Confidential Data: Must be encrypted when transmitted over any external or wireless network. All such transmissions must use a virtual private network (VPN) or similar IT-approved software. Transmission over personal or non-KSU networks is prohibited.

Restricted Data: Encryption is strongly recommended when transmitting over external or wireless networks.

All KSU information should be stored on KSU servers, network storage devices, or KSU-approved cloud storage. Storing data on local PC drives is not recommended as it is not backed up.

Storage of Confidential data on personal or unauthorized equipment is prohibited unless approved by IT, in which case encryption is required.

Storage of credit card information on KSU computing equipment is prohibited.

Storage media containing sensitive (confidential or restricted) information must be completely sanitized or physically destroyed before being reused or disposed of. Deleting files is not sufficient. Users must contact IT for assistance with proper data disposal.

Loss or Breach: The loss, breach, or unauthorized access of any Restricted or Confidential data must be reported immediately to Information Technology, the Office of the General Counsel, Risk Management, and the KSU Police Department.

Open Records Requests: All requests for data or information made under the Kentucky Open Records Act must be referred to the Office of the General Counsel.