All requests to reset passwords are performed by the Information Technology Helpdesk or online. Users must give proof of identity prior to the password being reset. Proof of identity includes KSU ID number, show ID if in person or other information known only to the person.

All backups of personally identifiable information must be encrypted.

Information Technology will serve as the custodian of University data.

Module managers/department heads will serve as data owners.

Data Owners must approve access to their data. User will submit completed access request forms from the Intranet with approval for access to the IT Help Desk.

IT will fulfill all completed and approved forms, incomplete forms will returned to owners

Requestor will be notified via email when completed.

A request form must be submitted for all additions or changes to access.

When and employee changes departments the IT Help Desk must be notified, so access to that department's data can be removed. If access is still required by the employee it must be approved again by the data owner.

When and employee leaves the University the IT Helpdesk must be notified, so access to University systems can be removed.

Ex-employees may continue to have access to University email for a limited time with approval from their Vice President.

Risk Management with assistance from IT will periodically send out security reports to all data owners for review.

Periodic audit reviews will be conducted by Risk Management Department with assistance from IT.

Information Technology as custodians of data will perform daily backups and store tapes in a fireproof safe.

The IT department will maintain a weekly archive of backup tapes in a secure offsite storage location.

The IT department will maintain a six month archive of data tapes in a secure offsite storage location.

The IT department will maintain an annual archive of data tapes in a secure offsite storage location.