laws, regulations, contracts, binding agreements (such as non-disclosure or data use agreements), or industry requirements. If your division, department, office, or lab is looking to provision a cloud service to support its work, it must mandatorily consult the Department of Information technology prior to subscribing to such services. If your division, department, office, or lab needs to provision a cloud service to store, process, share, or otherwise manage regulated institutional data, it must work with the Department of Information Technology and Stamford I Regional Legal Counsel in order to properly evaluate and manage the risks that come with using the service for regulated institutional data. This will help ensure that agreements with cloud service providers have the appropriate provisions, such as notification of changes to the service's protective measures and assurance that the service properly destroys deleted data. Contact information for the Department of Information Technology support@stamford.edu Using Cloud Computing Services Using a third party cloud service to handle institutional data does not absolve you from the responsibility of ensuring that the data is properly and securely managed. Members of the Stamford community are expected to responsibly maintain and use institutional data regardless of the resource used to access or store the data - whether an institutional system, a privately owned resource, or a third-party resource. The care taken to review a cloud services' security and trustworthiness must match the sensitivity of the institutional data you are looking to support with the service and the data's governing regulatory environment. In order to use a cloud service to store, process, share, or otherwise manage regulated institutional data, you must: Have a clear and compelling need for using a cloud service Work with Department of Information Technology and local I regional Legal Counsel to develop the appropriate contractual safeguards Have a clearly designated Information Manager from your division, department or office for the institutional data. An Information Manager is the individual charged "to ensure the responsible management and use of institutional data." Know the retention period and, when applicable, the destruction date of the institutional data. 7
7 CLOUDSTORAGEPOUCY These steps should also guide your use of cloud services for storing, processing, sharing, or otherwise managing other institutional data. Information Classification Framework The following table provides a simple framework for classifying institutional data as Regulated, Confidential, Administrative, or Public and can help in your decisions on appropriate solutions for storing and managing information. Confidentiality level Description Cloud Use Level A: Regulated I nstitutional Data All Institutional data that is governed by privacy or information protection mandates required by law, regulation, contract, binding agreement, or industry requirements. May not use self-provisioned cloud services to store, process, share, or otherwise manage regulated Institutional data without working with the IT Department & local I regional Legal Counsel to develop the appropriate contractual safeguards. Can only use a contractually (locally or centrally) provisioned cloud service once you have confirmed with your Information Manager, the IT Department and local I regional Legal Counsel that the service is appropriate for confidential institutional data. Not all centrally and locally provisioned services are designed to handle regulated data. Level B: Confidential Institutional Data Institutional data that is meant for a very limited distribution - available only to members of the Stamford community on a strictly need-to-know basis. Should not use self-provisioned cloud services to store, process, share, or otherwise manage confidential institutional data without ensuring that a service's safeguards are appropriate for confidential institutional data. Should only use a centrally or locally provisioned cloud service once you have confirmed with your Information Manager as well as the IT Department and local I regional Legal Counsel that the service is appropriate for confidential institutional data. Not all contractually provisioned services are designed to handle confidential 8
8 data. Level C: Administrative Institutional Data Institutional data that is meant for a limited distribution; available only to members of the Stamford community that need the data to support thei r work. Such data derives its value for Stamford in part from not being publically disclosed. Should not use self-provisioned cloud services to store, process, share, or otherwise manage administrative institutional data without ensuring that a service's safeguards are appropriate for administrative institutional data. Should only use a centrally or locally provisioned cloud service once you have confirmed with your Information Manager and IT Department that the service is appropriate for administrative institutional data. Not all contractually provisioned services are designed to handle administrative data. Level D: Public Institutional Data Institutional data that is meant for members of the Stamford community and in some cases wide and open distribution to the public at large. This institutional data does not contain confidential information. May use self-provisioned cloud services to store or manage public institutional data with caution. Should ensure that using these cloud services does not violate any licensing agreements. May use contractually provisioned cloud services to store or manage public institutional data. 9
Cloud Computing Policy 1.0 INTRODUCTION 2.0 PURPOSE. Effective Date: July 28, 2015
Cloud Computing Policy Effective Date: July 28, 2015 1.0 INTRODUCTION Cloud computing services are application and infrastructure resources that users access via the Internet. These services, contractually
USER ACCOUNT MANAGEMENT POLICY
USERS ACCOUNT MANAGEMENT POLICY f A member of ~~ INTCRNAT 0: ~t, UNIVCRSITICS' USER ACCOUNT MANAGEMENT POLICY IT-P-010 Date: March 3, 2014 USERS ACCOUNT MANAGEMENT POLICY f. Amemberof.olilllll ' INTtRN
IT BACKUP POLICY AND PROCEDURES IT-P-005
, LAUREATE A member of.oilllll I INT[RNATIONAL., UNIVERSITIES IT BACKUP POLICY AND PROCEDURES IT-P-005 Date: 7 November, 2013 , I LAUREATE A member of..1111111 INTERNATIONAL, UNIVERSITIES' Stamford International
IT-P-001 IT Helpdesk IT HELPDESK POLICY & PROCEDURE IT-P-001
IT HELPDESK POLICY & PROCEDURE IT-P-001 Date:25 September, 2013 Amemberof, LAUREATE I'.;TlRNAT'Oi'lAl. UWII[RSITIB Stamford International University Policy Policy Statement This Policy has been written
What Every User Needs To Know Before Moving To The Cloud. LawyerDoneDeal Corp.
