[ { "page": 1, "items": [ { "page": 1, "type": "TITLE", "location": { "l": 177.84, "t": 728.4, "r": 510.96, "b": 680.4 }, "text": "KENTUCKY STATE UNIVERSITY\nPOLICIES AND PROCEDURES", "reading_order": 0, "level": 1 }, { "page": 1, "type": "TITLE", "location": { "l": 172.32, "t": 616.32, "r": 438.72, "b": 599.04 }, "text": "DATA CLASSIFCAITON POLICY", "reading_order": 1, "level": 1 }, { "page": 1, "type": "TITLE", "location": { "l": 88.32, "t": 585.36, "r": 154.08, "b": 569.28 }, "text": "1. Policy", "reading_order": 2, "level": 2 }, { "page": 1, "type": "TEXT", "location": { "l": 68.64, "t": 550.56, "r": 536.16, "b": 466.56 }, "text": "All representatives, affiliates, vendors, contractors or subcontractors of Kentucky State University (KSU) who use, generate, own, come into contact, or have access to, or possession of, KSU internal information are required to familiarize themselves with this data classification policy and to consistently use this policy in their daily KSU business activities or operations. Information is either Public, Confidential, or Restricted information; all three are defined later in this document.", "reading_order": 3 }, { "page": 1, "type": "TEXT", "location": { "l": 74.64, "t": 455.76, "r": 535.92, "b": 412.56 }, "text": "This data classification policy is applicable to all information created, used, or shared at KSU. This includes electronic, hardcopy, and data/information shared verbally or visually.", "reading_order": 4 }, { "page": 1, "type": "TEXT", "location": { "l": 74.64, "t": 401.04, "r": 536.88, "b": 317.04 }, "text": "Data classification, as defined in this document, is based on the concept of need to know, or the principle of least privilege. This term means that information is not disclosed to any person who does not have a legitimate and demonstrable business need or does not have specific authorization to receive the information. This privilege, when combined with the policies defined in this document, will protect the institution’s information from unauthorized disclosure, use, modification, and deletion.", "reading_order": 5 }, { "page": 1, "type": "TITLE", "location": { "l": 75.84, "t": 305.28, "r": 160.8, "b": 291.36 }, "text": "PROCEDURES", "reading_order": 6, "level": 2 }, { "page": 1, "type": "TITLE", "location": { "l": 76.8, "t": 277.44, "r": 180.48, "b": 263.52 }, "text": "1. Classification", "reading_order": 7, "level": 2 }, { "page": 1, "type": "TEXT", "location": { "l": 76.08, "t": 250.8, "r": 283.92, "b": 236.16 }, "text": "KSU data will be classified as followed:", "reading_order": 8 }, { "page": 1, "type": "TEXT", "location": { "l": 74.4, "t": 223.44, "r": 536.4, "b": 153.12 }, "text": "Confidential: This classification applies to the most sensitive data or information that is intended for use strictly within KSU, protected by any confidentiality agreements, or data protected by federal or state law, such as FERPA, HIPPA, GLBA or PCI-DSS. Its unauthorized disclosure could seriously and adversely impact KSU, its customers, its business partners, and its suppliers.", "reading_order": 9 }, { "page": 1, "type": "TEXT", "location": { "l": 75.12, "t": 141.6, "r": 536.64, "b": 72 }, "text": "Restricted: This classification applies to less-sensitive business data or information that is intended for use within KSU. By default, all information that is not defined as confidential or public should be treated as restricted. Its unauthorized disclosure could adversely impact KSU, or its customers, suppliers, business partners, or employees, but would not violate law.", "reading_order": 10 }, { "page": 1, "type": "TEXT", "location": { "l": 75.84, "t": 59.76, "r": 535.92, "b": 31.2 }, "text": "Public: This classification applies to data or information that has been approved by KSU administration for release and availability to the general public. This data or", "reading_order": 11 } ] }, { "page": 2, "items": [ { "page": 2, "type": "TEXT", "location": { "l": 75.84, "t": 700.32, "r": 534.96, "b": 671.04 }, "text": "information may be disclosed to any individual regardless of their relationship to KSU. While data or", "reading_order": 0 }, { "page": 2, "type": "TEXT", "location": { "l": 74.88, "t": 645.6, "r": 537.12, "b": 602.64 }, "text": "information that is classified as public has no restrictions, necessary controls and caution should always be exercised to ensure unauthorized modification does not occur and the integrity of the data remains intact.", "reading_order": 1 }, { "page": 2, "type": "TEXT", "location": { "l": 75.84, "t": 590.16, "r": 212.88, "b": 576.24 }, "text": "Data Classification Chart", "reading_order": 2 }, { "page": 