could seriously and adversely impact KSU.

• Restricted: Less-sensitive business data intended for internal KSU use. Its unauthorized disclosure could adversely impact KSU or its partners but would not violate the law. By default, all information not defined as Confidential or Public is considered Restricted.
• Public: Information approved by KSU administration for release to the general public, which may be disclosed to anyone.

Data Owner

The KSU manager or official responsible for the business function supported by an information resource. Data owners are responsible for authorizing user access and ensuring users are trained on proper data handling.

Data Custodian

An employee responsible for the day-to-day maintenance of information resources, such as backups and physical security. This is a shared responsibility between Information Technology and data owners.

Data User

An individual authorized by a data owner to access university data to perform their job responsibilities.

Information Resources

All data, equipment, facilities, and software used by KSU to create, collect, process, store, and transmit information.

PROCESS:

Guiding Principles

The requirements set forth in this policy are based on the principles of "need to know" and "least privilege." This means information should not be disclosed to any person who does not have a legitimate and demonstrable business need for it.

Data Handling Requirements

All data users must utilize appropriate controls when storing, handling, and distributing KSU information.

Access Control

• Access to information must be granted only to individuals with a legitimate business need and specific authorization from the Data Owner.
• Systems must have controls to authenticate the identity of users before granting access.
• When an employee changes departments or leaves the University, the IT Help Desk must be notified immediately so access can be modified or removed.

Data Transmission