What Every User Needs To Know Before Moving To The Cloud LawyerDoneDeal Corp. What Every User Needs To Know Before Moving To The Cloud 1 What is meant by Cloud Computing, or Going To The Cloud? A model
Information Security Policy
Information Security Policy Policy Title Responsible Executive Responsible Office Information Security Policy Vice President for Information Technology and CIO, Jay Dominick Office of Information Technology,
ACCEPTABLE USE POLICY
ACCEPTABLE USE POLICY Title: Information Security - Acceptable Use Policy Subject: Information Security Policy No: ISO: 2013:01 Applies: University-wide Issuing Authority: Vice President for Information
PATCH MANAGEMENT POLICY IT-P-016
IT-P-016 Date: 28 th March, 2016 Stamford International University ( STIU ) Patch Management Policy Rationale Stamford International University ( STIU ) is responsible for ensuring the confidentiality,
Office of the Chief Information Officer
Office of the Chief Information Officer Online File Storage BACKGROUND Online file storage services offer powerful and convenient methods to share files among collaborators, various computers, and mobile
CLOUD COMPUTING ISSUES FOR SCHOOL DISTRICTS. Presented to the 2013 BRADLEY F. KIDDER LAW CONFERENCE. October 2, 2013
CLOUD COMPUTING ISSUES FOR SCHOOL DISTRICTS Presented to the 2013 BRADLEY F. KIDDER LAW CONFERENCE October 2, 2013 By: Diane M. Gorrow Soule, Leslie, Kidder, Sayward & Loughman, P.L.L.C. 220 Main Street
LEEDS BECKETT UNIVERSITY. Information Security Policy. 1.0 Introduction
LEEDS BECKETT UNIVERSITY Information Security Policy 1.0 Introduction 1.1 Information in all of its forms is crucial to the effective functioning and good governance of our University. We are committed
Research Information Security Guideline
Research Information Security Guideline Introduction This document provides general information security guidelines when working with research data. The items in this guideline are divided into two different
Report of the Information & Privacy Commissioner/Ontario. Review of the Canadian Institute for Health Information:
Information and Privacy Commissioner of Ontario Report of the Information & Privacy Commissioner/Ontario Review of the Canadian Institute for Health Information: A Prescribed Entity under the Personal
Cloud Storage Policy (Draft for consultation)
(Draft for consultation) Please note that this draft is under consultation with stakeholders in colleges and university services, before refinement and approval by the appropriate University Committee.
