• Passwords must be treated as confidential information and must not be shared.
• Network passwords are required to be changed every 180 days.
• All password resets are performed by the Information Technology (IT) Help Desk or online. Users must provide proof of identity (e.g., KSU ID number) before a password will be reset.

Workstation and Device Security

• Password-protected screen savers are mandated on all university-owned computers and must be set to a maximum timeout of 15 minutes.
• All KSU information must be stored on university servers, network storage devices, or university-approved cloud storage. Storing KSU information on local PC drives (C: drive), USB drives, CDs/DVD, or other portable devices is prohibited.

Encryption

• All files containing Personally Identifiable Information (PII) must be encrypted. Instructions for encrypting Microsoft Office documents are to use the "Protect Document" feature under the "File" menu.
• Applications that do not have encryption capabilities must not be used to handle PII.
• PII is not permitted in the body of an email.
• Encrypted files containing PII may be sent via email, but the email must not contain the encryption key or password. The key may be communicated over the phone or in a separate email.
• All backups of PII must be encrypted.

REFERENCES AND RELATED MATERIALS:

• Data Security and Management Policy

CONTACTS:

HISTORY: