Data Security

Passwords should be treated as confidential information and must not be shared.

Password protected screen savers are mandated on all University owned computers set to a maximum time out of 15 minutes.

Employees are responsible for the security and integrity of University information and all such information should be stored on University servers, Network storage devices or University approved Cloud Storage and is NOT to be stored on local PC drives (c; drive, d: drive), USB attached storage (also known as

jump drives, flash drives, portable hard drives), CD/DVD or any other device. Local data is NOT backed up. A failure of a local drive can result in a complete loss of that data.

All employees must encryption all files that have personally identifiable information (Social security, number, date of birth, driver's license number etc.). For Microsoft products go to “File” then “Protect Document” and follow instructions.

If an application does not have encryption capabilities it is not allowed to be used with personally identifiable information.

No personally identifiable information is allowed in the body of an email.

Encrypted files with personally identifiable information are allowed to be emailed, but the email must NOT contain the encryption key.

The encryption key may be communicated over the phone or in a separate email.

Network passwords are enforced to change every 180 days.

All requests to reset passwords are performed by the Information Technology Helpdesk or online. Users must give proof of identity prior to the password being reset. Proof of identity includes KSU ID number, show ID if in person or other information known only to the person.

All backups of personally identifiable information must be encrypted.

Information Technology will serve as the custodian of University data.

Module managers/department heads will serve as data owners.