Title: Data Security Policy Code: 1-100-200 Date: 11-6-08rev Approved: WPL INTRODUCTION
Title: Data Security Policy Code: 1-100-200 Date: 11-6-08rev Approved: WPL INTRODUCTION The purpose of this policy is to outline essential roles and responsibilities within the University community for
Montclair State University. HIPAA Security Policy
Montclair State University HIPAA Security Policy Effective: June 25, 2015 HIPAA Security Policy and Procedures Montclair State University is a hybrid entity and has designated Healthcare Components that
MICROSOFT OFFICE 365 PRIVACY IMPACT ASSESSMENT. Western Student E-Communications Outsourcing
MICROSOFT OFFICE 365 PRIVACY IMPACT ASSESSMENT Western Student E-Communications Outsourcing Paul Eluchok - University Privacy Officer David Ghantous - Associate Director of Technical Services Dated: August
IT Services. IT Services Standard. Data Storage Security
IT Services IT Services Standard Data Storage Security Revision and Review Revision History Version Version Date Status Summary of Changes Author 0.1 Mar 24, 2015 Draft Initial draft Kevin Vadnais 0.2
UNIVERSITY OF ROCHESTER INFORMATION TECHNOLOGY POLICY
PURPOSE The University of Rochester recognizes the vital role information technology plays in the University s missions and related administrative activities as well as the importance in an academic environment
CLOUD SERVICES RHUL CODE OF PRACTICE. Cloud Services RHUL Code of Practice
CLOUD SERVICES RHUL CODE OF PRACTICE Document Id Cloud Services RHUL Code of Practice Sponsor Laura Gibbs Author Nigel Rata Date December 2014 Version Control Log Version Date Change 1.0 10/10/12 Initial
Third Party Security Requirements Policy
Overview This policy sets out the requirements expected of third parties to effectively protect BBC information. Audience Owner Contacts This policy applies to all third parties and staff, including contractors,
Information Security Policy
Information Security Policy Policy Contents I. POLICY STATEMENT II. REASON FOR POLICY III. SCOPE IV. AUDIENCE V. POLICY TEXT VI. PROCEDURES VII. RELATED INFORMATION VIII. DEFINITIONS IX. FREQUENTLY ASKED
University of Alaska. Cloud Computing Guidelines
University of Alaska Cloud Computing Guidelines Guidelines for the Use of 3 rd Party or Cloud Computing Services at the University of Alaska Why is this important to me? If you manage a service and plan
Information Security Policy
Information Security Policy Contents Version: 1 Contents... 1 Introduction... 2 Anti-Virus Software... 3 Media Classification... 4 Media Handling... 5 Media Retention... 6 Media Disposal... 7 Service Providers...
Information Security Program
Stephen F. Austin State University Information Security Program Revised: September 2014 2014 Table of Contents Overview... 1 Introduction... 1 Purpose... 1 Authority... 2 Scope... 2 Information Security
Virginia Commonwealth University Information Security Standard
Virginia Commonwealth University Information Security Standard Title: Scope: Data Classification Standard This document provides the classification requirements for all data generated, processed, stored,
UNIVERSITY OF MAINE SYSTEM STANDARDS FOR SAFEGUARDING INFORMATION ATTACHMENT C
UNIVERSITY OF MAINE SYSTEM STANDARDS FOR SAFEGUARDING INFORMATION ATTACHMENT C This Attachment addresses the Contractor s responsibility for safeguarding Compliant Data and Business Sensitive Information
THE UNIVERSITY OF THE WEST INDIES Electronic Mail & Messaging Services Policy 1. Introduction
THE UNIVERSITY OF THE WEST INDIES Electronic Mail & Messaging Services Policy 1. Introduction In accordance with its broader strategic objectives, The University of the West Indies (the UWI) promotes the
How Microsoft is taking Privacy by Design to Work. Alan Chan National Technology Officer Microsoft Hong Kong 7 May 2015
How Microsoft is taking Privacy by Design to Work Alan Chan National Technology Officer Microsoft Hong Kong 7 May 2015 Agenda Introducing the New Microsoft Microsoft privacy principle Protecting privacy
Politique de sécurité de l information Information Security Policy
Politique de sécurité de l information Information Security Policy Adoptée par le Conseil d administration Le 10 novembre 2011 Adopted by the Board of Directors on November 10, 2011 Table of contents FOREWORD
technical factsheet 176
technical factsheet 176 Data Protection CONTENTS 1. Introduction 1 2. Register with the Information Commissioner s Office 1 3. Period protection rights and duties remain effective 2 4. The data protection
Acquia Comments on EU Recommendations for Data Processing in the Cloud
Acquia Comments on EU Recommendations for Data Processing in the Cloud Executive Summary On July 1, 2012, European Union (EU) data protection regulators provided guidelines for service providers processing
Information Governance Framework. June 2015
Information Governance Framework June 2015 Information Security Framework Janice McNay June 2015 1 Company Thirteen Group Lead Manager Janice McNay Date of Final Draft and Version Number June 2015 Review
Bring Your Own Device Policy
Bring Your Own Device Policy Purpose of this Document This document describes acceptable use pertaining to using your own device whilst accessing University systems and services. This document will be
Business Associate Agreement (BAA) Guidance
Business Associate Agreement (BAA) Guidance Introduction The purpose of this document is to provide guidance for creating or updating business associate agreements between your Practice ( Covered Entity
BUSINESS ASSOCIATE AGREEMENT
BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement ( Agreement ) by and between (hereinafter known as Covered Entity ) and Office Ally, LLC. (hereinafter known as Business Associate ), and
Policy No: TITLE: EFFECTIVE DATE: CANCELLATION: REVIEW DATE:
Policy No: TITLE: AP-AA-17.2 Data Classification and Data Security ADMINISTERED BY: Office of Vice President for Academic Affairs PURPOSE EFFECTIVE DATE: CANCELLATION: REVIEW DATE: August 8, 2005 Fall
UNIVERSITY OF MASSACHUSETTS RECORD MANAGEMENT, RETENTION AND DISPOSITION POLICY
DOC. T99-061 Passed by the BoT 8/4/99 UNIVERSITY OF MASSACHUSETTS RECORD MANAGEMENT, RETENTION AND DISPOSITION POLICY The President of the University shall adopt guidelines to require that each campus
ADDENDUM TO ADMINISTRATIVE SERVICES AGREEMENT FOR HIPAA PRIVACY/SECURITY RULES
ADDENDUM TO ADMINISTRATIVE SERVICES AGREEMENT FOR HIPAA PRIVACY/SECURITY RULES This Addendum is entered into effective as of, by and among Delta Dental of Virginia ("Business Associate"), and ( Covered
Wellesley College Written Information Security Program
Wellesley College Written Information Security Program Introduction and Purpose Wellesley College developed this Written Information Security Program (the Program ) to protect Personal Information, as
The supplier shall have appropriate policies and procedures in place to ensure compliance with
Supplier Instructions for Processing of Personal Data 1 PURPOSE SOS International has legal and contractual obligations on the matters of data protection and IT security. As a part of these obligations
PACIFIC EXPLORATION & PRODUCTION CORPORATION (the Corporation )
PRIVACY POLICY (Initially adopted by the Board of Directors on November 16, 2007) PACIFIC EXPLORATION & PRODUCTION CORPORATION (the Corporation ) The Corporation is committed to controlling the collection,
Accountability Model for Cloud Governance
Accountability Model for Cloud Governance Massimo Felici, Hewlett-Packard Laboratories CSP Forum 2014, Athens, 21-22 May 2014 Overview Problem of Data Governance Data Governance in the Cloud Accountability
I S O I E C 2 7 0 0 2 2 0 1 3 I N F O R M A T I O N S E C U R I T Y A U D I T T O O L
7.1 EMPHASIZE SECURITY PRIOR TO EMPLOYMENT 7.1.1 VERIFY THE BACKGROUNDS OF ALL NEW PERSONNEL Do you check the backgrounds of all candidates for employment? Do you make sure that background verifications
Check In Systems. Software Usage Agreement
Check In Systems Software Usage Agreement Usage of Check In Systems Inc. software shall constitute agreement with the following; You understand that you have the right to terminate or not use the software
Information Security Policy. Document ID: 3809 Version: 1.0 Owner: Chief Security Officer, Security Services
Information Security Policy Document ID: 3809 Version: 1.0 Owner: Chief Security Officer, Security Services Contents 1 Purpose / Objective... 1 1.1 Information Security... 1 1.2 Purpose... 1 1.3 Objectives...
Sample Business Associate Agreement (4. Other Bus. Assoc., Version 6-06-05)
Sample Business Associate Agreement (4. Other Bus. Assoc., Version 6-06-05) This Business Associate Agreement (the Agreement ) is entered into as of, 20, (the Effective Date ) by and between, (the Covered
What are the compliance challenges of Microsoft Office 365?
PROOFPOINT FOR OFFICE 365: ENABLES ADVANCED SECURITY AND COMPLIANCE FOR YOUR ENTERPRISE UNDERSTAND THE SOLUTION BY ROLE: COMPLIANCE What are the compliance challenges of Microsoft Office 365? Microsoft
Western Oregon University Information Security Manual v1.6
Table of Contents: 000 Introductory Material 001 Introduction Western Oregon University v1.6 Please direct comments to: Bill Kernan, Chief Information Security Officer 100 Information Security Roles and
Privacy Impact Assessment Of the. Office of Inspector General Information Technology Infrastructure Systems
Privacy Impact Assessment Of the Office of Inspector General Information Technology Infrastructure Systems Program or application name: Office of Inspector General Information Technology Infrastructure
Privacy and Security Incident Management Protocol
Our Vision Better data. Better decisions. Healthier Canadians. Our Mandate To lead the development and maintenance of comprehensive and integrated health information that enables sound policy and effective
Student Email Service Improvements Executive Background Brief
Student Email Service Improvements Executive Background Brief Executive Summary Despite the ubiquity of consumer email services and the fact that virtually all students coming to York have been using electronic
Central Texas College District Human Resource Management Operating Policies and Procedures Manual Policy No. 294: Computer Security Policy
Central Texas College District Human Resource Management Operating Policies and Procedures Manual Policy No. 294: Computer Security Policy I. PURPOSE To identify the requirements needed to comply with
Title: Number: Responsible Office: Last Revision:
Title: Number: Responsible Office: Last Revision: Cloud Computing: Opportunities Used Safely G4 004D Information Security and Privacy Office July 2011 The following guidance was developed and published
Contact: Henry Torres, (870) 972-3033
Information & Technology Services Management & Security Principles & Procedures Executive Summary Contact: Henry Torres, (870) 972-3033 Background: The Security Task Force began a review of all procedures
Acceptable Use Policy
Acceptable Use Policy TABLE OF CONTENTS PURPOSE... 4 SCOPE... 4 AUDIENCE... 4 COMPLIANCE & ENFORCEMENT... 4 POLICY STATEMENTS... 5 1. General... 5 2. Authorized Users... 5 3. Loss and Theft... 5 4. Illegal
Information Security Policy September 2009 Newman University IT Services. Information Security Policy
Contents 1. Statement 1.1 Introduction 1.2 Objectives 1.3 Scope and Policy Structure 1.4 Risk Assessment and Management 1.5 Responsibilities for Information Security 2. Compliance 3. HR Security 3.1 Terms
The problem of cloud data governance
The problem of cloud data governance Vasilis Tountopoulos, Athens Technology Center S.A. (ATC) CSP EU Forum 2014 - Thursday, 22 nd May, 2014 Focus on data protection in the cloud Why data governance in
Using AWS in the context of Australian Privacy Considerations October 2015
Using AWS in the context of Australian Privacy Considerations October 2015 (Please consult https://aws.amazon.com/compliance/aws-whitepapers/for the latest version of this paper) Page 1 of 13 Overview
Data Processing Agreement for Oracle Cloud Services
Data Processing Agreement for Oracle Cloud Services Version December 1, 2013 1. Scope and order of precedence This is an agreement concerning the Processing of Personal Data as part of Oracle s Cloud Services
Cloud Computing: Contracting and Compliance Issues for In-House Counsel
International In-house Counsel Journal Vol. 6, No. 23, Spring 2013, 1 Cloud Computing: Contracting and Compliance Issues for In-House Counsel SHAHAB AHMED Director Legal and Corporate Affairs, Microsoft,
APPROVED BY: DATE: NUMBER: PAGE: 1 of 9
1 of 9 PURPOSE: To define standards for appropriate and secure use of MCG Health electronic systems, specifically e-mail systems, Internet access, phones (static or mobile; including voice mail) wireless
INITIAL APPROVAL DATE INITIAL EFFECTIVE DATE
TITLE AND INFORMATION TECHNOLOGY RESOURCES DOCUMENT # 1107 APPROVAL LEVEL Alberta Health Services Executive Committee SPONSOR Legal & Privacy / Information Technology CATEGORY Information and Technology
Remote Access and Mobile Working Policy. Document Status. Security Classification. Level 4 - PUBLIC. Version 1.1. Approval. Review By June 2012
Remote Access and Mobile Working Policy Document Status Security Classification Version 1.1 Level 4 - PUBLIC Status DRAFT Approval Life 3 Years Review By June 2012 Owner Secure Research Database Analyst
