===== PAGE 1 =====
POLICY TITLE:

Data Security and Management

APPLIES TO:

All users of KSU information technology resources

ADMINISTRATIVE AUTHORITY:

Chief Information Officer (CIO)

Department of Information Technology (IT)

APPROVED BY:

Kentucky State University Board of Regents

EFFECTIVE DATE:

August 8, 2025

NEXT REVIEW DATE:

August 8, 2028

## POLICY STATEMENT:

All Kentucky State University (KSU) data must be protected through appropriate security controls, access management, and backup procedures to ensure its confidentiality, integrity, and availability. This policy establishes the framework for securing university data in compliance with the Data Classification Policy and applicable laws.

## DEFINITIONS:

## Data Custodian

The entity responsible for the day-to-day maintenance, backup, and security of KSU Information Resources. The Department of Information Technology generally serves as the Data Custodian.

## Data Owner

The KSU manager or department head responsible for the business function supported by an information

===== PAGE 2 =====
resource. Data Owners are responsible for approving access to their data.

## PROCESS:

## Core Principles

KSU data will be protected through specific technical controls, access will be managed based on the principle of least privilege, and critical data will be backed up according to a defined schedule to ensure business continuity.

## Implementation

The specific technical controls, access management procedures, and backup/disaster recovery plans are detailed in their respective implementing regulations.

## REFERENCES AND RELATED MATERIALS:

KSU Data Classification Policy

KSU Data Security Controls Regulation

KSU Data Access Management Regulation

KSU Data Backup and Disaster Recovery Regulation

## CONTACTS:


<table border=1 style='margin: auto; word-wrap: break-word;'><tr><td style='text-align: center; word-wrap: break-word;'>Subject</td><td style='text-align: center; word-wrap: break-word;'>Office</td><td style='text-align: center; word-wrap: break-word;'>Telephone</td><td style='text-align: center; word-wrap: break-word;'>E-mail</td></tr><tr><td style='text-align: center; word-wrap: break-word;'>General Questions</td><td style='text-align: center; word-wrap: break-word;'>Office of the CIO</td><td style='text-align: center; word-wrap: break-word;'>(502) 597-7000</td><td style='text-align: center; word-wrap: break-word;'>Wendy.Dixie@kysu.edu</td></tr></table>

## HISTORY:


<table border=1 style='margin: auto; word-wrap: break-word;'><tr><td style='text-align: center; word-wrap: break-word;'>Revision Type</td><td style='text-align: center; word-wrap: break-word;'>Date of Issuance/Revision</td><td style='text-align: center; word-wrap: break-word;'>Drafter(s)/Editor(s)</td></tr><tr><td style='text-align: center; word-wrap: break-word;'>Issued (New Policy)</td><td style='text-align: center; word-wrap: break-word;'>Circa 2014</td><td style='text-align: center; word-wrap: break-word;'>Unknown</td></tr><tr><td style='text-align: center; word-wrap: break-word;'>Revised (New Template and Substantive Revisions)</td><td style='text-align: center; word-wrap: break-word;'>June 2025</td><td style='text-align: center; word-wrap: break-word;'>Zach Atwell</td></tr></table>