2, "type": "TITLE", "location": { "l": 75.6, "t": 562.8, "r": 239.04, "b": 549.36 }, "text": "2. Data and Access Control", "reading_order": 3, "level": 2 }, { "page": 2, "type": "TEXT", "location": { "l": 74.88, "t": 522.48, "r": 537.12, "b": 466.56 }, "text": "Each of the requirements set forth in this policy are based on the concept of need to know unless data is classified as public. Information must be disclosed only to those individuals who have a legitimate business need, specific authorization or approval for the information.", "reading_order": 4 }, { "page": 2, "type": "TEXT", "location": { "l": 74.64, "t": 454.32, "r": 536.88, "b": 370.08 }, "text": "The proper controls shall be in place to authenticate the identity of users and to validate each user's authorization before allowing the user to access information or services on the system. Data used for authentication shall be protected from unauthorized access. Controls shall be in place to ensure that only personnel with the proper authorization and a need to know are granted access to KSU's systems and their resources. Remote access shall be controlled through identification and authentication mechanisms.", "reading_order": 5 }, { "page": 2, "type": "TEXT", "location": { "l": 74.64, "t": 358.56, "r": 537.6, "b": 206.4 }, "text": "Data owners must approve users who will be permitted to gain access to information, and the uses to which this information will be utilized. Requests for access to KSU email, network, or Banner systems must be made to Information Technology. A written or email request must be submitted for all additions or changes to access Information Resources. When an employee changes departments the IT Help Desk must be notified, so access to that department's data can be removed from Information Resources. If access is still required by the employee, it must be approved again by the data owner. When an employee leaves the University, the IT Help Desk must be notified, so access to these Information Resources can be removed. Ex-employees may continue to have access to University email for a limited time, and if a business needs to require, with written approval from their Vice President.", "reading_order": 6 }, { "page": 2, "type": "TEXT", "location": { "l": 74.88, "t": 195.12, "r": 536.64, "b": 152.88 }, "text": "All data users must take steps to ensure that appropriate controls are utilized in the storage, handling, distribution, and regular usage of electronic information regardless of classification.", "reading_order": 7 }, { "page": 2, "type": "TITLE", "location": { "l": 75.6, "t": 140.16, "r": 181.92, "b": 125.52 }, "text": "3. Transmission", "reading_order": 8, "level": 2 }, { "page": 2, "type": "TEXT", "location": { "l": 74.64, "t": 113.28, "r": 536.64, "b": 84 }, "text": "Confidential data or files that are to be transmitted over external communication networks, wireless or between computers, must be sent only in encrypted form.", "reading_order": 9 } ] }, { "page": 3, "items": [ { "page": 3, "type": "TEXT", "location": { "l": 74.64, "t": 658.08, "r": 537.12, "b": 560.88 }, "text": "electronic mail systems, the Internet, etc. All such transmissions must use a virtual private network, encryption, or similar software as approved by Information Technology. Transmission over personal, or any non-KSU, network is prohibited. When transmitting restricted data over external communication networks, wireless or between computers, encryption is strongly recommended. While data that is classified as public has no transmission restrictions, caution should always be exercised when using or transmitting KSU information.", "reading_order": 0 }, { "page": 3, "type": "TITLE", "location": { "l": 75.6, "t": 521.28, "r": 150, "b": 506.64 }, "text": "4. Storage", "reading_order": 1, "level": 2 }, { "page": 3, "type": "TEXT", "location": { "l": 74.88, "t": 495.12, "r": 537.12, "b": 411.12 }, "text": "All KSU employees are responsible for the security and integrity of University information. All such information should be stored on University servers, network storage devices, or University approved Cloud Storage. Data stored on local PC drives is not recommended because such data is not backed up and a failure of a local drive can result in a complete loss of that data. Caution should always be exercised when storing KSU information.", "reading_order": 2 }, { "page": 3, "type": "TEXT", "location": { "l": 74.88, "t": 399.6, "r": 536.16, "b": 342.96 }, "text": "Storage of confidential data on personal or unauthorized computing equipment is prohibited unless approval is received by Information Technology. If approved, then encryption