Passwords must be treated as confidential information and must not be shared.

Network passwords are required to be changed every 180 days.

All password resets are performed by the Information Technology (IT) Help Desk or online. Users must provide proof of identity (e.g., KSU ID number) before a password will be reset.

Password-protected screen savers are mandated on all university-owned computers and must be set to a maximum timeout of 15 minutes.

All KSU information must be stored on university servers, network storage devices, or university-approved cloud storage. Storing KSU information on local PC drives (C: drive), USB drives, CDs/DVD, or other portable devices is prohibited.

All files containing Personally Identifiable Information (PII) must be encrypted. Instructions for encrypting Microsoft Office documents are to use the "Protect Document" feature under the "File" menu.

Applications that do not have encryption capabilities must not be used to handle PII.

PII is not permitted in the body of an email.

Encrypted files containing PII may be sent via email, but the email must not contain the encryption key or password. The key may be communicated over the phone or in a separate email.

All backups of PII must be encrypted.

Data Security and Management Policy