POLICY TITLE: Data Classification

APPLIES TO:

All representatives, affiliates, vendors, and contractors who use, generate, or have access to Kentucky State University data

ADMINISTRATIVE AUTHORITY: Chief Information Officer (CIO) Department of Information Technology (IT)

APPROVED BY: Kentucky State University Board of Regents

EFFECTIVE DATE: August 8, 2025

NEXT REVIEW DATE: August 8, 2028

POLICY STATEMENT:

All Kentucky State University (KSU) data must be classified according to its level of sensitivity to ensure that appropriate security controls are applied. This policy provides the framework for classifying data and outlines the baseline requirements for its protection. All users are required to familiarize themselves with and adhere to this policy to protect the university's information from unauthorized disclosure, use, modification, or deletion, and to ensure compliance with applicable laws and regulations.

DEFINITIONS:

Data Classification Level

• Confidential: The most sensitive data, intended for use strictly within KSU and protected by law or confidentiality agreements (e.g., data covered by FERPA, HIPAA, GLBA, PCI-DSS). Its unauthorized disclosure