White Paper: Cloud Security. Cloud Security
White Paper: Cloud Security Cloud Security Introduction Due to the increase in available bandwidth and technological advances in the area of virtualisation, and the desire of IT managers to provide dynamically
Third Party Security Guidelines. e-governance
for e-governance Draft DEPARTMENT OF ELECTRONICS AND INFORMATION TECHNOLOGY Ministry of Communication and Information Technology, Government of India. Document Control S/L Type of Information Document
Review of Cloud Risks: What if
Review of Cloud Risks: What if Availability of Data Ownership of Data Security of Information Privacy Controls there is no way to prevent Twitter from sharing your data (like when & where you tweeted from)
Daren Kinser Auditor, UCSD Jennifer McDonald Auditor, UCSD
Daren Kinser Auditor, UCSD Jennifer McDonald Auditor, UCSD Agenda Cloud Computing Technical Overview Cloud Related Applications Identified Risks Assessment Criteria Cloud Computing What Is It? National
TOWN OF COTTESLOE POLICY EMAIL MANAGEMENT
EMAIL MANAGEMENT POLICY STATEMENT Town of Cottesloe email accounts are intended for business transactions in support of the Town s strategic goals and objectives. Accordingly any email transmission residing
Information Integrity & Data Management
Group Standard Information Integrity & Data Management Serco recognises its responsibility to ensure that any information and data produced meets customer, legislative and regulatory requirements and is
Mobile App Developer Agreements
Mobile App Developer Agreements By Alan L. Friel Many companies that have had disputes with developers have been surprised to discover that the agreements signed, often without input from legal, failed
INFORMATION SECURITY PROCEDURES
INFORMATION AN INFORMATION SECURITY PROCEURES Parent Policy Title Information Security Policy Associated ocuments Use of Computer Facilities Statute 2009 Risk Management Policy Risk Management Procedures
www.shipmangoodwin.com Shipman & Goodwin LLP 2015. All rights reserved. @SGHealthLaw HARTFORD STAMFORD GREENWICH WASHINGTON, DC
HIPAA Compliance and Non-Business Associate Vendors: Strategies and Best Practices July 14, 2015 William J. Roberts, Esq. Shipman & Goodwin LLP 2015. All rights reserved. HARTFORD STAMFORD GREENWICH WASHINGTON,
Information Protection Readiness for Securing Personal Information
for Securing Personal Information Information Protection Readiness for Securing Personal Information May 23, 2014 Office of the City Auditor The Office of the City Auditor conducted this project in accordance
BRIDGEVALLEY COMMUNITY & TECHNICAL COLLEGE OPERATING POLICY
BRIDGEVALLEY COMMUNITY & TECHNICAL COLLEGE OPERATING POLICY Effective Date Subject Number Page April 1, 2014 PROTECTING PERSONALLY IDENTIFIABLE INFORMATION (PII) B-OP-17-14 1 of 7 Supersedes/Supplements:
BUSINESS ASSOCIATE AND DATA USE AGREEMENT NAME OF COVERED ENTITY: COVERED ENTITY FEIN/TAX ID: COVERED ENTITY ADDRESS:
BUSINESS ASSOCIATE AND DATA USE AGREEMENT NAME OF COVERED ENTITY: COVERED ENTITY FEIN/TAX ID: COVERED ENTITY ADDRESS:, City State Zip This Business Associate and Data Use Agreement ( Agreement ) is effective
Overview of the HIPAA Security Rule
Office of the Secretary Office for Civil Rights () Overview of the HIPAA Security Rule Office for Civil Rights Region IX Alicia Cornish, EOS Sheila Fischer, Supervisory EOS Topics Upon completion of this
1. The records have been created, sent or received in connection with the compilation.
Record Retention & Destruction Policy Bradley Kirschner PC recognizes that the firm s engagement and administrative files are critical assets. As such, the firm has established this formal written policy
3. Consent for the Collection, Use or Disclosure of Personal Information
PRIVACY POLICY FOR RENNIE MARKETING SYSTEMS Our privacy policy includes provisions of the Personal Information Protection Act (BC) and the Personal Information Protection and Electronic Documents Act (Canada),
Top Ten Technology Risks Facing Colleges and Universities
Top Ten Technology Risks Facing Colleges and Universities Chris Watson, MBA, CISA, CRISC Manager, Internal Audit and Risk Advisory Services cwatson@schneiderdowns.com April 23, 2012 Overview Technology
Who Should Know This Policy 2 Definitions 2 Contacts 3 Procedures 3 Forms 5 Related Documents 5 Revision History 5 FAQs 5
Information Security Policy Type: Administrative Responsible Office: Office of Technology Services Initial Policy Approved: 09/30/2009 Current Revision Approved: 08/10/2015 Policy Statement and Purpose
Email archives: no longer fit for purpose?
