KENTUCKY STATE UNIVERSITY Information Technology 400 East Main St. Frankfort, KY 40601 Phone: (502) 597-7027 Fax: (502) 597-6111
TITLE: University Data Policy SECTION: INFORMATION MANAGEMENT AND SECURITY FOR ACCESS REVIEW
REVISION DATE: 10/13 CODE: IT-IM-09
PURPOSE: To establish policies for the University with respect to data security, access and review along with data backups and disaster recovery.
OBJECTIVE: To minimize the loss of University data.
POLICY:
I. Data Security
Passwords should be treated as confidential information and must not be shared.
Password protected screen savers are mandated on all University owned computers set to a maximum time out of 15 minutes.
Employees are responsible for the security and integrity of University information and all such information should be stored on University servers, Network storage devices or University approved Cloud Storage and is NOT to be stored on local PC drives (c; drive, d: drive), USB attached storage (also known as – jump drives, flash drives, portable hard drives), CD/DVD or any other device. Local data is NOT backed up. A failure of a local drive can result in a complete loss of that data.
All employees must encryption all files that have personally identifiable information (Social security, number, date of birth, driver’s license number etc.). For Microsoft products go to “File” then “Protect Document” and follow instructions.
If an application does not have encryption capabilities it is not allowed to be used with personally identifiable information.
No personally identifiable information is allowed in the body of an email.
Encrypted files with personally identifiable information are allowed to be emailed, but the email must NOT contain the encryption key.
The encryption key may be communicated over the phone or in a separate email.
Network passwords are enforced to change every 180 days.
ISSUED: May 2013 REVIEWED: 10/13
APPROVED: SIGNATURE/TITLE:
Kentucky State University is an Equal Educational Opportunity/Affirmative Action Institution