四 四 四 四 四 四 四 四 四 四 四 四 四 四 四 四 四 四 四 四 四 四 四
policies and procedures in place;b. obtain a SAS 70 report annually; andc. require the service provider to provide the University notice of any breach in security that may affect student or employee data.
In the event that University personnel detect Red Flags, the following steps should be taken:
Prevent and/or Mitigate 1. Continuously monitor covered accounts for evidence of identity theft;2. Contact the student or applicant if suspicious information is obtained;3. Change passwords or other security devices that permits access to covered accounts every 90 days or less as required;4. Change passwords immediately if suspicion of a breach exists;5. Verify identifying information before activating or opening a covered account;6. Close students account and provide the student with a new student identification number if the students account has been compromised; and7. Notify the Program Administrator, law enforcement, or other appropriate agencies of any breach of student accounts.
Protecting Student Information The following steps should be taken to prevent the likelihood of Identity Theft occurring:1. Ensure that the website is secure when entering identifying information;2. Ensure complete and secure destruction of paper documents and computer files containing student account information in accordance with the records retention policy;3. Ensure that office computers with access to students or employee information is password protected;4. Avoid using the social security numbers on documents or files (i.e. use the CWID number whenever possible);5. Ensure computer virus protection is up to date; and6. Maintain only the student or employee information that is necessary for University purposes.