RESEARCH PAPER Email archives: no longer fit for purpose? Most organisations are using email archiving systems designed in the 1990s: inflexible, non-compliant and expensive May 2013 Sponsored by Contents
Records & Information Management Policy
2014 Records & Information Management Policy VerQu CONTENTS Document Control... 2 Purpose... 3 Scope... 3 Organizational Placement... 3 Roles and Responsibilities... 3 Corporate Records Manager... 3 Record
The Winnipeg Foundation Privacy Policy
The Winnipeg Foundation Privacy Policy The http://www.wpgfdn.org (the Website ) is operated by The Winnipeg Foundation (the Foundation ). The Winnipeg Foundation Privacy Policy Foundation is committed
Accepting Payment Cards and ecommerce Payments
Policy V. 4.1.1 Responsible Official: Vice President for Finance and Treasurer Effective Date: September 29, 2010 Accepting Payment Cards and ecommerce Payments Policy Statement The University of Vermont
Do you know your privacy risks? How new technologies, changing business models, and emerging regulations are changing the data-protection landscape
January 2013 Do you know your privacy risks? How new technologies, changing business models, and emerging regulations are changing the data-protection landscape At a glance Threats to data security both
HIPAA Business Associate Contract. Definitions
HIPAA Business Associate Contract Definitions Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the Privacy Rule. Examples of specific definitions:
BUSINESS ASSOCIATE AGREEMENT
BUSINESS ASSOCIATE AGREEMENT This HIPAA Business Associate Agreement ( BA Agreement ) amends, supplements, and is made a part of the Agreement ( Agreement ) entered with Client ( CLIENT ) and International
BUSINESS ASSOCIATE AGREEMENT
Note: This form is not meant to encompass all the various ways in which any particular facility may use health information and should be specifically tailored to your organization. In addition, as with
At Cambrian, Your Privacy is Our Priority. Regardless of how you deal with us on the phone, online, or in person we have strict security measures
Privacy Policy At Cambrian, Your Privacy is Our Priority At Cambrian Credit Union, we know our members are concerned about the confidentiality and security of their personal information. This Policy ensures
Cloud Computing and HIPAA Privacy and Security
Cloud Computing and HIPAA Privacy and Security This is just one example of the many online resources Practical Law Company offers. Christine A. Williams, Perkins Coie LLP, with PLC Employee Benefits &
Contracting for Cloud Computing
Contracting for Cloud Computing Geofrey L Master Mayer Brown JSM Partner +852 2843 4320 geofrey.master@mayerbrownjsm.com April 5th 2011 Mayer Brown is a global legal services organization comprising legal
The CIPM certification is comprised of two domains: Privacy Program Governance (I) and Privacy Program Operational Life Cycle (II).
Page 1 of 7 The CIPM certification is comprised of two domains: Privacy Program Governance (I) and Privacy Program Operational Life Cycle (II). Domain I provides a solid foundation for the governance of
NAVIGATING THE MAZE. 2013 LEGAL CIO ROUNDTABLE RETREAT March 3-5, 2013 The Boulders Hotel Carefree, Arizona. 2013 CIO Roundtable Retreat
NAVIGATING THE MAZE 2013 LEGAL CIO ROUNDTABLE RETREAT March 3-5, 2013 The Boulders Hotel Carefree, Arizona Information Governance Define your Process and Framework Agenda Information Governance Defined
Paychex Accounting Online Terms of Use
Paychex Accounting Online Terms of Use Paychex recommends that Client read the Terms of Use prior to using the Paychex Accounting Online Software ( Software ). If Client does not accept and agree with
The Manitoba Child Care Association PRIVACY POLICY
The Manitoba Child Care Association PRIVACY POLICY BACKGROUND The Manitoba Child Care Association is committed to comply with the legal obligations imposed by the federal government's Personal Information
Office of Security Management (213) 974-7926
PREPARED BY OCCUPATIONAL HEALTH PROGRAMS CHIEF EXECUTIVE OFFICE RISK MANAGEMENT BRANCH October 2007 Section Page STATEMENT OF PURPOSE...3 Psychiatric Emergencies AUTHORITY & CIVIL SERVICE RULES... 4 Application
TABLE OF CONTENTS. University of Northern Colorado
TABLE OF CONTENTS University of Northern Colorado HIPAA Policies and Procedures Page # Development and Maintenance of HIPAA Policies and Procedures... 1 Procedures for Updating HIPAA Policies and Procedures...
Business Associate Agreement
Business Associate Agreement This Business Associate Agreement (the Agreement ) is made by and between Business Associate, [Name of Business Associate], and Covered Entity, The Connecticut Center for Health,