will be required. Storage of credit card information is prohibited on computing equipment.", "reading_order": 3 }, { "page": 3, "type": "TEXT", "location": { "l": 74.64, "t": 331.44, "r": 537.6, "b": 233.76 }, "text": "Storage media containing sensitive (i.e. restricted or confidential) information shall be sanitized completely before reassigning that medium to a different user or disposing of it when no longer used. Simply deleting the data from the media is not sufficient. A method must be used that completely erases all data. When disposing of media containing data that cannot be completely erased, it must be destroyed in a manner approved by Information Technology. Please contact Information Technology when needing to dispose or reuse media that contains sensitive data.", "reading_order": 4 }, { "page": 3, "type": "TITLE", "location": { "l": 75.36, "t": 221.76, "r": 294.96, "b": 207.36 }, "text": "5. Documented Backup and Recovery", "reading_order": 5, "level": 2 }, { "page": 3, "type": "TEXT", "location": { "l": 75.36, "t": 194.88, "r": 493.44, "b": 180 }, "text": "All confidential data must have a documented backup and recovery procedure.", "reading_order": 6 }, { "page": 3, "type": "TITLE", "location": { "l": 75.84, "t": 167.04, "r": 190.56, "b": 153.36 }, "text": "6. Data Retention", "reading_order": 7, "level": 2 }, { "page": 3, "type": "TEXT", "location": { "l": 75.84, "t": 140.4, "r": 463.68, "b": 126 }, "text": "Data retention will adhere to KSU's data retention policy. (Will be a link)", "reading_order": 8 }, { "page": 3, "type": "TITLE", "location": { "l": 75.6, "t": 112.56, "r": 187.92, "b": 98.4 }, "text": "7. Audit Controls", "reading_order": 9, "level": 2 } ] }, { "page": 4, "items": [ { "page": 4, "type": "TEXT", "location": { "l": 75.12, "t": 672, "r": 536.88, "b": 642.24 }, "text": "Data owners must actively monitor and review their systems and procedures for potential misuse and/or unauthorized access.", "reading_order": 0 }, { "page": 4, "type": "TEXT", "location": { "l": 75.36, "t": 631.68, "r": 481.92, "b": 616.08 }, "text": "Data owners and users must adhere to the Banner Security Audit procedure.", "reading_order": 1 }, { "page": 4, "type": "TITLE", "location": { "l": 75.6, "t": 604.08, "r": 286.32, "b": 589.2 }, "text": "8. Requests for Data or Information", "reading_order": 2, "level": 2 }, { "page": 4, "type": "TEXT", "location": { "l": 75.6, "t": 577.2, "r": 535.92, "b": 547.92 }, "text": "Refer all requests for data or information under the open records law to the General Counsel's office.", "reading_order": 3 }, { "page": 4, "type": "TITLE", "location": { "l": 75.6, "t": 535.68, "r": 354.72, "b": 521.04 }, "text": "9. Loss of Restricted or Confidential Information", "reading_order": 4, "level": 2 }, { "page": 4, "type": "TEXT", "location": { "l": 74.88, "t": 509.04, "r": 535.92, "b": 480 }, "text": "The loss, breach or unauthorized access of any restricted or confidential data or information must be reported immediately to:", "reading_order": 5 }, { "page": 4, "type": "LIST_ITEM", "location": { "l": 75.84, "t": 467.28, "r": 239.04, "b": 453.36 }, "text": "Information Technology", "marker": "•", "list_id": "L1", "level": 0, "reading_order": 6 }, { "page": 4, "type": "LIST_ITEM", "location": { "l": 76.8, "t": 453.12, "r": 197.76, "b": 440.64 }, "text": "General Counsel", "marker": "•", "list_id": "L1", "level": 0, "reading_order": 7 }, { "page": 4, "type": "LIST_ITEM", "location": { "l": 76.32, "t": 439.44, "r": 206.64, "b": 426.72 }, "text": "Risk Management", "marker": "•", "list_id": "L1", "level": 0, "reading_order": 8 }, { "page": 4, "type": "LIST_ITEM", "location": { "l": 75.84, "t": 425.76, "r": 236.64, "b": 412.56 }, "text": "KSU Police Department", "marker": "•", "list_id": "L1", "level": 0, "reading_order": 9 }, { "page": 4, "type": "TEXT", "location": { "l": 75.36, "t": 399.84, "r": 535.68, "b": 370.8 }, "text": "Theft or loss of any Information Resource containing any sensitive data must be reported to:", "reading_order": 10 }, { "page": 4, "type": "LIST_ITEM", "location": { "l": 76.08, "t": 358.32, "r": 236.64, "b": 345.12 }, "text": "KSU Police Department", "marker": "•", "list_id": "L2", "level": 0, "reading_order": 11 }, { "page": 4, "type": "LIST_ITEM", "location": { "l": 76.08, "t": 343.92, "r": 238.56, "b": 330 }, "text": "Information Technology", "marker": "•", "list_id": "L2", "level": 0, "reading_order": 12 }, { "page": 4, "type": "TITLE", "location": { "l": 76.08, "t": 317.28, "r": 169.2, "b": 303.6 }, "text": "10. Definitions", "reading_order": 13, "level": 2 }, { "page": 4, "type": "TEXT", "location": { "l": 75.12, "t": 