IUP Data Classification Policy

Introduction

Indiana University of Pennsylvania produces, collects, and uses many different types of electronic and paper data records to fulfill its mission. Federal, state, and local law as well as various university policies mandate privacy and protection, as well as openness, of certain records.

Purpose

The purpose of data classification is to establish a framework for classifying university data records based on sensitivity, value, and criticality.  Classifying university records is the initial step in determining security controls for the protection of data.

University data is defined as all data owned, collected, licensed, or otherwise in possession of IUP.

Scope

This policy applies to all individuals with access or authorization to produce, collect, or use IUP data. The data subjects are university records and not records created for personal use. Specifically, the guideline applies to those who are responsible for classifying and approving the use of IUP data.

Data Classification

Data classification, in the context of information security, is the classification of data based on its level of sensitivity and the impact to the university should that data be disclosed, altered, or destroyed without authorization. The classification of data helps determine what baseline security controls are appropriate for safeguarding that data. All institutional data should be classified into one of the three classifications level listed below:

Public Data

• Is data that is intended for public disclosure and controlled by the university.
• The loss of confidentiality, integrity, or availability of the data has no adverse impact on the university.
• Requires authentication to publish and modify.
• Examples: News releases, university catalog, university policies, event schedules, legally mandated disclosures, university directory information.

Private Data

• Is data not generally available to the public and limited to individuals with an IUP computing account.
• The loss of confidentiality, integrity, or availability of the data could have a mildly adverse impact on the university.
• Tightly controlled user and network access based on job responsibilities.
• Stored and transferred using encryption where feasible.
• Likely subject to Pennsylvania’s Right-To-Know Law with review for potential disclosure.
• Examples: Personnel records, Student records (non-FERPA), tactical plans, non-public reports,budget information, deliberations about business processes, non-public course data stored in Learning Management System, IT documentation, Email communications, ID numbers.

Restricted Data

• Restricted Data includes confidential or sensitive information.
• Is data required by law/regulation to be protected.
• The loss of the confidentiality, integrity, or availability of the data could have a significant adverse impact on the university.
• Highest level of controlled user and network security.
• Requires approval by leadership based on review of job responsibilities along with data use and requirements.
• Stored and transmitted using encryption.
• Not stored on shared or general-purpose storage including email.
• Not subject to Pennsylvania’s Right-to-Know Law pursuant to specific exemptions in the Law.
• Examples: Family Educational Rights and Privacy Act (FERPA) protected student records, Gramm-Leach Bliley Act (GLBA) protecting financial records, and medical records (HIPPA),  SSN, payment card data, banking account numbers, passwords.

Guidelines

IUP employees will be informed of these data classifications in addition to FERPA and other related policies. The university will inventory and manage data use within the Restricted and Confidential or Sensitive data elements.

Lead data stewards or domain experts are leaders who oversee the lifecycle of university data and who will determine the data classifications for their respective department, area, or function. These selected and privileged individuals may also serve as “security officers” to grant access to Restricted Data.  At the current juncture, the University Reporting Team and Banner Security Officers will serve as the data stewards until a formal structure is implemented.

Institutional Research is the lead in managing data classification in relation to IUP requirements locally and within the Pennsylvania State System of Higher Education.

Classification should be revisited on a periodic basis or when new technologies or systems are implemented. This activity again should be led by Institutional Research and data stewards or domain experts.

Definitions and Supporting Documentation

• Confidential or Sensitive Data is typically classified as Restricted data based on the classification policy.
• Data Steward is a senior-level employee of the university who oversees the lifecycle of one or more sets of institutional data.
• Institutional/University Data is defined as all data owned, collected, licensed, or otherwise in possession of IUP.
• Non-Public Information is defined as any information classified as Private or Restricted data based on the classification policy. 

Resources

IUP IT Policies

FERPA

Computer Account Retention Policy

Gram-Leach-Biley Act

Information Protection Policy

IUP Acceptable Use Policy

Health Service Policies

Right-to-Know Policy