290.64, "r": 535.92, "b": 233.28 }, "text": "Data: Information which is recorded - regardless of form or media – that is used to support the business of the University, whether in an administrative or research capacity. Data may be saved or transmitted in hard copy (printed or written), digital/electronic (video, audio, or photo images) or other formats.", "reading_order": 14 }, { "page": 4, "type": "TEXT", "location": { "l": 74.88, "t": 222.72, "r": 536.88, "b": 138.24 }, "text": "Data Custodian: An employee who is responsible for day-to-day maintenance, backup and recovery, granting access and privileges, and physical security of KSU Information Resources. The Data Custodian shall adhere to information security policies and procedures to manage data or information resources in their care. This is shared a responsibility between Information Technology (backup and recovery) and Data Owners (access and control).", "reading_order": 15 }, { "page": 4, "type": "TEXT", "location": { "l": 76.32, "t": 100.08, "r": 535.68, "b": 84.48 }, "text": "Data Owner or Module Manager: The manager or university official responsible for the", "reading_order": 16 } ] }, { "page": 5, "items": [ { "page": 5, "type": "TEXT", "location": { "l": 74.64, "t": 699.84, "r": 536.64, "b": 629.52 }, "text": "business function supported by the Information Resource or the individual upon whom responsibility rests for administering the program using the Information Resources. In addition to following this and other University policies relating to data, the data owner is responsible for training users on the proper handling of data and for the capture, management, and dissemination of data.", "reading_order": 0 }, { "page": 5, "type": "TEXT", "location": { "l": 75.6, "t": 617.76, "r": 535.92, "b": 575.04 }, "text": "Data Ownership: KSU has ownership of all institutional data; data owners, individual units, and/or departments may act as stewards, and may supervise the ways in which certain types of information are used and protected", "reading_order": 1 }, { "page": 5, "type": "TEXT", "location": { "l": 76.08, "t": 562.56, "r": 536.16, "b": 521.04 }, "text": "Data User or User: An individual who is authorized by the Data Owner to access University data as part of their responsibilities or for completion of their role in the University.", "reading_order": 2 }, { "page": 5, "type": "TEXT", "location": { "l": 74.88, "t": 508.8, "r": 536.16, "b": 356.64 }, "text": "Information Resources: Any data and information used by KSU. This includes, but is not limited to procedures, equipment, facilities, software, and data that are designed, built, operated, and maintained to create, collect, record, process, store, retrieve, display, share, and transmit information. This may include, but is not limited to, any and all computer printouts, online display devices, mass storage media, and all computer-related activities involving any device capable of receiving email, browsing web sites, or otherwise capable of receiving, storing, managing, or transmitting data including, but not limited to, servers, personal computers, notebook computers, handheld computers, mobile devices, pagers, distributed processing systems, telecommunication resources, network environments, telephones, fax machines, printers, and hosted services.", "reading_order": 3 }, { "page": 5, "type": "TITLE", "location": { "l": 87.84, "t": 330.48, "r": 229.2, "b": 315.84 }, "text": "2. Entities Affected", "marker": "2.", "reading_order": 4, "level": 2 }, { "page": 5, "type": "LIST_ITEM", "location": { "l": 88.08, "t": 312.24, "r": 219.6, "b": 298.8 }, "text": "Campus Community", "marker": "•", "list_id": "L3", "level": 0, "reading_order": 5 }, { "page": 5, "type": "LIST_ITEM", "location": { "l": 88.08, "t": 296.64, "r": 238.56, "b": 282.72 }, "text": "Information Technology", "marker": "•", "list_id": "L3", "level": 0, "reading_order": 6 }, { "page": 5, "type": "TITLE", "location": { "l": 87.6, "t": 268.08, "r": 374.64, "b": 251.52 }, "text": "3. Policy Owner/Interpreting Authority", "reading_order": 7, "level": 2 }, { "page": 5, "type": "TEXT", "location": { "l": 105.84, "t": 235.68, "r": 404.88, "b": 207.84 }, "text": "Executive Vice President of Finance and Administration\nChief Information Technology Officer", "reading_order": 8 }, { "page": 5, "type": "TITLE", "location": { "l": 87.84, "t": 192.24, "r": 224.4, "b": 175.68 }, "text": "4. Related Policies", "reading_order": 9, "level": 2 }, { "page": 5, "type": "TITLE", "location": { "l": 87.84, "t": 157.2, "r": 363.6, "b": 141.12 }, "text": "5. Statutory or Regulatory References", "reading_order": 10, "level": 2 } ] } ]